CCD Cheat Sheet 2026

The 30 highest-yield CCD facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which standard provides a framework for classifying and naming software vulnerabilities using a list format maintained by MITRE? → CVE (Common Vulnerabilities and Exposures)
2. Which Windows security feature uses hardware-based isolation to protect the LSASS process from credential theft? → Credential Guard
3. What does 'TTP' stand for in the context of threat intelligence? → Tactics, Techniques, and Procedures
4. A defender wants to limit the blast radius if a standard user account is compromised. Which principle guides this control? → Principle of least privilege
5. Which vulnerability management metric measures the average time between vulnerability discovery and successful remediation? → Mean Time to Remediate (MTTR)
6. What should be the response when a security event is detected? → Investigate and take action
7. A forensic analyst uses the 'strings' command on a suspicious binary and finds base64-encoded PowerShell commands. What technique does this suggest? → Obfuscated payload delivery
8. Which STIX/TAXII concept is used to share threat intelligence between organizations in a standardized format? → TAXII as transport protocol and STIX as data format
9. During static analysis of a PE binary, which section typically contains the import address table (IAT)? → .idata
10. In Zeek (formerly Bro), what is a 'notice' used for? → Recording a network event worthy of analyst attention
11. A Windows endpoint is configured with PowerShell Constrained Language Mode. What does this restrict? → Access to .NET types, COM objects, and advanced scripting capabilities
12. What is the role of a Security Information and Event Management (SIEM) system in network security? → Aggregating and correlating log data to detect security incidents
13. Which MITRE ATT&CK tactic does 'scheduled task creation for persistence' fall under? → Persistence
14. Which technology creates an encrypted tunnel over a public network to securely connect remote users to a corporate network? → VPN
15. Which protocol is commonly used for centralized authentication, authorization, and accounting (AAA) in network environments? → RADIUS
16. Which tool is MOST commonly used to create a forensically sound bit-for-bit image of a hard drive during incident response? → dd or dcfldd
17. Which Windows security feature prevents untrusted code from executing by using cryptographic signatures to validate software before load? → Code Integrity / Windows Code Signing
18. A security analyst identifies an active intrusion at 2 AM. The IR plan requires management notification within one hour. Which step should happen FIRST? → Notify the incident response team and escalate per the IR plan
19. During incident triage, you identify that an attacker used Mimikatz to dump credentials. Which Windows event ID BEST helps detect this activity? → Event ID 4688 – Process Creation (with command-line logging)
20. Which team handles alerts and threat mitigation in real-time? → Security Operations Center (SOC)
21. Which framework is commonly used to map SIEM detection rules to known adversary tactics and techniques? → MITRE ATT&CK
22. An attacker achieves persistence by modifying a registry run key under HKCU. Which defense-in-depth control would MOST likely detect this? → Sysmon registry monitoring (Event ID 13/14)
23. Which ATT&CK tactic involves an adversary trying to avoid detection by security controls? → Defense Evasion
24. What does the 'Diamond Model' of intrusion analysis primarily focus on? → Relationships between adversary, capability, infrastructure, and victim
25. Which Linux kernel security module provides mandatory access control (MAC) to confine processes to a predefined set of allowed actions? → SELinux (Security-Enhanced Linux)
26. Which standard of practice is MOST important for ensuring quality in Vulnerability Assessment & Management? → Following evidence-based protocols while adapting to specific circumstances
27. A malware analyst observes that a sample resolves API calls by walking the PEB's InMemoryOrderModuleList and hashing export names. What is this technique? → API hashing / dynamic API resolution
28. A defender sees a large number of ICMP echo requests sent to a broadcast address, with replies flooding a victim. This describes which attack? → Smurf attack
29. Which type of account typically has elevated privileges and is used to run automated processes or services? → Service account
30. Which technique allows a vulnerability scanner to obtain more accurate results by using system credentials? → Credentialed scanning