Certified Cyber Defender (CCD) — Questions and Answers

Question 1: Which threat intelligence indicator type refers to known malicious file hashes, IPs, and domains?

TTPs
ATT&CK Groups
CVEs
IOCs (Correct answer)

Correct answer: IOCs

Indicators of Compromise (IOCs) are forensic artifacts such as file hashes, IP addresses, and domain names associated with known threats.

Question 2: Which Windows registry hive stores autorun entries that persist malware across reboots for the current user?

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKEY_LOCAL_MACHINE\SAM
HKEY_CLASSES_ROOT\CLSID
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKCU\Software\Microsoft\Windows\CurrentVersion\Run stores per-user autorun entries executed at login.

Question 3: Which of the following best describes a 'correlation rule' in a SIEM?

A logic statement that combines multiple events or conditions to generate a higher-fidelity alert (Correct answer)
A user role controlling access to SIEM dashboards
A firewall policy automatically applied based on threat score
A cryptographic hash used to verify log integrity

Correct answer: A logic statement that combines multiple events or conditions to generate a higher-fidelity alert

Correlation rules define conditional logic that links multiple individual events into a composite, higher-confidence security alert.

Question 4: What does 'TTP' stand for in the context of threat intelligence?

Tactics, Techniques, and Procedures (Correct answer)
Threat, Tactics, Protocols
Tools, Techniques, and Policies
Threat Tracking Platform

Correct answer: Tactics, Techniques, and Procedures

TTPs (Tactics, Techniques, and Procedures) describe how adversaries operate, making them the most valuable and hardest-to-change intelligence for defenders.

Question 5: A SIEM alert fires on repeated failed logins followed immediately by a successful login from a foreign IP. Which MITRE ATT&CK tactic does this pattern most directly map to?

Lateral Movement via Pass-the-Hash
Persistence via Account Manipulation
Initial Access via Valid Accounts
Credential Access via Brute Force (Correct answer)

Correct answer: Credential Access via Brute Force

Repeated failed logins succeeded by a success from an unusual IP is the classic signature of brute-force credential access (T1110).

Question 6: Which protocol is MOST commonly used to forward syslog messages to a SIEM collector?

Syslog over UDP 514 or TCP 514/6514 (Correct answer)
SNMP trap over TCP 162
NetFlow over UDP 2055
LDAP over TCP 389

Correct answer: Syslog over UDP 514 or TCP 514/6514

Syslog messages are traditionally forwarded on UDP port 514, with TCP 514 or TLS-secured 6514 used for reliable or encrypted transport.

Question 7: What documentation practice is considered essential in Security Information & Event Management within the Certified Cyber Defender field?

Using shorthand notes that can be expanded later if needed
Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Only documenting unusual events or complications
Completing all documentation at the end of the workday

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Security Information & Event Management ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 8: What is the 'order of volatility' in digital forensics?

The order in which evidence expires legally
The sequence for collecting evidence from most to least volatile (e.g., RAM before disk) (Correct answer)
The ranking of security incidents by severity
The priority list for patching systems

Correct answer: The sequence for collecting evidence from most to least volatile (e.g., RAM before disk)

The order of volatility guides forensic investigators to collect the most transient evidence first (e.g., RAM, network connections) before it disappears.

Question 9: What documentation practice is considered essential in Incident Response & Handling within the Certified Cyber Defender field?

Completing all documentation at the end of the workday
Using shorthand notes that can be expanded later if needed
Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Only documenting unusual events or complications

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Incident Response & Handling ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 10: What is the primary purpose of Privileged Access Management (PAM)?

To provide all employees with administrative rights by default
To automate password resets for standard user accounts
To control and monitor access to critical systems by privileged users and accounts (Correct answer)
To eliminate all administrator accounts from an organization

Correct answer: To control and monitor access to critical systems by privileged users and accounts

PAM focuses on securing, controlling, and monitoring privileged accounts that have elevated access to critical infrastructure and systems.

Question 11: A threat hunter wants to identify lateral movement in the environment. Which data source is MOST useful?

Windows Security Event logs (Event IDs 4624, 4648, 4672) (Correct answer)
Application crash dumps
Web server access logs
DNS zone transfer logs

Correct answer: Windows Security Event logs (Event IDs 4624, 4648, 4672)

Windows Security Event IDs 4624 (logon), 4648 (explicit credential logon), and 4672 (special privileges) are key indicators of lateral movement activity.

Question 12: Which tool is commonly used to create a forensic bit-for-bit image of a hard drive in Linux?

dd or dcfldd (Correct answer)
Nmap
Wireshark
Nessus

Correct answer: dd or dcfldd

`dd` and `dcfldd` are standard Linux utilities used to create forensic bit-for-bit disk images while preserving evidence integrity.

Question 13: When a conflict arises between standard procedures and a unique situation in Vulnerability Assessment & Management, what should a CCD professional prioritize?

Safety and ethical obligations while seeking expert consultation (Correct answer)
The preference of the client or stakeholder
The most cost-effective solution available
Strict adherence to written procedures without exception

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Vulnerability Assessment & Management. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 14: How does risk management apply to daily practice in Intrusion Detection & Prevention for Certified Cyber Defender professionals?

By avoiding high-risk situations entirely
Through annual safety audits exclusively
Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)
Only through responding to incidents after they occur

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Intrusion Detection & Prevention requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 15: What is the purpose of a 'purple team' exercise in the context of threat detection improvement?

To train junior analysts on basic SOC workflows
To have red and blue teams collaborate so detections are tuned against real attack techniques (Correct answer)
To audit compliance controls against regulatory frameworks
To conduct independent red team assessments without blue team knowledge

Correct answer: To have red and blue teams collaborate so detections are tuned against real attack techniques

Purple teaming combines offensive (red) and defensive (blue) functions in a collaborative loop, immediately tuning detections based on what the red team demonstrates evades them.

Question 16: What is the final phase in the incident response process?

Containment
Eradication
Lessons learned (Correct answer)
Detection

Correct answer: Lessons learned

The "Lessons Learned" phase is the final, yet crucial, step in the incident response process. During this phase, the incident response team reviews the entire incident, evaluating what went well and what could be improved. This analysis helps refine policies, procedures, and technologies to enhance an organization's overall security posture and preparedness for future incidents.

Question 17: In Incident Response & Handling, what is the FIRST step a CCD professional should take when encountering a new case or situation?

Implement an immediate solution based on past experience
Consult with a supervisor before taking any action
Conduct a comprehensive assessment and gather all relevant information (Correct answer)
Document the situation and wait for further instructions

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Incident Response & Handling, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified Cyber Defender practice.

Question 18: What should be the response when a security event is detected?

Investigate and take action (Correct answer)
Ignore and watch for changes
Log off all users
Wait for system reboot

Correct answer: Investigate and take action

When a security event is detected, the immediate and appropriate response is to investigate its nature and severity. This involves gathering more information, confirming if it's a true incident, and then taking decisive action based on the findings. Ignoring or delaying action can allow a potential threat to escalate and cause greater harm to the organization.

Question 19: An IDS generates 5,000 alerts per day but analysts confirm only 12 true positives per week. What does this scenario BEST illustrate?

Alert fatigue caused by high false positive rate (Correct answer)
High false negative rate
Misconfigured logging pipeline
Insufficient sensor coverage

Correct answer: Alert fatigue caused by high false positive rate

When the vast majority of alerts are false positives, analysts become desensitized—this is the classic definition of alert fatigue.

Question 20: A threat hunter notices beaconing traffic at regular 5-minute intervals to an external IP. What technique should be used to confirm C2 communication?

Disable all outbound traffic
Check firewall uptime logs
Analyze beacon jitter, packet size consistency, and DNS lookups to the IP (Correct answer)
Reboot the affected endpoint

Correct answer: Analyze beacon jitter, packet size consistency, and DNS lookups to the IP

Analyzing beacon regularity, jitter, packet size, and associated DNS queries helps confirm command-and-control (C2) communication patterns.

Question 21: How does risk management apply to daily practice in Malware Analysis & Reverse Engineering for Certified Cyber Defender professionals?

Only through responding to incidents after they occur
Through annual safety audits exclusively
By avoiding high-risk situations entirely
Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Malware Analysis & Reverse Engineering requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 22: What does a SIEM system do?

Stores and shreds documents
Collects and correlates security logs (Correct answer)
Protects physical buildings
Manages employee timesheets

Correct answer: Collects and correlates security logs

A Security Information and Event Management (SIEM) system is a powerful tool designed to provide a holistic view of an organization's security posture. It aggregates log data from various sources across the IT infrastructure, such as servers, network devices, and applications. By correlating these logs, SIEM systems can detect patterns and anomalies that indicate potential security incidents, enabling faster detection and response.

Question 23: What is the PRIMARY purpose of continuing education requirements in Malware Analysis & Reverse Engineering for CCD professionals?

Earning additional credentials for career advancement
Fulfilling mandatory regulatory requirements only
Maintaining current knowledge and competency as the field evolves (Correct answer)
Networking with other professionals in the field

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Malware Analysis & Reverse Engineering ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified Cyber Defender field.

Question 24: When a conflict arises between standard procedures and a unique situation in Security Information & Event Management, what should a CCD professional prioritize?

Strict adherence to written procedures without exception
The preference of the client or stakeholder
The most cost-effective solution available
Safety and ethical obligations while seeking expert consultation (Correct answer)

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Security Information & Event Management. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 25: What is the PRIMARY purpose of continuing education requirements in Log Analysis & Forensics for CCD professionals?

Maintaining current knowledge and competency as the field evolves (Correct answer)
Networking with other professionals in the field
Fulfilling mandatory regulatory requirements only
Earning additional credentials for career advancement

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Log Analysis & Forensics ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified Cyber Defender field.

Question 26: During a containment phase, a responder isolates an infected host by removing it from the network. What is the PRIMARY risk of this action?

Destroying volatile memory evidence before capture (Correct answer)
Alerting the attacker to the investigation
Corrupting the system's file integrity baseline
Triggering data encryption on remaining hosts

Correct answer: Destroying volatile memory evidence before capture

Network isolation can disrupt live memory, which holds ephemeral artifacts like running processes, open connections, and encryption keys crucial to the investigation.

Question 27: A defender reviews NetFlow data and notices a single internal host sending 2 GB of data to an external IP at 2 AM. Which detection category does this represent?

Heuristic sandboxing detection
Reputation-based threat intelligence detection
Signature-based detection
Anomaly-based / behavioral detection (Correct answer)

Correct answer: Anomaly-based / behavioral detection

Detecting the unusual volume and timing against a behavioral baseline—without a specific signature—is the definition of anomaly-based detection.

Question 28: Why is disk encryption used on endpoint devices?

To defragment the hard drive
To slow down hackers
To reduce battery usage
To protect stored data (Correct answer)

Correct answer: To protect stored data

Disk encryption is a security measure that scrambles all data on a hard drive, rendering it unreadable to unauthorized individuals. Its primary purpose on endpoint devices is to protect sensitive information stored on the device, especially in cases of loss or theft. Even if a device falls into the wrong hands, the encrypted data remains secure without the correct decryption key.

Question 29: What is the Pyramid of Pain in threat intelligence?

A risk scoring system for CVEs
A model ranking IOC types by how difficult they are for adversaries to change (Correct answer)
A patch prioritization framework
A network segmentation model

Correct answer: A model ranking IOC types by how difficult they are for adversaries to change

The Pyramid of Pain ranks indicators from hash values (easy to change) to TTPs (very hard to change), showing what hurts adversaries most when defenders act on each level.

Question 30: What is the purpose of log correlation in security monitoring?

Reduce internet speed
Detect coordinated security incidents (Correct answer)
Track system performance only
Schedule backups

Correct answer: Detect coordinated security incidents

Log correlation involves analyzing and linking security events from multiple disparate sources to identify relationships and patterns that might not be apparent from individual logs. This process is crucial for detecting sophisticated, multi-stage attacks or coordinated security incidents that span across different systems or network segments. By connecting the dots, correlation helps uncover complex threats that might otherwise go unnoticed.

Question 31: Which SIEM feature allows analysts to search historical log data to reconstruct a timeline of a past security incident?

Automated ticketing integration
Vulnerability scanning
Forensic log search and replay (Correct answer)
Real-time dashboards

Correct answer: Forensic log search and replay

Forensic log search and replay enables analysts to query retained logs and reconstruct the sequence of events in a past incident.

Question 32: Why is it important to segment a network?

To isolate sensitive areas and control traffic. (Correct answer)
To make the network structure simpler.
To allow unrestricted access to all users.
To reduce network speed.

Correct answer: To isolate sensitive areas and control traffic.

Network segmentation involves dividing a computer network into smaller, isolated sub-networks or segments. This practice is crucial for enhancing security by isolating sensitive areas and controlling traffic flow between different parts of the network. If one segment is compromised, the breach is contained, preventing it from spreading to other critical areas.

Question 33: A SIEM shows a sudden increase in 'Account Lockout' events across 200 workstations within 10 minutes. What is the MOST likely cause?

Normal business-hours authentication traffic
Ransomware encryption in progress
A misconfigured Group Policy pushing a password change
A password-spraying attack causing account lockouts (Correct answer)

Correct answer: A password-spraying attack causing account lockouts

Simultaneous lockouts across many accounts in a short window are a classic indicator of a password-spraying attack targeting Active Directory.

Question 34: During lessons-learned, the team identifies that dwell time was 47 days. Which control failure MOST likely contributed to the extended dwell time?

Insufficient SIEM alerting and threat hunting cadence (Correct answer)
Failure to patch a known critical CVE within SLA
Lack of a vulnerability management program
Absence of multi-factor authentication on VPN

Correct answer: Insufficient SIEM alerting and threat hunting cadence

Long dwell time indicates that detection mechanisms—SIEM tuning, alert triage, and proactive threat hunting—were insufficient to surface attacker activity sooner.

Question 35: An analyst finds an executable with a creation timestamp of 2020 but a modified timestamp of yesterday. This discrepancy MOST likely indicates:

The file was copied from an older backup archive
File system corruption affecting metadata integrity
Timestomping—deliberate manipulation of file metadata to evade detection (Correct answer)
The file is legitimately patched by a software update

Correct answer: Timestomping—deliberate manipulation of file metadata to evade detection

Timestomping is an anti-forensics technique where attackers alter MACE timestamps on malicious files to blend in with legitimate system files.

Question 36: What is the purpose of a threat intelligence 'feed' in a security operations environment?

To generate vulnerability scan reports
To provide employee security awareness training
To manage firewall rule changes
To deliver automated streams of IOCs and threat data for ingestion into security tools (Correct answer)

Correct answer: To deliver automated streams of IOCs and threat data for ingestion into security tools

Threat intelligence feeds provide automated, continuously updated streams of IOCs and threat data that security tools like SIEMs and firewalls can ingest and act on.

Question 37: A ransomware incident has encrypted files on a file server. The FIRST priority after confirming the incident should be:

Preserving forensic evidence and isolating affected systems (Correct answer)
Rebuilding the file server from backup
Notifying law enforcement
Determining the ransom amount and negotiating

Correct answer: Preserving forensic evidence and isolating affected systems

Evidence preservation and containment must come first to prevent further encryption, protect forensic artifacts, and understand the full scope before remediation.

Question 38: When a conflict arises between standard procedures and a unique situation in Endpoint Protection & Hardening, what should a CCD professional prioritize?

The preference of the client or stakeholder
Strict adherence to written procedures without exception
Safety and ethical obligations while seeking expert consultation (Correct answer)
The most cost-effective solution available

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Endpoint Protection & Hardening. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 39: An attacker exfiltrates data by encoding it in DNS TXT records. Which SIEM data source would BEST help detect this?

Email gateway logs
Endpoint antivirus logs
Firewall allow/deny logs
DNS server query logs with TXT record visibility (Correct answer)

Correct answer: DNS server query logs with TXT record visibility

DNS server logs capturing TXT record query volume and size can reveal DNS tunneling used to exfiltrate data covertly.

Question 40: A forensic analyst is reviewing Windows Event logs and sees Event ID 4688. What does this indicate?

A new process was created (Correct answer)
A service was stopped
A file was deleted
A user account was created

Correct answer: A new process was created

Windows Security Event ID 4688 indicates that a new process was created and includes details like the process name, parent process, and creator user account.

Question 41: In Intrusion Detection & Prevention, what is the FIRST step a CCD professional should take when encountering a new case or situation?

Implement an immediate solution based on past experience
Consult with a supervisor before taking any action
Document the situation and wait for further instructions
Conduct a comprehensive assessment and gather all relevant information (Correct answer)

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Intrusion Detection & Prevention, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified Cyber Defender practice.

Question 42: Which endpoint detection capability specifically monitors and logs the sequence of parent-child process relationships to detect process injection?

File Integrity Monitoring (FIM)
Network Traffic Analysis (NTA)
Process lineage / process tree analysis (Correct answer)
Memory forensics with Volatility

Correct answer: Process lineage / process tree analysis

Process lineage tracking records parent-child relationships, revealing anomalies like Word spawning PowerShell, a common injection indicator.

Question 43: Which Windows security feature prevents untrusted code from executing by using cryptographic signatures to validate software before load?

Data Execution Prevention (DEP)
Code Integrity / Windows Code Signing (Correct answer)
Address Space Layout Randomization (ASLR)
Control Flow Guard (CFG)

Correct answer: Code Integrity / Windows Code Signing

Windows Code Integrity checks cryptographic signatures on executables and drivers, blocking unsigned or improperly signed code from running.

Question 44: What is the PRIMARY purpose of continuing education requirements in Intrusion Detection & Prevention for CCD professionals?

Fulfilling mandatory regulatory requirements only
Networking with other professionals in the field
Maintaining current knowledge and competency as the field evolves (Correct answer)
Earning additional credentials for career advancement

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Intrusion Detection & Prevention ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified Cyber Defender field.

Question 45: Which ATT&CK tactic involves an adversary trying to avoid detection by security controls?

Persistence
Execution
Collection
Defense Evasion (Correct answer)

Correct answer: Defense Evasion

Defense Evasion in MITRE ATT&CK covers techniques adversaries use to avoid detection, such as obfuscation, disabling security tools, and masquerading.

Question 46: A forensic analyst acquires a disk image and computes its MD5 hash. Why is this hash computed again after analysis?

To encrypt the evidence file
To compress the image file
To speed up file indexing
To verify the image has not been altered and evidence integrity is maintained (Correct answer)

Correct answer: To verify the image has not been altered and evidence integrity is maintained

Recomputing the hash after analysis confirms the disk image remains unchanged, demonstrating evidence integrity and supporting admissibility.

Question 47: What is Role-Based Access Control (RBAC)?

Allowing users to define their own access rights dynamically
Granting access based on a user's physical location
Granting users permissions based on their assigned organizational roles (Correct answer)
Assigning permissions based on individual behavioral attributes

Correct answer: Granting users permissions based on their assigned organizational roles

RBAC assigns access rights based on predefined roles within an organization, simplifying access management and enforcement.

Question 48: During forensic analysis of a Linux system, which file contains a history of commands entered by users in the bash shell?

/proc/cmdline
/var/log/auth.log
~/.bash_history (Correct answer)
/etc/passwd

Correct answer: ~/.bash_history

The `~/.bash_history` file stores the command history for a user's bash shell sessions, revealing past commands executed by the user.

Question 49: A threat hunter uses the hypothesis 'Attackers living off the land are using certutil.exe for payload delivery.' Which data source BEST validates this hypothesis?

Authentication logs showing failed login attempts
Firewall logs showing blocked outbound connections
Process execution logs showing certutil.exe with -urlcache or -decode flags (Correct answer)
DNS query logs filtered for unknown domains

Correct answer: Process execution logs showing certutil.exe with -urlcache or -decode flags

Certutil is a native Windows binary commonly abused to download or decode payloads; process execution logs capturing its command-line arguments directly confirm or refute the hypothesis.

Question 50: Which standard of practice is MOST important for ensuring quality in Security Information & Event Management?

Strictly adhering to the same procedure in every situation
Minimizing documentation to focus on practical work
Following evidence-based protocols while adapting to specific circumstances (Correct answer)
Using the most advanced technology available regardless of need

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified Cyber Defender professionals must also adapt their approach based on specific circumstances and individual case needs within Security Information & Event Management.

Question 51: What is 'anti-forensics' and why is it a concern for digital forensic investigators?

A legal defense strategy against forensic evidence
A type of network monitoring tool
A method to encrypt forensic reports
Techniques used by attackers to destroy, hide, or alter evidence to impede forensic analysis (Correct answer)

Correct answer: Techniques used by attackers to destroy, hide, or alter evidence to impede forensic analysis

Anti-forensics encompasses techniques like file wiping, timestamp manipulation, steganography, and encryption that adversaries use to prevent investigators from recovering evidence.

Question 52: What does EDR stand for in cybersecurity?

Endpoint Detection and Response (Correct answer)
External Device Routing
Email Delivery Rate
Electronic Data Restore

Correct answer: Endpoint Detection and Response

EDR stands for Endpoint Detection and Response, which is a cybersecurity solution that continuously monitors endpoint devices for malicious activity. EDR systems collect and analyze data from endpoints, providing visibility into potential threats and enabling rapid detection, investigation, and response to security incidents. This advanced capability goes beyond traditional antivirus to offer deeper threat analysis.

Question 53: Which type of threat intelligence is MOST actionable for immediate defensive tuning of firewall and SIEM rules?

Tactical intelligence providing TTPs at the campaign level
Strategic intelligence describing geopolitical actor motivations
Operational intelligence about specific adversary infrastructure (IPs, domains, hashes) (Correct answer)
Finished intelligence reports summarizing threat landscape trends

Correct answer: Operational intelligence about specific adversary infrastructure (IPs, domains, hashes)

Operational indicators like malicious IPs, domains, and file hashes can be directly ingested into security controls for immediate blocking and detection.

Question 54: What is an Access Control List (ACL)?

A log of all failed authentication attempts on a system
A list of blocked IP addresses enforced by a firewall
A list of permissions attached to an object specifying which subjects can access it and how (Correct answer)
A list of all users registered in an organization's directory

Correct answer: A list of permissions attached to an object specifying which subjects can access it and how

An ACL is a set of rules that defines which subjects have which access rights to specific objects such as files or network resources.

Question 55: Which of the following best describes Multi-Factor Authentication (MFA)?

Using the same password across multiple systems with encryption
Allowing biometric-only authentication for privileged users
Using a single strong password for all systems
Requiring authentication from two or more independent credential categories (Correct answer)

Correct answer: Requiring authentication from two or more independent credential categories

MFA requires users to verify identity using two or more factors from different categories such as something you know, have, or are.

Question 56: When hardening a Linux endpoint, which configuration change most directly reduces the attack surface by preventing SUID binaries from being executed on a mounted filesystem?

Setting umask to 027
Mounting the filesystem with the nosuid option (Correct answer)
Enabling TCP SYN cookies
Disabling IPv6 on the interface

Correct answer: Mounting the filesystem with the nosuid option

The nosuid mount option prevents SUID/SGID bits from taking effect on that filesystem, stopping privilege escalation via vulnerable SUID binaries.

Question 57: Which standard of practice is MOST important for ensuring quality in Vulnerability Assessment & Management?

Strictly adhering to the same procedure in every situation
Minimizing documentation to focus on practical work
Following evidence-based protocols while adapting to specific circumstances (Correct answer)
Using the most advanced technology available regardless of need

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Question 58: In Endpoint Protection & Hardening, what is the FIRST step a CCD professional should take when encountering a new case or situation?

Consult with a supervisor before taking any action
Implement an immediate solution based on past experience
Document the situation and wait for further instructions
Conduct a comprehensive assessment and gather all relevant information (Correct answer)

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Endpoint Protection & Hardening, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified Cyber Defender practice.

Question 59: Which open-source framework is the standard tool for performing memory forensics analysis?

Volatility (Correct answer)
Rekall (deprecated, now Volatility)
FTK Imager
Autopsy

Correct answer: Volatility

Volatility is the industry-standard open-source framework for extracting digital artifacts from volatile memory (RAM) dumps.

Question 60: Which log source is MOST valuable for reconstructing the exact sequence of commands an attacker ran on a compromised Linux host?

Syslog facility auth.log
Cron job logs (/var/log/cron)
Bash history file (~/.bash_history)
Auditd with execve syscall rules (Correct answer)

Correct answer: Auditd with execve syscall rules

Auditd configured to capture execve syscalls records every command execution at the kernel level and cannot be trivially cleared by the user like bash_history.

Question 61: When a conflict arises between standard procedures and a unique situation in Intrusion Detection & Prevention, what should a CCD professional prioritize?

Safety and ethical obligations while seeking expert consultation (Correct answer)
The most cost-effective solution available
The preference of the client or stakeholder
Strict adherence to written procedures without exception

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Intrusion Detection & Prevention. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 62: What is the purpose of a 'lookup table' (reference data) in SIEM rule logic?

To store raw syslog packets before parsing
To configure user access permissions within the SIEM
To allow rules to reference external lists like known bad IPs or authorized service accounts (Correct answer)
To define backup SIEM failover targets

Correct answer: To allow rules to reference external lists like known bad IPs or authorized service accounts

Lookup tables let correlation rules reference external data sets—such as threat intel IP lists or whitelisted accounts—to improve accuracy.

Question 63: Which method enhances security by verifying a user’s identity with more than one factor?

Using a strong password only.
Applying software updates regularly.
Multi-factor authentication (Correct answer)
Relying on IP filtering.

Correct answer: Multi-factor authentication

Multi-factor authentication (MFA) is a security method that requires users to provide two or more distinct verification factors to prove their identity before gaining access. These factors typically include something the user knows (e.g., password), something the user has (e.g., phone, token), and/or something the user is (e.g., fingerprint). MFA significantly enhances security by making it much harder for unauthorized users to access accounts.

Question 64: An analyst observes that a SIEM alert for 'data exfiltration' fires every time a developer pushes code to an external Git repository. What action should the analyst take?

Block all external Git traffic
Tune the rule to exclude known developer IPs or the Git service destination (Correct answer)
Remove the exfiltration detection rule entirely
Accept the alert as a true positive and escalate

Correct answer: Tune the rule to exclude known developer IPs or the Git service destination

Rule tuning—adding exceptions for known-good traffic like authorized Git pushes—reduces false positives without eliminating legitimate detection.

Question 65: How does risk management apply to daily practice in Security Information & Event Management for Certified Cyber Defender professionals?

Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)
Only through responding to incidents after they occur
By avoiding high-risk situations entirely
Through annual safety audits exclusively

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Security Information & Event Management requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 66: Which technique allows an attacker to execute malicious code within the address space of a legitimate process to evade endpoint detection?

Credential stuffing
Spear phishing attachment
Process injection (e.g., DLL injection, process hollowing) (Correct answer)
SQL injection

Correct answer: Process injection (e.g., DLL injection, process hollowing)

Process injection techniques embed malicious code into legitimate processes, making detection harder because the activity appears to originate from a trusted executable.

Question 67: A Linux system shows an unknown process with a deleted binary (shown as /proc/<pid>/exe pointing to a deleted file). What does this indicate?

Normal behavior when package managers update binaries in use
The process crashed and its binary was cleaned up
A fileless or in-memory malware technique to evade disk-based detection (Correct answer)
The process is a kernel thread with no associated binary

Correct answer: A fileless or in-memory malware technique to evade disk-based detection

Malware often deletes its binary after execution to remain resident only in memory, reducing its on-disk footprint and evading file-based AV scans.

Question 68: During a threat hunt, an analyst finds a process running from `%AppData%\Roaming` with no parent process signature. What attack technique does this most suggest?

Living-off-the-land (LOLBins) persistence or malware execution (Correct answer)
DNS poisoning
DDoS attack
SQL injection

Correct answer: Living-off-the-land (LOLBins) persistence or malware execution

Processes running from user-writable directories like AppData with unsigned or missing parent chains are classic indicators of malware persistence or LOLBin abuse.

Question 69: During incident triage, you identify that an attacker used Mimikatz to dump credentials. Which Windows event ID BEST helps detect this activity?

Event ID 4740 – Account Locked Out
Event ID 4624 – Successful Logon
Event ID 1102 – Audit Log Cleared
Event ID 4688 – Process Creation (with command-line logging) (Correct answer)

Correct answer: Event ID 4688 – Process Creation (with command-line logging)

Event ID 4688 with command-line auditing enabled records process creation details, allowing detection of Mimikatz execution by process name or arguments.

Question 70: When performing root cause analysis after an incident, the '5 Whys' technique is used to:

Prioritize remediation tasks by cost and complexity
Drill down through causal layers to identify the underlying systemic failure (Correct answer)
Quantify financial damages from the breach
Assign blame to the team member who made the initial error

Correct answer: Drill down through causal layers to identify the underlying systemic failure

The 5 Whys method iteratively asks 'why' to peel back symptom layers and identify the root cause enabling a permanent fix rather than a symptomatic patch.

Question 71: What documentation practice is considered essential in Vulnerability Assessment & Management within the Certified Cyber Defender field?

Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Only documenting unusual events or complications
Completing all documentation at the end of the workday
Using shorthand notes that can be expanded later if needed

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Vulnerability Assessment & Management ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 72: Which mitigation technique randomizes the memory addresses of the stack, heap, and libraries to make exploitation harder?

Data Execution Prevention (DEP/NX)
Stack Canaries
Control Flow Integrity (CFI)
Address Space Layout Randomization (ASLR) (Correct answer)

Correct answer: Address Space Layout Randomization (ASLR)

ASLR randomizes where code and data are loaded in memory, forcing attackers to brute-force or leak addresses rather than using hardcoded offsets.

Question 73: What is Single Sign-On (SSO)?

A protocol that shares plaintext passwords between different services
A system that disables authentication after the first login attempt
A method requiring users to log in separately to each application
An authentication scheme allowing users to log in once and access multiple applications (Correct answer)

Correct answer: An authentication scheme allowing users to log in once and access multiple applications

SSO allows users to authenticate once and gain access to multiple systems without re-authenticating for each individual application.

Question 74: What documentation practice is considered essential in Log Analysis & Forensics within the Certified Cyber Defender field?

Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Completing all documentation at the end of the workday
Using shorthand notes that can be expanded later if needed
Only documenting unusual events or complications

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Log Analysis & Forensics ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 75: What is the PRIMARY purpose of continuing education requirements in Network Defense & Monitoring for CCD professionals?

Earning additional credentials for career advancement
Fulfilling mandatory regulatory requirements only
Networking with other professionals in the field
Maintaining current knowledge and competency as the field evolves (Correct answer)

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Network Defense & Monitoring ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified Cyber Defender field.

Question 76: Which file system artifact in Windows records metadata about files including creation, modification, and access times?

SAM database
Master File Table (MFT) (Correct answer)
Event log .evtx files
Registry hive SOFTWARE

Correct answer: Master File Table (MFT)

The NTFS Master File Table (MFT) contains metadata for every file on the volume, including timestamps, file size, and attributes critical for forensic timelines.

Question 77: Which of the following best describes a VPN?

A tool for increasing internet speed.
A method for physical cable testing.
A secure connection over a public network. (Correct answer)
A network protocol used for DNS.

Correct answer: A secure connection over a public network.

A Virtual Private Network (VPN) creates a secure, encrypted connection, often referred to as a 'tunnel,' over a less secure public network like the internet. This allows users to send and receive data securely and privately, as if their devices were directly connected to a private network. VPNs are used to protect online privacy, bypass geo-restrictions, and secure remote access to corporate networks.

Question 78: Which of the following is an example of an indicator of compromise?

Frequent password changes.
Unusual outbound network traffic. (Correct answer)
Successful login events.
Updated antivirus software.

Correct answer: Unusual outbound network traffic.

An Indicator of Compromise (IOC) is forensic data that identifies potentially malicious activity on a system or network. Unusual outbound network traffic, especially to unknown destinations or in large volumes, often signals that an attacker is exfiltrating data or establishing command-and-control communications. This deviation from normal behavior is a strong sign of a potential breach.

Question 79: A post-incident review finds that the IR team lacked authority to isolate systems without manager approval, delaying containment by 6 hours. What document should be updated to address this?

The Incident Response Policy granting pre-authorized containment authority (Correct answer)
The Data Classification Policy
The Vulnerability Management Procedure
The Business Continuity Plan (BCP)

Correct answer: The Incident Response Policy granting pre-authorized containment authority

Pre-authorized containment authority in the IR policy allows responders to act immediately within defined parameters without waiting for ad-hoc managerial approval.

Question 80: Why is documentation important in incident response?

To destroy evidence.
To track and learn from incidents. (Correct answer)
To delay response actions.
To punish employees.

Correct answer: To track and learn from incidents.

Documentation is vital throughout the entire incident response lifecycle. It provides a detailed record of the incident, including detection, actions taken, evidence collected, and outcomes. This comprehensive record allows organizations to analyze past incidents, identify trends, improve future response strategies, and demonstrate compliance.

Question 81: After eradication of malware, what is the CRITICAL step before returning a system to production?

Running a full antivirus scan on the cleaned system
Restoring from a known-good backup or rebuilding the system (Correct answer)
Notifying the user that the incident is resolved
Resetting all local user passwords

Correct answer: Restoring from a known-good backup or rebuilding the system

Malware can leave persistent backdoors invisible to scanners; restoring from a pre-incident clean backup or rebuilding ensures a trustworthy baseline.

Question 82: What is 'slack space' in the context of digital forensics?

Free space on network shares
The space between the end of a file and the end of its allocated disk cluster that may contain residual data (Correct answer)
Temporary file storage during analysis
Unused disk space after formatting

Correct answer: The space between the end of a file and the end of its allocated disk cluster that may contain residual data

Slack space is the unused portion of a disk cluster after a file ends, which can contain remnants of previously stored data valuable to forensic investigators.

Question 83: What does the principle of least privilege state?

Administrators should share credentials with trusted staff
Users should have maximum permissions for productivity
Users should only have the minimum permissions necessary to perform their job functions (Correct answer)
All users should have equal access to all system resources

Correct answer: Users should only have the minimum permissions necessary to perform their job functions

The principle of least privilege limits user permissions to only what is required for their role, reducing the attack surface.

Question 84: Which type of rootkit operates at the kernel level by modifying the System Service Descriptor Table (SSDT) to hide malicious activity?

SSDT-hooking kernel rootkit (Correct answer)
User-mode rootkit
Firmware/UEFI rootkit
Bootkit

Correct answer: SSDT-hooking kernel rootkit

SSDT-hooking rootkits redirect system calls by patching kernel function pointers, allowing them to intercept and filter API results.

Question 85: What is the main function of an Intrusion Detection System (IDS)?

To replace firewalls in perimeter defense.
To prevent unauthorized access to files.
To stop all malware from entering the network.
To monitor and alert on potential threats. (Correct answer)

Correct answer: To monitor and alert on potential threats.

An Intrusion Detection System (IDS) is designed to continuously monitor network traffic or system activities for malicious activity or policy violations. Upon detecting suspicious patterns or known attack signatures, the IDS generates alerts to security personnel. Its main function is to identify potential threats and provide warnings, rather than actively blocking them.

Question 86: An endpoint security solution detects a process opening a handle to another process's memory with PROCESS_VM_READ rights. Which attack is most likely occurring?

Credential dumping via direct memory read (Correct answer)
Kernel exploitation
DLL sideloading
Process hollowing

Correct answer: Credential dumping via direct memory read

PROCESS_VM_READ access combined with ReadProcessMemory is the hallmark of credential dumping tools like Mimikatz reading LSASS memory.

Question 87: An analyst finds that Sysmon Event ID 3 is generating thousands of alerts per hour from a single endpoint. What does this indicate?

Excessive registry modifications
Mass file creation events
High-volume outbound network connections from a process (Correct answer)
Frequent driver loads

Correct answer: High-volume outbound network connections from a process

Sysmon Event ID 3 logs network connections; mass generation indicates high-volume outbound activity consistent with scanning, data exfiltration, or C2 beaconing.

Question 88: What documentation practice is considered essential in Endpoint Protection & Hardening within the Certified Cyber Defender field?

Using shorthand notes that can be expanded later if needed
Completing all documentation at the end of the workday
Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Only documenting unusual events or complications

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Endpoint Protection & Hardening ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 89: What should be done immediately after detecting a confirmed breach?

Ignore and monitor for further activity.
Unplug all network cables.
Inform the media.
Alert the incident response team. (Correct answer)

Correct answer: Alert the incident response team.

Upon confirming a breach, immediate action is crucial to mitigate damage and initiate a structured response. Alerting the incident response team ensures that trained professionals can quickly mobilize, assess the situation, and begin executing the predefined incident response plan. This prompt notification is essential for an effective and coordinated defense.

Question 90: An attacker achieves code execution via a buffer overflow but DEP is enabled. Which follow-on technique allows them to bypass DEP using existing executable code?

Return-Oriented Programming (ROP) (Correct answer)
Format string exploitation
Heap spraying
Use-after-free exploitation

Correct answer: Return-Oriented Programming (ROP)

ROP chains together small executable code snippets (gadgets) already present in memory to perform arbitrary operations without injecting new shellcode.

Question 91: A forensic investigator finds a file with a `.jpg` extension but the hex signature shows `4D 5A`. What does this indicate?

The file is a Windows executable (PE file) with a disguised extension (Correct answer)
A corrupt image file
A compressed ZIP archive
A valid JPEG image

Correct answer: The file is a Windows executable (PE file) with a disguised extension

The hex signature `4D 5A` (MZ) is the magic number for Windows PE (Portable Executable) files, indicating the file is an executable disguised with a .jpg extension.

Question 92: An analyst receives a threat intelligence feed indicating a new C2 domain. What is the FASTEST defensive action that blocks communication without requiring endpoint changes?

Quarantine all endpoints that queried the domain
Block the domain's ASN at the perimeter firewall
Deploy a new EDR signature to all endpoints
Add the domain to DNS RPZ (Response Policy Zone) sinkhole (Correct answer)

Correct answer: Add the domain to DNS RPZ (Response Policy Zone) sinkhole

A DNS RPZ sinkhole immediately intercepts and redirects DNS queries for the malicious domain across the entire network without touching individual endpoints.

Question 93: A defender enables application whitelisting to prevent unauthorized code execution. Which bypass technique uses trusted Windows scripts to run arbitrary code?

Pass-the-Hash
Kerberoasting
T1218 - Signed Script Proxy Execution (e.g., using mshta.exe or wscript.exe) (Correct answer)
ARP spoofing

Correct answer: T1218 - Signed Script Proxy Execution (e.g., using mshta.exe or wscript.exe)

Attackers abuse trusted Windows script hosts like mshta.exe, wscript.exe, or cscript.exe to proxy execution of malicious scripts while bypassing whitelists.

Question 94: What does the term 'live forensics' or 'live acquisition' refer to?

Installing security agents on endpoints
Restoring a system from backup
Performing forensics on archived log files
Collecting forensic evidence from a running system without powering it down (Correct answer)

Correct answer: Collecting forensic evidence from a running system without powering it down

Live forensics involves collecting volatile data (RAM, active network connections, running processes) from a powered-on system before it is shut down and evidence is lost.

Question 95: How does risk management apply to daily practice in Incident Response & Handling for Certified Cyber Defender professionals?

By avoiding high-risk situations entirely
Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)
Only through responding to incidents after they occur
Through annual safety audits exclusively

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Incident Response & Handling requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 96: An analyst discovers an endpoint is beaconing to an external IP every 60 seconds. Which technique best describes this C2 communication pattern?

Periodic beaconing with a fixed sleep interval (Correct answer)
HTTP tunneling over port 443
Domain fronting
Fast flux DNS

Correct answer: Periodic beaconing with a fixed sleep interval

Periodic beaconing with a fixed interval is a common C2 pattern where malware checks in at regular, predictable intervals.

Question 97: What documentation practice is considered essential in Intrusion Detection & Prevention within the Certified Cyber Defender field?

Only documenting unusual events or complications
Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Completing all documentation at the end of the workday
Using shorthand notes that can be expanded later if needed

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Intrusion Detection & Prevention ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 98: Which type of account typically has elevated privileges and is used to run automated processes or services?

Standard user account
Service account (Correct answer)
Temporary contractor account
Guest account

Correct answer: Service account

Service accounts are specialized accounts with elevated privileges used to run applications, background services, or automated processes.

Question 99: Which standard of practice is MOST important for ensuring quality in Malware Analysis & Reverse Engineering?

Strictly adhering to the same procedure in every situation
Following evidence-based protocols while adapting to specific circumstances (Correct answer)
Minimizing documentation to focus on practical work
Using the most advanced technology available regardless of need

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Question 100: A threat intelligence report lists an APT group using spearphishing with macro-enabled documents. Which ATT&CK Initial Access technique does this map to?

T1566.001 - Spearphishing Attachment (Correct answer)
T1078 - Valid Accounts
T1133 - External Remote Services
T1190 - Exploit Public-Facing Application

Correct answer: T1566.001 - Spearphishing Attachment

T1566.001 covers spearphishing attachments, where adversaries send emails with malicious attachments like macro-enabled Office documents.

Certified Cyber Defender (CCD)

The CCD certification from CyberDefenders tests knowledge across defensive cybersecurity disciplines including threat analysis, network security, identity management, incident response, and governance. The exam validates blue team skills required for SOC analysts, DFIR professionals, and security engineers.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cyberdefenders.org — Eligibility, fees, exam information · verified Oct 2026
help.cyberdefenders.org — Test delivery, exam format, time limit, renewal, score validity, test dates, passing score, score release · verified Oct 2026