CASP+ Security Operations and Incident Response 1 — Questions and Answers
Question 1: During a security incident, a responder discovers malware on a compromised host. What is the FIRST action that should be taken according to incident response best practices?
- Immediately reimage the system
- Isolate the system from the network while preserving volatile memory (Correct answer)
- Delete all suspicious files
- Notify law enforcement immediately
Correct answer: Isolate the system from the network while preserving volatile memory
Network isolation stops active exfiltration or C2 communication while preserving volatile memory (RAM) contains critical forensic evidence that is lost on reboot or shutdown.
Question 2: Which log source is MOST valuable for detecting data exfiltration via DNS tunneling?
- Windows event logs from domain controllers
- DNS query and response logs with anomaly baselines (Correct answer)
- Firewall allow/deny logs
- Antivirus scan results
Correct answer: DNS query and response logs with anomaly baselines
DNS tunneling encodes data in DNS query strings; analysis of DNS logs for high-frequency queries, unusual record types, or large TXT responses reveals this technique.
Question 3: A SOC analyst receives an alert for a possible SQL injection attack. Which evidence BEST confirms successful exploitation?
- A single 400 Bad Request response in web server logs
- Database error messages followed by unexpected data in HTTP responses (Correct answer)
- A spike in failed login attempts
- A port scan originating from the web server IP
Correct answer: Database error messages followed by unexpected data in HTTP responses
Database error messages in responses indicate the application is processing injected SQL, and unexpected data in the response confirms the attacker retrieved data from the database.
Question 4: Which incident response phase involves identifying lessons learned and updating security controls to prevent recurrence?
- Detection and Analysis
- Containment
- Eradication and Recovery
- Post-Incident Activity (Correct answer)
Correct answer: Post-Incident Activity
The Post-Incident Activity phase (NIST SP 800-61) includes a lessons-learned meeting, updating incident response plans, and implementing improvements to prevent similar incidents.
Question 5: A threat hunter is looking for living-off-the-land (LotL) attacks. Which data source provides the MOST visibility into these techniques?
- Antivirus signature scan results
- Process creation and command-line logging (Sysmon Event ID 1) (Correct answer)
- Network bandwidth utilization graphs
- Vulnerability scanner output
Correct answer: Process creation and command-line logging (Sysmon Event ID 1)
LotL attacks use legitimate system tools (PowerShell, WMI, certutil); Sysmon process creation logs capture command-line arguments that reveal malicious use of trusted binaries.
Question 6: Which technique allows an attacker to maintain persistence on a Windows system by hijacking the loading of DLLs?
- Pass-the-hash
- DLL search order hijacking (Correct answer)
- Golden ticket attack
- Kerberoasting
Correct answer: DLL search order hijacking
DLL search order hijacking places a malicious DLL in a directory that Windows searches before the legitimate DLL location, causing the malicious code to load with the application's privileges.
CASP+ Security Operations and Incident Response 1
During a security incident, a responder discovers malware on a compromised host.
What is the FIRST action that should be taken according to incident response best practices?