GCIH Command and Control Detection Quiz

1. Which log source is most valuable for detecting lateral movement associated with C2 activity?

Web server access logs

Windows Event Logs and Sysmon logs

Application error logs

Printer logs

2. Which of the following best describes 'command injection' in the context of C2 operations?

Sending unauthorized commands through the C2 channel

Blocking attacker commands at the gateway

Encrypting all outbound traffic

Disabling network protocols

3. In incident response, what is the primary benefit of identifying C2 infrastructure early?

To arrest attackers immediately

To contain the breach and prevent further attacker commands

To improve firewall performance

To reduce IT support costs

4. Which network-based indicator suggests potential C2 communication?

Connections to known malicious IP addresses

Unusual outbound ports and protocols

Large data transfers at odd hours

All of the above

5. What is the primary purpose of 'domain generation algorithms' (DGA) in C2 infrastructure?

To improve DNS query speed

Generate multiple domains to evade detection and blocking

To encrypt network traffic

To verify SSL certificates

6. Which analysis method involves executing suspicious files in an isolated environment to observe C2 behavior?

Static analysis

Dynamic analysis or sandbox analysis

Code review

Penetration testing

7. In C2 detection, what does 'exfiltration' typically refer to?

Unauthorized removal of data from a network

Firewall rule configuration

Antivirus signature updates

User account lockout procedures

8. Which of the following is a characteristic of 'covert channels' used in C2 communications?

High-bandwidth data transfers

Legitimate-looking traffic that hides malicious commands

Only UDP protocol usage

Broadcast-only communication

9. What is the primary advantage of using SIEM tools for C2 detection?

Centralized log collection and correlation of suspicious events

Faster internet connectivity

Lower hardware costs

Easier user account management

10. In threat hunting, what does 'YARA rule' primarily help detect?

Network latency issues

Malware patterns and C2 signatures in files and memory

User authentication failures

Disk space utilization

11. Which network protocol is commonly abused by attackers for command and control due to its legitimate use and difficulty in filtering?

HTTP/HTTPS

SMTP

DNS

All of the above

12. What is a 'proxy chain' in the context of C2 infrastructure?

A series of intermediate servers used to obfuscate attacker location

A firewall rule set

A backup communication channel

A data encryption method

13. Which of the following best describes 'DNS tunneling' as a C2 technique?

Encrypting DNS queries with TLS

Hiding malicious commands in DNS requests and responses

Blocking DNS traffic at the firewall

Using DNS load balancing

14. In C2 detection, what is the significance of analyzing SSL/TLS certificates on suspicious connections?

To verify legitimate HTTPS traffic only

To identify self-signed or recently issued certificates used by attackers

To block all encrypted traffic

To measure network bandwidth usage

15. Which tool is commonly used for passive DNS monitoring to detect C2 communications?

Wireshark

Passive DNS databases

Nmap

Metasploit

16. What is a 'fast flux' network in the context of C2 infrastructure?

A network with high-speed connections

Rapidly changing IP addresses associated with a single domain

A peer-to-peer botnet communication model

Encrypted DNS traffic patterns

17. Which analysis method involves monitoring network traffic to identify C2 communications by examining flow patterns?

Static analysis

Behavioral analysis

Netflow analysis

Binary disassembly

18. In the context of C2 detection, what does 'dead drop' refer to?

A compromised server that stores malware

A pre-arranged location where attackers leave data for later retrieval

Encrypted traffic between two endpoints

A firewall rule that blocks outbound connections

19. Which of the following is a common indicator of compromise (IOC) for detecting C2 activity?

Unusual DNS queries to suspicious domains

Abnormal outbound traffic on non-standard ports

Binary data in HTTP headers

All of the above

20. What is the primary characteristic of a beaconing pattern in C2 communications?

Random intervals between connections

Regular, periodic outbound connections to a remote server

High-volume data transfers only

Connections limited to internal networks

GCIH Command and Control Detection Quiz

1. Which log source is most valuable for detecting lateral movement associated with C2 activity?

2.

What first name or nickname would you like us to use?

2. Which of the following best describes 'command injection' in the context of C2 operations?

3. In incident response, what is the primary benefit of identifying C2 infrastructure early?

4. Which network-based indicator suggests potential C2 communication?

5. What is the primary purpose of 'domain generation algorithms' (DGA) in C2 infrastructure?

6. Which analysis method involves executing suspicious files in an isolated environment to observe C2 behavior?

7. In C2 detection, what does 'exfiltration' typically refer to?

8. Which of the following is a characteristic of 'covert channels' used in C2 communications?

9. What is the primary advantage of using SIEM tools for C2 detection?

10. In threat hunting, what does 'YARA rule' primarily help detect?

11. Which network protocol is commonly abused by attackers for command and control due to its legitimate use and difficulty in filtering?

12. What is a 'proxy chain' in the context of C2 infrastructure?

13. Which of the following best describes 'DNS tunneling' as a C2 technique?

14. In C2 detection, what is the significance of analyzing SSL/TLS certificates on suspicious connections?

15. Which tool is commonly used for passive DNS monitoring to detect C2 communications?

16. What is a 'fast flux' network in the context of C2 infrastructure?

17. Which analysis method involves monitoring network traffic to identify C2 communications by examining flow patterns?

18. In the context of C2 detection, what does 'dead drop' refer to?

19. Which of the following is a common indicator of compromise (IOC) for detecting C2 activity?

20. What is the primary characteristic of a beaconing pattern in C2 communications?