MENU
An analyst is alerted for a malicious file hash. After analysis, the analyst determined that an internal workstation is communicating over port 80 with an external server and that the file hash is associated with Duqu malware. Which tactics, techniques, and procedures align with this analysis?
Suggested Answer: A
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
32 comments · newest first
UL
Ulysses
10 months ago
Wait, are we sure it's Duqu? Seems a bit off.
YU
Yun
10 months ago
I agree, port 80 is a classic for C2!
LE
Lelia
11 months ago
C is also a possibility, but I lean towards A.
RE
Ressie
11 months ago
B seems more relevant with SMB involved.
EL
Elmer
11 months ago
Definitely sounds like Command and Control with Duqu.
MA
Matilda
11 months ago
I keep mixing up the techniques. I thought SMB was more about lateral movement, but this scenario feels like it’s more about command and control. Is A definitely the best choice?
DE
Delfina
11 months ago
I practiced a similar question about malware tactics, and I think Duqu is primarily about Command and Control, so option A seems right to me.
CH
Chantell
12 months ago
I'm not entirely sure, but I feel like the communication over port 80 could relate to some kind of discovery technique. Maybe option D?
CA
Cassandra
12 months ago
I remember studying Duqu and its connection to Command and Control. I think option A makes sense here.
KA
Kate
1 year ago
I'm feeling confident about this one. The communication over port 80 and the Duqu malware association point to Command and Control and Application Layer Protocol tactics, which match option A. I'll go with that.
MA
Margery
1 year ago
Okay, I've got a strategy here. First, I'll eliminate the options that don't seem to match the details given. Then I'll focus on the remaining options and try to determine which one best aligns with the Duqu malware and the communication over port 80.
TI
Tijuana
1 year ago
Hmm, I'm a bit unsure about this one. The question mentions tactics, techniques, and procedures, so I need to think about the broader attack lifecycle, not just the specific details provided. Let me re-read the options carefully.
VI
Viva
1 year ago
This one seems pretty straightforward. The key details are the malicious file hash, the internal workstation communicating over port 80 with an external server, and the association with Duqu malware. I think option A is the best fit.
HE
Herschel
2 years ago
I hope the exam question isn't as 'Duqu'ced up as this one. Anyway, A) seems like the best choice to me.
MA
Margery
1 year ago
User 2: Yeah, Command and Control, Application Layer Protocol, Duqu make sense.
MI
Miriam
1 year ago
User 1: I agree, A) seems like the right choice.
ED
Eden
2 years ago
But Vernice, the analysis mentioned port 80 communication, which is not related to SMB/Windows Admin Shares.
VE
Vernice
2 years ago
I believe the answer is B) Discovery, Remote Services: SMB/Windows Admin Shares, Duqu.
CO
Cora
2 years ago
I agree with Eden, because the internal workstation communicating with an external server over port 80 aligns with Command and Control tactics.
TI
Timothy
2 years ago
A) is the way to go, no doubt. Duqu is notorious for using Application Layer Protocol for its Command and Control activities.
LA
Lawrence
2 years ago
Hmm, I'm not sure. D) Discovery, System Network Configuration Discovery, Duqu could also be a possibility, as the analyst was alerted about a malicious file hash.
BE
Beula
1 year ago
True, but C) Lateral Movement, Remote Services: SMB/Windows Admin Shares, Duqu aligns better with the communication over port 80 with an external server.
AL
Alfreda
2 years ago
I agree, but B) Discovery, Remote Services: SMB/Windows Admin Shares, Duqu could also be a valid option.
LO
Loreta
2 years ago
I think A) Command and Control, Application Layer Protocol, Duqu makes more sense in this scenario.
ED
Eden
2 years ago
I think the answer is A) Command and Control, Application Layer Protocol, Duqu.
FR
Frederic
2 years ago
I think C) Lateral Movement, Remote Services: SMB/Windows Admin Shares, Duqu is the correct answer. The workstation communicating with an external server suggests lateral movement.
KI
King
2 years ago
User 2
CL
Clay
2 years ago
User 1
WA
Wade
2 years ago
A) Definitely! The communication over port 80 and the file hash association with Duqu malware point to Command and Control, Application Layer Protocol, and Duqu tactics, techniques, and procedures.
AN
Angelyn
2 years ago
C) Maybe there's also Lateral Movement involved with Remote Services: SMB/Windows Admin Shares.
TA
Tamar
2 years ago
B) I agree, it could also involve Discovery and Remote Services: SMB/Windows Admin Shares.
AM
Amie
2 years ago
A) Definitely! The communication over port 80 and the file hash association with Duqu malware point to Command and Control, Application Layer Protocol, and Duqu tactics, techniques, and procedures.