CCD Incident Response & Handling 5

Question 1

Which Cyber Kill Chain phase does 'spear phishing with a malicious attachment' MOST directly correspond to?

Accepted Answer

Delivery

Answer

Delivery is the phase where the weaponized payload is transmitted to the target, such as via a phishing email.

Question 2

An analyst reviewing SIEM alerts notices repeated failed logins followed immediately by a successful login from an unusual geographic location. This BEST describes which attack pattern?

Accepted Answer

Credential stuffing or brute-force attack

Answer

Repeated failures followed by success from a foreign IP is a classic credential stuffing or brute-force pattern.

Question 3

What is the purpose of an IR 'playbook' in a security operations center?

Accepted Answer

To provide step-by-step procedures for responding to specific incident types

Answer

Playbooks standardize and accelerate response by giving analysts predefined steps for common incident scenarios.

Question 4

A security analyst receives an alert that a host is beaconing to an external IP every 60 seconds. Which phase of the incident response process does initial triage and scope determination fall under?

Accepted Answer

Detection and Analysis

Answer

Triage, scope determination, and impact analysis are core activities of the Detection and Analysis phase per NIST SP 800-61.

Question 5

Which Windows Registry hive is MOST commonly abused by malware for persistence via 'Run' keys?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKCU Run keys execute programs at user logon without requiring elevated privileges, making them a common persistence mechanism.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Incident Response & Handling 5