Cert Master

KT-EPS Process analysis

Sysmon shows powershell.exe -enc launching from excel.exe with outbound 443. Meaning?

Multiple choice — select one answer

Answer choices

  1. a. Proof that TLS inspection is misconfigured on the perimeter firewall only
  2. b. Normal Excel behavior when opening any spreadsheet from email attachments, without security or identity team coordination per policy.
  3. c. Indicates a printer driver update scheduled by Windows Update automatically, without security or identity team coordination per policy.
  4. d. Likely macro-driven execution downloading or executing a second-stage payload

Architectural breakdown & explanation

Encoded PowerShell from Office is a classic malware staging pattern.

Correct answer(s): d. Likely macro-driven execution downloading or executing a second-stage payload

Exam domain: Process analysis (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications