CCD Cheat Sheet 2026

The 30 highest-yield CCD facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What does 'TTP' stand for in the context of threat intelligence? → Tactics, Techniques, and Procedures
2. What should be the response when a security event is detected? → Investigate and take action
3. Which STIX/TAXII concept is used to share threat intelligence between organizations in a standardized format? → TAXII as transport protocol and STIX as data format
4. Which Windows security feature prevents untrusted code from executing by using cryptographic signatures to validate software before load? → Code Integrity / Windows Code Signing
5. During incident triage, you identify that an attacker used Mimikatz to dump credentials. Which Windows event ID BEST helps detect this activity? → Event ID 4688 – Process Creation (with command-line logging)
6. Which team handles alerts and threat mitigation in real-time? → Security Operations Center (SOC)
7. Which framework is commonly used to map SIEM detection rules to known adversary tactics and techniques? → MITRE ATT&CK
8. Which ATT&CK tactic involves an adversary trying to avoid detection by security controls? → Defense Evasion
9. What does the 'Diamond Model' of intrusion analysis primarily focus on? → Relationships between adversary, capability, infrastructure, and victim
10. Which Linux kernel security module provides mandatory access control (MAC) to confine processes to a predefined set of allowed actions? → SELinux (Security-Enhanced Linux)
11. Which standard of practice is MOST important for ensuring quality in Vulnerability Assessment & Management? → Following evidence-based protocols while adapting to specific circumstances
12. Which type of account typically has elevated privileges and is used to run automated processes or services? → Service account
13. Why is continuous monitoring essential in cybersecurity? → To detect and respond to threats in real time
14. During lessons-learned, the team identifies that dwell time was 47 days. Which control failure MOST likely contributed to the extended dwell time? → Insufficient SIEM alerting and threat hunting cadence
15. Which standard of practice is MOST important for ensuring quality in Incident Response & Handling? → Following evidence-based protocols while adapting to specific circumstances
16. What is 'write blocking' in the context of digital forensics? → Using hardware or software to prevent any writes to the evidence drive during acquisition
17. A playbook requires escalation when 'confirmed data exfiltration exceeds 1 GB.' What type of escalation trigger is this? → Severity threshold trigger
18. When performing root cause analysis after an incident, the '5 Whys' technique is used to: → Drill down through causal layers to identify the underlying systemic failure
19. Which file system artifact in Windows records metadata about files including creation, modification, and access times? → Master File Table (MFT)
20. In Endpoint Protection & Hardening, what is the FIRST step a CCD professional should take when encountering a new case or situation? → Conduct a comprehensive assessment and gather all relevant information
21. Which of the following best describes a VPN? → A secure connection over a public network.
22. A SIEM shows a sudden increase in 'Account Lockout' events across 200 workstations within 10 minutes. What is the MOST likely cause? → A password-spraying attack causing account lockouts
23. What is the purpose of a security information and event management (SIEM) system? → Monitor and analyze security data in real time.
24. What is alert fatigue in security operations? → Analysts ignore important alerts
25. What is the PRIMARY purpose of continuing education requirements in Intrusion Detection & Prevention for CCD professionals? → Maintaining current knowledge and competency as the field evolves
26. A SIEM detects a spike in DNS queries to newly registered domains from multiple internal hosts simultaneously. What threat does this MOST likely indicate? → Domain generation algorithm (DGA) malware beaconing
27. Which Windows Registry hive contains information about recently run programs, USB device history, and user activity? → NTUSER.DAT (user-specific hive) and SYSTEM hive
28. In Incident Response & Handling, what is the FIRST step a CCD professional should take when encountering a new case or situation? → Conduct a comprehensive assessment and gather all relevant information
29. A SIEM generates an alert every time a user logs in outside business hours. After a week, analysts begin ignoring these alerts. This is an example of: → Alert fatigue caused by excessive false positives
30. Which metric represents the average time taken to detect a security incident? → MTTD