SANS Advanced Incident Response, Threat Hunting, And Digital Forensics (FOR508) Practice Test

The combination of which two ASEP start values can each independently provide persistence for malicious code?

0x02 and 0x00 0x01 and 0x03 0x04 and 0x08 0x10 and 0x20

Correct Answer:

0x02 and 0x00

Explanation:

In ASEP, each start value corresponds to a distinct persistence path. The requirement is that each start value, on its own, can maintain persistence for malicious code. The pair 0x00 and 0x02 fits this because each value maps to a separate, standalone persistence mechanism. This means an attacker could rely on either value independently to achieve persistence, and together they present two independent persistence vectors. The other options pair values where at least one does not provide a standalone persistence path, or the persistence outcome depends on combining values, so they don’t meet the criterion of two independent persistence vectors. To defend, monitor and control changes to ASEP start values and block unauthorized persistence mechanisms at startup points.

Access more questions from this quiz

Continue to SANS Advanced Incident Response, Threat Hunting, and Digital Forensics (FOR508) Practice test for more practice questions and the full quiz experience.

Access More Questions