CCD Incident Response & Handling 4

Question 1

Which technique involves an attacker using legitimate system tools like PowerShell, WMI, or certutil to carry out malicious actions, making detection harder?

Accepted Answer

Living off the Land (LotL)

Answer

Living off the Land attacks use built-in OS tools that are trusted by security products, reducing the malware footprint.

Question 2

An IR analyst needs to determine if a suspicious IP communicated with internal hosts over the past 30 days. Which data source is MOST appropriate?

Accepted Answer

NetFlow or IPFIX records from network devices

Answer

NetFlow records provide historical IP-level communication metadata, ideal for retrospective threat hunting.

Question 3

What is the key difference between an 'incident' and an 'event' in the context of NIST SP 800-61?

Accepted Answer

An event is any observable occurrence; an incident is an event that adversely affects security

Answer

NIST defines an event as any observable action in a system, while an incident is an event that threatens confidentiality, integrity, or availability.

Question 4

Which tool is MOST commonly used to create a forensically sound bit-for-bit image of a hard drive during incident response?

Accepted Answer

dd or dcfldd

Answer

dd and dcfldd create exact bit-for-bit copies of storage media with cryptographic hashing to verify integrity.

Question 5

An attacker establishes a reverse shell using an encrypted channel over port 443 to avoid detection. Which defensive control would MOST effectively detect this?

Accepted Answer

Deploy SSL/TLS inspection to analyze encrypted traffic content

Answer

SSL/TLS inspection (MITM proxy) decrypts outbound traffic for inspection, revealing malicious content hidden in encrypted channels.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Incident Response & Handling 4