CCD Incident Response & Handling 3 — Questions and Answers
Question 1: In incident response, what is the primary purpose of a 'chain of custody' document?
- To assign incident ownership to a specific team
- To ensure evidence integrity and admissibility in legal proceedings (Correct answer)
- To track patch deployment timelines
- To document communication between IR team members
Correct answer: To ensure evidence integrity and admissibility in legal proceedings
Chain of custody records who handled evidence, when, and how, ensuring it remains untampered and legally admissible.
Question 2: A threat actor is exfiltrating data over DNS queries using base64-encoded subdomains. Which detection method is MOST effective?
- Block all outbound port 53 traffic
- Analyze DNS query frequency and subdomain length anomalies (Correct answer)
- Enable full packet capture on port 80
- Require DNSSEC on all internal resolvers
Correct answer: Analyze DNS query frequency and subdomain length anomalies
DNS tunneling is detected by monitoring for unusually long subdomains, high query rates, and entropy anomalies.
Question 3: Which IR framework categorizes incidents by FUNCTIONAL IMPACT rather than technical vector?
- MITRE ATT&CK
- NIST SP 800-61 (Correct answer)
- CIS Controls v8
- OWASP Top 10
Correct answer: NIST SP 800-61
NIST SP 800-61 provides a functional impact taxonomy (None, No Impact, Minimal, Significant, Severe).
Question 4: During eradication, an analyst removes malware but fails to identify the persistence mechanism. What is the MOST likely outcome?
- The attacker loses access permanently
- The malware reinstalls itself after the next reboot or scheduled task runs (Correct answer)
- The IDS generates a new alert for a different threat
- The system experiences a performance improvement
Correct answer: The malware reinstalls itself after the next reboot or scheduled task runs
Without removing persistence mechanisms like registry run keys or scheduled tasks, malware will re-execute after cleanup.
Question 5: Which log source is MOST valuable for identifying unauthorized use of administrative credentials across multiple Windows hosts?
- Application event logs
- Windows Security Event logs (Event ID 4624/4625) (Correct answer)
- System event logs
- DNS query logs
Correct answer: Windows Security Event logs (Event ID 4624/4625)
Security Event ID 4624 (successful logon) and 4625 (failed logon) are essential for tracking credential use across Windows systems.
Question 6: A responder is performing memory forensics and finds a process with no parent process ID (PPID) other than PID 4 (System). This is MOST suspicious when the process is which of the following?
- svchost.exe with PPID pointing to services.exe
- cmd.exe with PPID of 4 (System) (Correct answer)
- lsass.exe spawned by wininit.exe
- explorer.exe spawned by userinit.exe
Correct answer: cmd.exe with PPID of 4 (System)
cmd.exe should never be directly spawned by the System process; this indicates process injection or hollowing.
Question 7: Which phase of the incident response lifecycle focuses on improving defenses AFTER an incident is resolved?
- Preparation
- Containment
- Post-Incident Activity (Lessons Learned) (Correct answer)
- Detection and Analysis
Correct answer: Post-Incident Activity (Lessons Learned)
Post-Incident Activity includes lessons learned reviews to improve future detection, response, and prevention capabilities.
CCD Incident Response & Handling 3
In incident response, what is the primary purpose of a 'chain of custody' document?