Certified Cyber Defender (CCD) — Questions and Answers

Question 1: An IR team discovers ransomware on a file server. Which containment strategy is MOST appropriate to prevent further encryption?

Wipe the server and restore from backup immediately
Apply the latest OS patches to the affected server
Disconnect the server from the network and disable associated service accounts (Correct answer)
Deploy an IDS on the affected subnet

Correct answer: Disconnect the server from the network and disable associated service accounts

Disconnecting the network link and disabling accounts stops active encryption spread while preserving evidence.

Question 2: Which Windows API function is most commonly abused by ransomware to enumerate and encrypt files on a victim system?

CreateFileMapping
NtCreateThreadEx
VirtualAllocEx
FindFirstFile / FindNextFile (Correct answer)

Correct answer: FindFirstFile / FindNextFile

Ransomware typically uses FindFirstFile/FindNextFile to recursively enumerate filesystem paths before encrypting each file.

Question 3: Which Wireshark display filter would most effectively isolate DNS-over-HTTPS (DoH) traffic used by malware to tunnel C2 communications?

dns && udp.port == 53
tcp.port == 853
tcp.port == 443 && http2 (Correct answer)
udp.port == 5353

Correct answer: tcp.port == 443 && http2

DoH sends DNS queries encapsulated in HTTPS over TCP port 443 using HTTP/2, making the http2 filter on port 443 the correct combination to isolate it.

Question 4: Which technique do attackers use to discover live hosts and open ports on a network without triggering IDS alerts?

ARP flooding
Stealth (SYN) scanning with slow timing (Correct answer)
Ping broadcasting
Aggressive full-connect scanning

Correct answer: Stealth (SYN) scanning with slow timing

Stealth SYN scanning with slow timing evades IDS detection by sending half-open connection requests at low rates to avoid threshold-based alerts.

Question 5: In vulnerability prioritization, which combination of factors creates the highest urgency for remediation?

Low CVSS score with high business impact on legacy system
Low CVSS score with no public exploit on a non-critical system
High CVSS score with a public exploit targeting a critical internet-facing asset (Correct answer)
Medium CVSS score with theoretical exploit on internal server

Correct answer: High CVSS score with a public exploit targeting a critical internet-facing asset

Severity (CVSS), exploitability (public exploit available), and asset criticality (internet-facing) together create the highest remediation urgency.

Question 6: An IR analyst needs to determine if a suspicious IP communicated with internal hosts over the past 30 days. Which data source is MOST appropriate?

NetFlow or IPFIX records from network devices (Correct answer)
Endpoint patch history
Active Directory group membership logs
Antivirus quarantine logs

Correct answer: NetFlow or IPFIX records from network devices

NetFlow records provide historical IP-level communication metadata, ideal for retrospective threat hunting.

Question 7: What is the primary goal of threat hunting in a security operations context?

Generate compliance reports
Block inbound firewall traffic
Patch known vulnerabilities
Proactively search for hidden threats before alerts fire (Correct answer)

Correct answer: Proactively search for hidden threats before alerts fire

Threat hunting is the proactive practice of searching through networks and systems to detect threats that evade existing automated security controls.

Question 8: When triaging a potential ransomware incident, which log artifact would confirm mass file encryption activity?

Repeated SMB null sessions
A spike in DNS NX-domain responses
High volume of file rename/modify events in Windows Security audit logs (Event ID 4663) (Correct answer)
Increased LDAP queries to a domain controller

Correct answer: High volume of file rename/modify events in Windows Security audit logs (Event ID 4663)

Ransomware generates a massive burst of file write and rename operations (adding encryption extensions) that appear as Event ID 4663 (file access audited) in Windows logs.

Question 9: What documentation practice is considered essential in Endpoint Protection & Hardening within the Certified Cyber Defender field?

Only documenting unusual events or complications
Completing all documentation at the end of the workday
Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Using shorthand notes that can be expanded later if needed

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Endpoint Protection & Hardening ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 10: A security analyst discovers that a Windows service was installed with a path containing spaces and no quotes (e.g., C:\Program Files\service.exe). What vulnerability does this create?

Unquoted service path privilege escalation (Correct answer)
Token impersonation
DLL sideloading
Registry key persistence

Correct answer: Unquoted service path privilege escalation

Windows resolves unquoted paths with spaces by trying each space-separated segment, allowing an attacker to place a malicious executable earlier in the path to hijack the service.

Question 11: What does OAuth 2.0 primarily provide?

An authorization framework that allows third-party applications limited access to user resources (Correct answer)
An authentication protocol that directly verifies user identity
A protocol for synchronizing user directories across organizations
A method for encrypting user passwords during transmission

Correct answer: An authorization framework that allows third-party applications limited access to user resources

OAuth 2.0 is an authorization framework that enables applications to obtain limited access to user accounts without exposing user credentials.

Question 12: What is the PRIMARY purpose of continuing education requirements in Vulnerability Assessment & Management for CCD professionals?

Fulfilling mandatory regulatory requirements only
Maintaining current knowledge and competency as the field evolves (Correct answer)
Networking with other professionals in the field
Earning additional credentials for career advancement

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Vulnerability Assessment & Management ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified Cyber Defender field.

Question 13: An analyst notices that SIEM correlation rules are triggering alerts based on mismatched timestamps between sources. What is the BEST remediation?

Increase the alert threshold window
Switch to a syslog-only collection model
Disable timestamp-based rules
Implement NTP synchronization across all log sources (Correct answer)

Correct answer: Implement NTP synchronization across all log sources

NTP synchronization ensures all devices report consistent timestamps, enabling accurate time-based event correlation.

Question 14: Why is documentation important in incident response?

To delay response actions.
To track and learn from incidents. (Correct answer)
To punish employees.
To destroy evidence.

Correct answer: To track and learn from incidents.

Documentation is vital throughout the entire incident response lifecycle. It provides a detailed record of the incident, including detection, actions taken, evidence collected, and outcomes. This comprehensive record allows organizations to analyze past incidents, identify trends, improve future response strategies, and demonstrate compliance.

Question 15: Which chain-of-custody principle ensures that digital evidence remains admissible in court?

Only hash verification is required for admissibility
A documented, unbroken record of evidence handling from collection to presentation (Correct answer)
Evidence must be stored on write-protected media exclusively
Evidence must be collected by law enforcement only

Correct answer: A documented, unbroken record of evidence handling from collection to presentation

An unbroken chain of custody documents every person who handled the evidence, preventing claims of tampering and ensuring legal admissibility.

Question 16: An attacker uses LOLBins (Living-off-the-Land Binaries) to execute malicious code. Which Windows binary is most commonly abused for this?

mstsc.exe
certutil.exe (Correct answer)
notepad.exe
mmc.exe

Correct answer: certutil.exe

Certutil.exe is a trusted Windows binary frequently abused to download files and decode base64-encoded payloads, bypassing basic security controls.

Question 17: Which firewall inspection method tracks the state of active connections and makes decisions based on connection context?

Application-layer filtering
Stateful inspection (Correct answer)
Packet filtering
NAT traversal

Correct answer: Stateful inspection

Stateful inspection firewalls maintain a state table of active connections and allow only packets that match established sessions.

Question 18: A Windows endpoint is configured with PowerShell Constrained Language Mode. What does this restrict?

Remote PowerShell sessions to domain controllers
PowerShell logging and transcription
Execution of all unsigned scripts regardless of policy
Access to .NET types, COM objects, and advanced scripting capabilities (Correct answer)

Correct answer: Access to .NET types, COM objects, and advanced scripting capabilities

Constrained Language Mode limits PowerShell to basic operations, blocking access to .NET APIs and COM objects commonly abused in attacks.

Question 19: What is the purpose of a DMZ (Demilitarized Zone) in network architecture?

To block all external traffic
To host internal databases
To provide a buffer zone for publicly accessible services (Correct answer)
To replace the need for a firewall

Correct answer: To provide a buffer zone for publicly accessible services

A DMZ is a network segment that isolates publicly accessible services (like web servers) from the internal network, reducing attack surface.

Question 20: A SOC analyst observes that an endpoint's antivirus was disabled 10 minutes before a malware infection occurred. What attacker technique does this suggest?

Discovery via network scanning
Defense evasion via security tool tampering (Correct answer)
Privilege escalation via token manipulation
Persistence via scheduled tasks

Correct answer: Defense evasion via security tool tampering

Disabling security tools before executing malware is a classic defense evasion technique to prevent detection and blocking of the payload.

Question 21: What documentation practice is considered essential in Security Information & Event Management within the Certified Cyber Defender field?

Using shorthand notes that can be expanded later if needed
Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
Only documenting unusual events or complications
Completing all documentation at the end of the workday

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Security Information & Event Management ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 22: An analyst finds an executable with a creation timestamp of 2020 but a modified timestamp of yesterday. This discrepancy MOST likely indicates:

The file is legitimately patched by a software update
File system corruption affecting metadata integrity
The file was copied from an older backup archive
Timestomping—deliberate manipulation of file metadata to evade detection (Correct answer)

Correct answer: Timestomping—deliberate manipulation of file metadata to evade detection

Timestomping is an anti-forensics technique where attackers alter MACE timestamps on malicious files to blend in with legitimate system files.

Question 23: Which open-source platform is commonly used to aggregate and share threat intelligence feeds using a MISP format?

Zeek
Wireshark
MISP (Malware Information Sharing Platform) (Correct answer)
Splunk

Correct answer: MISP (Malware Information Sharing Platform)

MISP is an open-source threat intelligence platform designed for sharing, storing, and correlating indicators of compromise and threat intelligence.

Question 24: Which scan type is LEAST likely to disrupt network operations but provides limited vulnerability insight?

Aggressive port scan
Passive network traffic analysis (Correct answer)
Web application fuzzing
Full credentialed scan

Correct answer: Passive network traffic analysis

Passive analysis monitors existing traffic without sending probes, making it non-disruptive but unable to detect all vulnerability types.

Question 25: In Malware Analysis & Reverse Engineering, what is the FIRST step a CCD professional should take when encountering a new case or situation?

Consult with a supervisor before taking any action
Implement an immediate solution based on past experience
Document the situation and wait for further instructions
Conduct a comprehensive assessment and gather all relevant information (Correct answer)

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Malware Analysis & Reverse Engineering, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified Cyber Defender practice.

Question 26: Which protocol is commonly used for federated enterprise authentication using XML-based assertions?

OAuth 2.0
SAML (Security Assertion Markup Language) (Correct answer)
OpenID Connect
RADIUS

Correct answer: SAML (Security Assertion Markup Language)

SAML is an XML-based standard used for exchanging authentication and authorization data between identity providers and service providers.

Question 27: Which log source would BEST help identify a compromised web server being used to serve malware to visitors?

Web server access and error logs (Correct answer)
Windows Security Event Log
DHCP server logs
DNS server query logs

Correct answer: Web server access and error logs

Web server access and error logs reveal unusual file requests, injected redirects, and suspicious response codes indicating drive-by malware distribution.

Question 28: A threat hunter wants to identify lateral movement in the environment. Which data source is MOST useful?

Application crash dumps
Windows Security Event logs (Event IDs 4624, 4648, 4672) (Correct answer)
DNS zone transfer logs
Web server access logs

Correct answer: Windows Security Event logs (Event IDs 4624, 4648, 4672)

Windows Security Event IDs 4624 (logon), 4648 (explicit credential logon), and 4672 (special privileges) are key indicators of lateral movement activity.

Question 29: Which SIEM component is responsible for normalizing log data from heterogeneous sources into a common format?

Event correlation engine
Log normalization parser (Correct answer)
Asset discovery module
Threat intelligence feed

Correct answer: Log normalization parser

The log normalization parser transforms raw log data from diverse sources into a consistent, structured format for analysis.

Question 30: What is the 'order of volatility' in digital forensics?

The ranking of security incidents by severity
The order in which evidence expires legally
The priority list for patching systems
The sequence for collecting evidence from most to least volatile (e.g., RAM before disk) (Correct answer)

Correct answer: The sequence for collecting evidence from most to least volatile (e.g., RAM before disk)

The order of volatility guides forensic investigators to collect the most transient evidence first (e.g., RAM, network connections) before it disappears.

Question 31: An analyst reviews logs and finds repeated 'Account Locked Out' events for the same username across multiple workstations within minutes. What does this suggest?

A credential stuffing or password spray attack (Correct answer)
A user forgot their password on one machine
Normal Active Directory synchronization
A DNS resolution failure

Correct answer: A credential stuffing or password spray attack

Lockouts triggered on multiple workstations simultaneously for the same account indicate an automated attack spraying credentials across systems.

Question 32: Which protocol is commonly used to securely access a remote system?

SSH (Correct answer)
Telnet
FTP
HTTP

Correct answer: SSH

SSH (Secure Shell) is a cryptographic network protocol that enables secure remote access to computers over an unsecured network. It provides strong authentication and encrypts all communication between the client and server, protecting against eavesdropping and tampering. This makes it the preferred protocol for remote administration and secure file transfers.

Question 33: What is the PRIMARY purpose of continuing education requirements in Log Analysis & Forensics for CCD professionals?

Fulfilling mandatory regulatory requirements only
Earning additional credentials for career advancement
Networking with other professionals in the field
Maintaining current knowledge and competency as the field evolves (Correct answer)

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Log Analysis & Forensics ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified Cyber Defender field.

Question 34: What does the EPSS (Exploit Prediction Scoring System) measure?

The number of public exploits for a CVE
The probability that a CVE will be exploited in the wild within 30 days (Correct answer)
The time a vendor takes to release a patch
The severity of a vulnerability's impact on confidentiality

Correct answer: The probability that a CVE will be exploited in the wild within 30 days

EPSS produces a probability score (0–1) estimating the likelihood of exploitation in the next 30 days.

Question 35: During eradication, an analyst removes malware but fails to identify the persistence mechanism. What is the MOST likely outcome?

The malware reinstalls itself after the next reboot or scheduled task runs (Correct answer)
The system experiences a performance improvement
The attacker loses access permanently
The IDS generates a new alert for a different threat

Correct answer: The malware reinstalls itself after the next reboot or scheduled task runs

Without removing persistence mechanisms like registry run keys or scheduled tasks, malware will re-execute after cleanup.

Question 36: What is the primary risk of placing monitoring sensors ONLY at the network perimeter?

Perimeter sensors are unable to decrypt SSL traffic
Perimeter sensors consume too much bandwidth
Internal traffic is less important than external traffic
Internal attacker activity and lateral movement between internal hosts will go undetected (Correct answer)

Correct answer: Internal attacker activity and lateral movement between internal hosts will go undetected

Perimeter-only monitoring creates blind spots inside the network where lateral movement, insider threats, and post-breach activity are invisible.

Question 37: A defender configures ACLs to block all traffic except TCP 443 to a sensitive server. An attacker then tunnels malicious traffic over HTTPS. Which control would BEST detect this?

SSL/TLS inspection combined with application-layer IDS (Correct answer)
Deploy a honeypot on port 443
Tighten the ACL to block port 443 as well
Increase firewall log retention

Correct answer: SSL/TLS inspection combined with application-layer IDS

SSL/TLS inspection decrypts HTTPS traffic so application-layer IDS signatures can inspect payload content for malicious activity.

Question 38: During lessons-learned, the team identifies that dwell time was 47 days. Which control failure MOST likely contributed to the extended dwell time?

Lack of a vulnerability management program
Absence of multi-factor authentication on VPN
Insufficient SIEM alerting and threat hunting cadence (Correct answer)
Failure to patch a known critical CVE within SLA

Correct answer: Insufficient SIEM alerting and threat hunting cadence

Long dwell time indicates that detection mechanisms—SIEM tuning, alert triage, and proactive threat hunting—were insufficient to surface attacker activity sooner.

Question 39: An analyst is threat hunting and notices PowerShell executing encoded commands via `powershell.exe -enc`. What is the attacker likely doing?

Compressing log files
Obfuscating malicious commands to evade detection (Correct answer)
Configuring Group Policy
Running a legitimate Windows update

Correct answer: Obfuscating malicious commands to evade detection

Base64-encoded PowerShell commands (`-enc` flag) are commonly used by attackers to obfuscate malicious scripts and evade string-based detection.

Question 40: Which network indicator is most useful for detecting beaconing behavior of a C2 implant?

Regular, periodic outbound connections with consistent intervals and low jitter (Correct answer)
TLS handshakes using self-signed certificates
HTTP 404 responses from the target server
Unusually large DNS TXT records

Correct answer: Regular, periodic outbound connections with consistent intervals and low jitter

Beaconing implants check in with their C2 at predictable intervals, producing regular periodic spikes in network telemetry.

Question 41: What is account enumeration and why is it a security concern?

A technique attackers use to discover valid usernames by analyzing application error messages (Correct answer)
A method to count all active user sessions on a network system
The sequential creation of account IDs during user provisioning
The auditing of privileged accounts for compliance; it is a beneficial process

Correct answer: A technique attackers use to discover valid usernames by analyzing application error messages

Account enumeration allows attackers to confirm valid usernames through differential error responses, which can then be targeted in password attacks.

Question 42: What is the purpose of log correlation in security monitoring?

Schedule backups
Track system performance only
Reduce internet speed
Detect coordinated security incidents (Correct answer)

Correct answer: Detect coordinated security incidents

Log correlation involves analyzing and linking security events from multiple disparate sources to identify relationships and patterns that might not be apparent from individual logs. This process is crucial for detecting sophisticated, multi-stage attacks or coordinated security incidents that span across different systems or network segments. By connecting the dots, correlation helps uncover complex threats that might otherwise go unnoticed.

Question 43: Which standard of practice is MOST important for ensuring quality in Intrusion Detection & Prevention?

Using the most advanced technology available regardless of need
Following evidence-based protocols while adapting to specific circumstances (Correct answer)
Minimizing documentation to focus on practical work
Strictly adhering to the same procedure in every situation

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified Cyber Defender professionals must also adapt their approach based on specific circumstances and individual case needs within Intrusion Detection & Prevention.

Question 44: In Zero Trust Architecture, which principle applies to identity verification?

Trust all internal users by default and only verify external connections
Restrict identity verification to users accessing classified or sensitive data only
Grant permanent access to users who successfully pass initial authentication
Never trust, always verify — continuously authenticate and authorize every user and device (Correct answer)

Correct answer: Never trust, always verify — continuously authenticate and authorize every user and device

Zero Trust requires continuous verification of every user and device regardless of network location, eliminating implicit trust for internal actors.

Question 45: What is the main risk of scanning production systems during peak business hours?

Authentication tokens expire too quickly
Scans will miss vulnerabilities on active connections
Scanners cannot run while users are logged in
Network-intensive scans can degrade service availability (Correct answer)

Correct answer: Network-intensive scans can degrade service availability

Aggressive scanning can saturate network bandwidth or trigger resource exhaustion on production hosts during peak load.

Question 46: A security analyst identifies an active intrusion at 2 AM. The IR plan requires management notification within one hour. Which step should happen FIRST?

Notify the incident response team and escalate per the IR plan (Correct answer)
Conduct a post-incident review
Begin eradication of the malware
Restore systems from backup

Correct answer: Notify the incident response team and escalate per the IR plan

Escalation and notification must occur before remediation to ensure proper authorization and coordination.

Question 47: A forensic analyst extracts a memory dump and finds a process named 'svchost.exe' running from C:\Users\Public. What is significant about this?

Legitimate svchost.exe runs only from System32; this path indicates malware (Correct answer)
Public directory is a standard Microsoft path for services
This is expected behavior on Windows 11
svchost.exe always runs from user directories

Correct answer: Legitimate svchost.exe runs only from System32; this path indicates malware

Legitimate svchost.exe resides exclusively in C:\Windows\System32; execution from a user-writable path is a strong indicator of malware masquerading as a system process.

Question 48: When a conflict arises between standard procedures and a unique situation in Vulnerability Assessment & Management, what should a CCD professional prioritize?

The preference of the client or stakeholder
The most cost-effective solution available
Safety and ethical obligations while seeking expert consultation (Correct answer)
Strict adherence to written procedures without exception

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Vulnerability Assessment & Management. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 49: What should be done immediately after detecting a confirmed breach?

Ignore and monitor for further activity.
Unplug all network cables.
Alert the incident response team. (Correct answer)
Inform the media.

Correct answer: Alert the incident response team.

Upon confirming a breach, immediate action is crucial to mitigate damage and initiate a structured response. Alerting the incident response team ensures that trained professionals can quickly mobilize, assess the situation, and begin executing the predefined incident response plan. This prompt notification is essential for an effective and coordinated defense.

Question 50: During triage, an analyst finds a scheduled task that runs a Base64-encoded PowerShell command. What evasion technique does this represent?

Process injection
DLL side-loading
Obfuscation via encoding (Correct answer)
Token impersonation

Correct answer: Obfuscation via encoding

Base64 encoding the command payload is a common obfuscation technique to evade signature-based detection that looks for plaintext malicious strings.

Question 51: Which Windows event log ID should analysts monitor to detect successful local account creation by attackers?

Event ID 4624
Event ID 4698
Event ID 4720 (Correct answer)
Event ID 4688

Correct answer: Event ID 4720

Windows Security Event ID 4720 is logged when a new user account is created, indicating possible backdoor account creation.

Question 52: A security team wants to prevent users from installing unauthorized USB devices. Which control best addresses this?

Device control policy via endpoint security software (Correct answer)
Disabling AutoPlay only
Enabling Windows Defender Firewall
Applying AppLocker to network shares

Correct answer: Device control policy via endpoint security software

Device control policies in endpoint security platforms can whitelist approved devices and block unauthorized USB storage connections.

Question 53: Which team handles alerts and threat mitigation in real-time?

Marketing Team
Red Team
Security Operations Center (SOC) (Correct answer)
Help Desk

Correct answer: Security Operations Center (SOC)

The Security Operations Center (SOC) is the dedicated team responsible for the continuous monitoring, detection, and analysis of security events. When alerts are triggered, the SOC team investigates them, determines their legitimacy, and then takes immediate action to mitigate identified threats in real-time. They are at the forefront of an organization's defense against cyberattacks.

Question 54: What is the purpose of 'emulation' in modern antivirus engines when analyzing potentially malicious files?

Sandboxing the file by restricting its system call privileges
Executing code in a lightweight CPU emulator to detect behavior without exposing the real system (Correct answer)
Decompiling the binary and scanning the resulting pseudocode for known patterns
Running the file in a full OS virtual machine to observe network traffic

Correct answer: Executing code in a lightweight CPU emulator to detect behavior without exposing the real system

AV emulators execute suspicious code in a safe, instrumented CPU emulation layer, allowing detection of packed or obfuscated payloads that only reveal themselves at runtime.

Question 55: Which of the following is an example of an indicator of compromise?

Frequent password changes.
Updated antivirus software.
Unusual outbound network traffic. (Correct answer)
Successful login events.

Correct answer: Unusual outbound network traffic.

An Indicator of Compromise (IOC) is forensic data that identifies potentially malicious activity on a system or network. Unusual outbound network traffic, especially to unknown destinations or in large volumes, often signals that an attacker is exfiltrating data or establishing command-and-control communications. This deviation from normal behavior is a strong sign of a potential breach.

Question 56: What is the primary goal of containment during incident response?

To restore data from backup.
To stop the incident from spreading. (Correct answer)
To identify all affected files.
To notify the press immediately.

Correct answer: To stop the incident from spreading.

Containment is a critical phase in incident response aimed at limiting the scope and impact of a security breach. Its primary goal is to prevent the incident from escalating, infecting more systems, or causing further damage. By isolating affected systems or networks, organizations can minimize the overall harm and prepare for eradication.

Question 57: Which NIST document provides detailed guidance on enterprise patch and vulnerability management processes?

NIST SP 800-137
NIST SP 800-61
NIST SP 800-115
NIST SP 800-40 (Correct answer)

Correct answer: NIST SP 800-40

NIST SP 800-40 specifically addresses enterprise patch management planning and vulnerability remediation processes.

Question 58: What is application whitelisting?

Blocking browser extensions
Permitting only trusted apps to run (Correct answer)
Allowing all apps by default
Blacklisting certain file types

Correct answer: Permitting only trusted apps to run

Application whitelisting is a security control that allows only explicitly approved applications to execute on a system, while all other applications are blocked by default. This proactive approach significantly enhances security by preventing the execution of unauthorized or malicious software, including unknown malware and ransomware. It provides a strong defense against various types of attacks.

Question 59: When performing root cause analysis after an incident, the '5 Whys' technique is used to:

Quantify financial damages from the breach
Prioritize remediation tasks by cost and complexity
Drill down through causal layers to identify the underlying systemic failure (Correct answer)
Assign blame to the team member who made the initial error

Correct answer: Drill down through causal layers to identify the underlying systemic failure

The 5 Whys method iteratively asks 'why' to peel back symptom layers and identify the root cause enabling a permanent fix rather than a symptomatic patch.

Question 60: In Endpoint Protection & Hardening, what is the FIRST step a CCD professional should take when encountering a new case or situation?

Document the situation and wait for further instructions
Conduct a comprehensive assessment and gather all relevant information (Correct answer)
Implement an immediate solution based on past experience
Consult with a supervisor before taking any action

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Endpoint Protection & Hardening, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified Cyber Defender practice.

Question 61: What is the main security risk associated with orphaned accounts?

They cause performance degradation in authentication and directory systems
They represent accounts of former users that remain active, potentially allowing unauthorized access (Correct answer)
They prevent new accounts from being provisioned in the directory
They consume excessive storage space in directory services over time

Correct answer: They represent accounts of former users that remain active, potentially allowing unauthorized access

Orphaned accounts belong to users who no longer need access (such as former employees) but remain active, creating unauthorized access risk.

Question 62: What is a 'hypothesis-driven' threat hunt?

Blocking all unknown executables
Running automated scans without analyst input
Reviewing compliance audit logs
Starting a hunt based on an assumed adversary behavior or TTP (Correct answer)

Correct answer: Starting a hunt based on an assumed adversary behavior or TTP

Hypothesis-driven hunting starts with an assumption about adversary behavior informed by threat intelligence and then searches for evidence to confirm or deny it.

Question 63: In Splunk, which search command would you use to count events grouped by a specific field such as 'src_ip'?

dedup src_ip
table
rename src_ip
stats count by src_ip (Correct answer)

Correct answer: stats count by src_ip

The 'stats count by <field>' command aggregates events and counts occurrences grouped by the specified field.

Question 64: Which Windows feature creates read-only snapshots of files that can help recover from ransomware if not deleted by the attacker?

Windows Defender Credential Guard
BitLocker
Secure Boot
Shadow Volume Copies (VSS) (Correct answer)

Correct answer: Shadow Volume Copies (VSS)

Volume Shadow Copy Service (VSS) creates point-in-time snapshots of files, which ransomware often targets for deletion before encrypting data.

Question 65: A defender uses YARA rules to scan memory dumps. What is a YARA rule primarily designed to detect?

Network packet anomalies by protocol deviation
Malware patterns via string and byte sequence matching (Correct answer)
Lateral movement via Kerberos ticket abuse
Unauthorized user account modifications

Correct answer: Malware patterns via string and byte sequence matching

YARA rules define patterns—strings, byte sequences, and logical conditions—that match malware families or suspicious code in files and memory.

Question 66: What is Attribute-Based Access Control (ABAC)?

A model that grants access based on attributes of users, resources, and environmental conditions (Correct answer)
Assigning permissions based on predefined static role assignments only
An access model that requires biometric verification for every resource access request
Granting access based solely on the user's organizational department

Correct answer: A model that grants access based on attributes of users, resources, and environmental conditions

ABAC evaluates multiple attributes including user clearance, resource classification, and environmental conditions to make fine-grained access control decisions.

Question 67: Which Windows Group Policy setting prevents users from running executables downloaded from the internet that lack a trusted digital signature?

Disabling Windows Script Host (WSH)
Enabling NTFS file auditing on Downloads folder
SmartScreen enforcement via Windows Defender Application Control (Correct answer)
Restricting Software via Software Restriction Policies (SRP) by zone

Correct answer: SmartScreen enforcement via Windows Defender Application Control

Windows Defender SmartScreen and WDAC can block or warn about unsigned or reputation-unknown executables downloaded from untrusted internet sources.

Question 68: What is the primary purpose of Privileged Access Management (PAM)?

To eliminate all administrator accounts from an organization
To provide all employees with administrative rights by default
To control and monitor access to critical systems by privileged users and accounts (Correct answer)
To automate password resets for standard user accounts

Correct answer: To control and monitor access to critical systems by privileged users and accounts

PAM focuses on securing, controlling, and monitoring privileged accounts that have elevated access to critical infrastructure and systems.

Question 69: Which vulnerability management metric measures the average time between vulnerability discovery and successful remediation?

Mean Time to Remediate (MTTR) (Correct answer)
Vulnerability density
Mean Time to Detect (MTTD)
Patch compliance rate

Correct answer: Mean Time to Remediate (MTTR)

Mean Time to Remediate (MTTR) tracks how quickly an organization closes vulnerabilities after they are identified.

Question 70: A post-incident review finds that the IR team lacked authority to isolate systems without manager approval, delaying containment by 6 hours. What document should be updated to address this?

The Incident Response Policy granting pre-authorized containment authority (Correct answer)
The Data Classification Policy
The Vulnerability Management Procedure
The Business Continuity Plan (BCP)

Correct answer: The Incident Response Policy granting pre-authorized containment authority

Pre-authorized containment authority in the IR policy allows responders to act immediately within defined parameters without waiting for ad-hoc managerial approval.

Question 71: Which IPS deployment mode can actively block malicious traffic without requiring changes to network topology?

Inline mode (Correct answer)
Out-of-band mode
Passive tap mode
Span port mode

Correct answer: Inline mode

Inline mode places the IPS directly in the traffic path, allowing it to drop or modify packets in real time.

Question 72: An organization receives a vendor patch but cannot apply it immediately due to operational constraints. Which compensating control is MOST appropriate for a critical network service vulnerability?

Disable the service permanently
Apply a WAF rule or network ACL to block exploit traffic (Correct answer)
Delete the vulnerable software
Perform a full system rebuild

Correct answer: Apply a WAF rule or network ACL to block exploit traffic

Network-level controls like ACLs or WAF rules can block known exploit paths until the patch can be applied.

Question 73: How does risk management apply to daily practice in Malware Analysis & Reverse Engineering for Certified Cyber Defender professionals?

Only through responding to incidents after they occur
Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)
Through annual safety audits exclusively
By avoiding high-risk situations entirely

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Malware Analysis & Reverse Engineering requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 74: A NIDS fails to alert on a known attack signature. What type of IDS error has occurred?

True positive
False negative (Correct answer)
False positive
True negative

Correct answer: False negative

A false negative occurs when an IDS fails to detect a real attack, allowing malicious traffic to pass without an alert.

Question 75: Which method enhances security by verifying a user’s identity with more than one factor?

Multi-factor authentication (Correct answer)
Using a strong password only.
Relying on IP filtering.
Applying software updates regularly.

Correct answer: Multi-factor authentication

Multi-factor authentication (MFA) is a security method that requires users to provide two or more distinct verification factors to prove their identity before gaining access. These factors typically include something the user knows (e.g., password), something the user has (e.g., phone, token), and/or something the user is (e.g., fingerprint). MFA significantly enhances security by making it much harder for unauthorized users to access accounts.

Question 76: An organization uses SCAP. What does SCAP enable?

Real-time exploitation of discovered vulnerabilities
Encryption of vulnerability scan results
Manual log review for compliance reporting
Standardized automated security configuration and vulnerability checking (Correct answer)

Correct answer: Standardized automated security configuration and vulnerability checking

SCAP (Security Content Automation Protocol) provides standardized formats for expressing and automating security configuration checks and vulnerability assessments.

Question 77: What is LDAP (Lightweight Directory Access Protocol) primarily used for in IAM?

Encrypting passwords stored in user credential databases
Generating one-time passwords for multi-factor authentication systems
Monitoring network traffic for unauthorized access attempts
Accessing and managing directory information services for user authentication and authorization (Correct answer)

Correct answer: Accessing and managing directory information services for user authentication and authorization

LDAP is a protocol for accessing and maintaining distributed directory information services, commonly used to query user credentials and attributes.

Question 78: An attacker establishes a reverse shell using an encrypted channel over port 443 to avoid detection. Which defensive control would MOST effectively detect this?

Require two-factor authentication for all remote access
Implement application whitelisting on endpoints
Block all port 443 traffic at the perimeter firewall
Deploy SSL/TLS inspection to analyze encrypted traffic content (Correct answer)

Correct answer: Deploy SSL/TLS inspection to analyze encrypted traffic content

SSL/TLS inspection (MITM proxy) decrypts outbound traffic for inspection, revealing malicious content hidden in encrypted channels.

Question 79: An attacker exploits a vulnerability within hours of its public disclosure. This scenario is best described as:

A zero-day exploit
A known-exploited vulnerability (KEV)
An n-day exploit (Correct answer)
A logic bomb

Correct answer: An n-day exploit

An n-day exploit targets a vulnerability after it has been publicly disclosed but before organizations have patched it.

Question 80: A threat hunter notices PowerShell launching from within Microsoft Word. Which detection technique most directly identifies this parent-child process anomaly?

Signature-based antivirus detection
Network flow baseline anomaly detection
File hash reputation lookup via VirusTotal
Process lineage / parent-child process analysis (Correct answer)

Correct answer: Process lineage / parent-child process analysis

Parent-child process analysis examines the spawning relationship between processes, making it ideal for catching living-off-the-land techniques like Office → PowerShell.

Question 81: How does risk management apply to daily practice in Endpoint Protection & Hardening for Certified Cyber Defender professionals?

Only through responding to incidents after they occur
By avoiding high-risk situations entirely
Through annual safety audits exclusively
Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Endpoint Protection & Hardening requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 82: Which obfuscation method splits a string into individual character codes that are concatenated at runtime to evade static string scanning?

Base64 encoding
Polymorphic engine mutation
XOR encryption
String concatenation obfuscation (Correct answer)

Correct answer: String concatenation obfuscation

Splitting strings into character-code arrays that are joined at runtime prevents signature-based tools from matching the complete plaintext string.

Question 83: In Log Analysis & Forensics, what is the FIRST step a CCD professional should take when encountering a new case or situation?

Document the situation and wait for further instructions
Consult with a supervisor before taking any action
Conduct a comprehensive assessment and gather all relevant information (Correct answer)
Implement an immediate solution based on past experience

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Log Analysis & Forensics, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified Cyber Defender practice.

Question 84: When a conflict arises between standard procedures and a unique situation in Intrusion Detection & Prevention, what should a CCD professional prioritize?

Strict adherence to written procedures without exception
Safety and ethical obligations while seeking expert consultation (Correct answer)
The most cost-effective solution available
The preference of the client or stakeholder

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Intrusion Detection & Prevention. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 85: What is the main function of an Intrusion Detection System (IDS)?

To monitor and alert on potential threats. (Correct answer)
To replace firewalls in perimeter defense.
To prevent unauthorized access to files.
To stop all malware from entering the network.

Correct answer: To monitor and alert on potential threats.

An Intrusion Detection System (IDS) is designed to continuously monitor network traffic or system activities for malicious activity or policy violations. Upon detecting suspicious patterns or known attack signatures, the IDS generates alerts to security personnel. Its main function is to identify potential threats and provide warnings, rather than actively blocking them.

Question 86: What is federated identity management?

A method of assigning unique identities to network devices only
A system where each application manages its own user database independently
A process for revoking user access across all systems simultaneously
A framework allowing users to use the same identity across multiple organizations or domains (Correct answer)

Correct answer: A framework allowing users to use the same identity across multiple organizations or domains

Federated identity enables organizations to share identity information across trust boundaries so users can authenticate once and access resources in multiple domains.

Question 87: What is the purpose of an audit trail in Identity and Access Management?

To automatically revoke expired or inactive user accounts
To block suspicious login attempts in real time before they succeed
To provide a chronological record of user activities and access events for accountability (Correct answer)
To encrypt sensitive user credentials stored in the directory service

Correct answer: To provide a chronological record of user activities and access events for accountability

Audit trails record who accessed what, when, and what actions were performed, enabling forensic investigation and compliance verification.

Question 88: What is Just-In-Time (JIT) access provisioning?

Automatically removing all access rights outside of business hours
Providing temporary, time-limited elevated privileges only when needed for a specific task (Correct answer)
Granting permanent administrative access to all senior staff
Assigning access rights based on a user's real-time geographic location

Correct answer: Providing temporary, time-limited elevated privileges only when needed for a specific task

JIT access provides temporary elevated privileges for specific tasks only when needed, minimizing the exposure window for privileged accounts.

Question 89: Which type of threat intelligence is MOST actionable for immediate defensive tuning of firewall and SIEM rules?

Operational intelligence about specific adversary infrastructure (IPs, domains, hashes) (Correct answer)
Strategic intelligence describing geopolitical actor motivations
Finished intelligence reports summarizing threat landscape trends
Tactical intelligence providing TTPs at the campaign level

Correct answer: Operational intelligence about specific adversary infrastructure (IPs, domains, hashes)

Operational indicators like malicious IPs, domains, and file hashes can be directly ingested into security controls for immediate blocking and detection.

Question 90: Which attack technique involves sending malformed Ethernet frames to cause a switch to fail open and broadcast all traffic?

ARP spoofing
VLAN hopping
STP manipulation
MAC flooding (Correct answer)

Correct answer: MAC flooding

MAC flooding overwhelms a switch's CAM table with fake MAC addresses, causing it to fail open and broadcast frames to all ports like a hub.

Question 91: A SIEM rule fires when 5 failed logins occur within 2 minutes from the same IP. What type of attack is this rule designed to detect?

Phishing campaign
Man-in-the-middle attack
SQL injection attempt
Brute-force or password-spraying attack (Correct answer)

Correct answer: Brute-force or password-spraying attack

Repeated rapid login failures from a single source are a hallmark of brute-force or password-spraying attacks.

Question 92: A malware sample uses the Windows registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' — what persistence mechanism does this represent?

Registry run key persistence (Correct answer)
DLL search order hijacking
Scheduled task persistence
Service-based persistence

Correct answer: Registry run key persistence

Writing to the Run registry key causes Windows to execute the specified binary each time the current user logs in.

Question 93: Which CVSS v3 metric describes the conditions beyond the attacker's control that must exist for the vulnerability to be exploited?

User Interaction
Attack Vector
Attack Complexity (Correct answer)
Privileges Required

Correct answer: Attack Complexity

Attack Complexity (AC) captures conditions outside attacker control, such as race conditions or specific configuration states.

Question 94: Which technique involves injecting malicious code into a legitimate suspended process after hollowing out its original memory content?

Reflective DLL loading
AtomBombing
Process hollowing (RunPE) (Correct answer)
DLL injection

Correct answer: Process hollowing (RunPE)

Process hollowing unmaps a legitimate process's executable code and replaces it with malicious code, making the malware appear as a trusted process.

Question 95: When applying the DREAD scoring model, which factor estimates the number of people affected by a vulnerability?

Discoverability
Exploitability
Affected users (Correct answer)
Damage potential

Correct answer: Affected users

The 'Affected users' component in DREAD scores how broadly exploitation would impact the user population.

Question 96: What is the purpose of endpoint security software?

To monitor social media usage
To increase internet speed
To prevent unauthorized access to devices (Correct answer)
To store user passwords

Correct answer: To prevent unauthorized access to devices

Endpoint security software is designed to protect individual computing devices, such as laptops, desktops, and mobile phones, from cyber threats. Its primary purpose is to prevent unauthorized access, malware infections, and data breaches on these endpoints. It achieves this through various features like antivirus, anti-malware, firewall, and intrusion prevention systems.

Question 97: A SIEM alert fires for 'Impossible Travel' — a user authenticated from New York at 9:00 AM and then from London at 9:15 AM. What does this indicate?

Possible credential compromise or account sharing across geographically distant locations (Correct answer)
Normal behavior if the user has a global role
The user is using a VPN split-tunnel
A misconfigured time zone on the London server

Correct answer: Possible credential compromise or account sharing across geographically distant locations

Impossible travel alerts flag authentication from two geographically distant locations within a time window physically impossible to bridge, suggesting stolen credentials.

Question 98: What is 'write blocking' in the context of digital forensics?

Using hardware or software to prevent any writes to the evidence drive during acquisition (Correct answer)
Blocking write access to the SIEM
Disabling SMB write shares
Preventing log files from being overwritten

Correct answer: Using hardware or software to prevent any writes to the evidence drive during acquisition

Write blockers are hardware or software devices that prevent any modification to the original evidence drive during forensic acquisition, preserving evidence integrity.

Question 99: Which standard of practice is MOST important for ensuring quality in Log Analysis & Forensics?

Following evidence-based protocols while adapting to specific circumstances (Correct answer)
Minimizing documentation to focus on practical work
Using the most advanced technology available regardless of need
Strictly adhering to the same procedure in every situation

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Question 100: What does the 'Diamond Model' of intrusion analysis primarily focus on?

Network topology mapping
Patch management lifecycle
Log retention policies
Relationships between adversary, capability, infrastructure, and victim (Correct answer)

Correct answer: Relationships between adversary, capability, infrastructure, and victim

The Diamond Model maps the four core features of every intrusion event: adversary, capability, infrastructure, and victim.

Certified Cyber Defender (CCD)

The CCD certification from CyberDefenders tests knowledge across defensive cybersecurity disciplines including threat analysis, network security, identity management, incident response, and governance. The exam validates blue team skills required for SOC analysts, DFIR professionals, and security engineers.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds