CCD Incident Response & Handling 3

Question 1

In incident response, what is the primary purpose of a 'chain of custody' document?

Accepted Answer

To ensure evidence integrity and admissibility in legal proceedings

Answer

Chain of custody records who handled evidence, when, and how, ensuring it remains untampered and legally admissible.

Question 2

A threat actor is exfiltrating data over DNS queries using base64-encoded subdomains. Which detection method is MOST effective?

Accepted Answer

Analyze DNS query frequency and subdomain length anomalies

Answer

DNS tunneling is detected by monitoring for unusually long subdomains, high query rates, and entropy anomalies.

Question 3

Which IR framework categorizes incidents by FUNCTIONAL IMPACT rather than technical vector?

Accepted Answer

NIST SP 800-61

Answer

NIST SP 800-61 provides a functional impact taxonomy (None, No Impact, Minimal, Significant, Severe).

Question 4

During eradication, an analyst removes malware but fails to identify the persistence mechanism. What is the MOST likely outcome?

Accepted Answer

The malware reinstalls itself after the next reboot or scheduled task runs

Answer

Without removing persistence mechanisms like registry run keys or scheduled tasks, malware will re-execute after cleanup.

Question 5

Which log source is MOST valuable for identifying unauthorized use of administrative credentials across multiple Windows hosts?

Accepted Answer

Windows Security Event logs (Event ID 4624/4625)

Answer

Security Event ID 4624 (successful logon) and 4625 (failed logon) are essential for tracking credential use across Windows systems.

(CCD) Certified Cyber Defender Practice Test