Mixed Deck — All CCD Topics Flashcards

What is the function of a SIEM's 'watchlist' or 'asset criticality' feature?

Answer: Prioritizing alerts involving high-value or high-risk assets or users

Asset criticality and watchlists cause the SIEM to elevate the priority of alerts involving designated high-value targets.

What is a key difference between a SIEM and a traditional log management system?

Answer: A SIEM adds real-time correlation, alerting, and threat detection on top of log collection and storage

While both store logs, a SIEM adds real-time correlation engines, behavioral analytics, and alerting to transform raw logs into actionable security intelligence.

What does EDR stand for in cybersecurity?

Answer: Endpoint Detection and Response

EDR stands for Endpoint Detection and Response, which is a cybersecurity solution that continuously monitors endpoint devices for malicious activity. EDR systems collect and analyze data from endpoints, providing visibility into potential threats and enabling rapid detection, investigation, and response to security incidents. This advanced capability goes beyond traditional antivirus to offer deeper threat analysis.

What documentation practice is considered essential in Security Information & Event Management within the Certified Cyber Defender field?

Answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Security Information & Event Management ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Which tool is used to analyze Windows memory dumps offline to find injected code, hidden processes, and active network connections?

Answer: Volatility

Volatility is a framework for offline memory forensics that extracts processes, network connections, and artifacts from raw memory dumps.

What type of forensic analysis examines RAM to find running processes, network connections, and encryption keys?

Answer: Memory forensics (volatile forensics)

Memory forensics analyzes RAM dumps to uncover running processes, open network connections, decrypted data, and malware that may not appear on disk.

Which Linux command displays currently active network connections and the processes that own them, useful for detecting backdoors?

Answer: ss -antp

The `ss -antp` command shows all TCP sockets with process information, and is the modern replacement for netstat on Linux systems.

What is 'write blocking' in the context of digital forensics?

Answer: Using hardware or software to prevent any writes to the evidence drive during acquisition

Write blockers are hardware or software devices that prevent any modification to the original evidence drive during forensic acquisition, preserving evidence integrity.

What is application whitelisting?

Answer: Permitting only trusted apps to run

Application whitelisting is a security control that allows only explicitly approved applications to execute on a system, while all other applications are blocked by default. This proactive approach significantly enhances security by preventing the execution of unauthorized or malicious software, including unknown malware and ransomware. It provides a strong defense against various types of attacks.

Which Windows security feature prevents untrusted code from executing by using cryptographic signatures to validate software before load?

Answer: Code Integrity / Windows Code Signing

Windows Code Integrity checks cryptographic signatures on executables and drivers, blocking unsigned or improperly signed code from running.

A ransomware incident has encrypted files on a file server. The FIRST priority after confirming the incident should be:

Answer: Preserving forensic evidence and isolating affected systems

Evidence preservation and containment must come first to prevent further encryption, protect forensic artifacts, and understand the full scope before remediation.

In Log Analysis & Forensics, what is the FIRST step a CCD professional should take when encountering a new case or situation?

Answer: Conduct a comprehensive assessment and gather all relevant information

In Log Analysis & Forensics, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified Cyber Defender practice.

Which Linux file should an analyst inspect first when investigating unauthorized cron-based persistence added for a specific user?

Answer: /var/spool/cron/crontabs/

Per-user cron jobs are stored in /var/spool/cron/crontabs/ and are separate from system-wide crontab entries.

Which Windows feature can prevent exploit code from executing payload in data memory regions by marking them as non-executable?

Answer: Data Execution Prevention (DEP/NX bit)

DEP uses the CPU's NX (No-Execute) bit to mark memory regions like the stack and heap as non-executable, stopping shellcode injected into data areas.

What is the 'order of volatility' in digital forensics?

Answer: The sequence for collecting evidence from most to least volatile (e.g., RAM before disk)

The order of volatility guides forensic investigators to collect the most transient evidence first (e.g., RAM, network connections) before it disappears.

Which of the following best describes threat hunting?

Answer: Manually searching for indicators of compromise.

Threat hunting is a proactive cybersecurity activity where security analysts actively and iteratively search through networks and endpoints to detect and isolate advanced threats that have evaded existing security solutions. Unlike reactive security measures that wait for alerts, threat hunting involves manually searching for indicators of compromise (IOCs) and unusual patterns to uncover hidden malicious activity.

A threat actor uses WMI permanent event subscriptions to execute a payload whenever a user logs in. Which category of persistence technique is this?

Answer: WMI event subscription persistence

WMI permanent event subscriptions link an event filter (e.g., logon) to a consumer (e.g., execute script), providing fileless, script-based persistence.

Why is it important to segment a network?

Answer: To isolate sensitive areas and control traffic.

Network segmentation involves dividing a computer network into smaller, isolated sub-networks or segments. This practice is crucial for enhancing security by isolating sensitive areas and controlling traffic flow between different parts of the network. If one segment is compromised, the breach is contained, preventing it from spreading to other critical areas.

A defender enables application whitelisting to prevent unauthorized code execution. Which bypass technique uses trusted Windows scripts to run arbitrary code?

Answer: T1218 - Signed Script Proxy Execution (e.g., using mshta.exe or wscript.exe)

Attackers abuse trusted Windows script hosts like mshta.exe, wscript.exe, or cscript.exe to proxy execution of malicious scripts while bypassing whitelists.

What is the purpose of a 'purple team' exercise in the context of threat detection improvement?

Answer: To have red and blue teams collaborate so detections are tuned against real attack techniques

Purple teaming combines offensive (red) and defensive (blue) functions in a collaborative loop, immediately tuning detections based on what the red team demonstrates evades them.