CCD Incident Response & Threat Detection 2 — Questions and Answers
Question 1: During a containment phase, a responder isolates an infected host by removing it from the network. What is the PRIMARY risk of this action?
- Destroying volatile memory evidence before capture (Correct answer)
- Triggering data encryption on remaining hosts
- Alerting the attacker to the investigation
- Corrupting the system's file integrity baseline
Correct answer: Destroying volatile memory evidence before capture
Network isolation can disrupt live memory, which holds ephemeral artifacts like running processes, open connections, and encryption keys crucial to the investigation.
Question 2: A SIEM alert fires on repeated failed logins followed immediately by a successful login from a foreign IP. Which MITRE ATT&CK tactic does this pattern most directly map to?
- Credential Access via Brute Force (Correct answer)
- Lateral Movement via Pass-the-Hash
- Initial Access via Valid Accounts
- Persistence via Account Manipulation
Correct answer: Credential Access via Brute Force
Repeated failed logins succeeded by a success from an unusual IP is the classic signature of brute-force credential access (T1110).
Question 3: Which log source is MOST valuable for reconstructing the exact sequence of commands an attacker ran on a compromised Linux host?
- Syslog facility auth.log
- Bash history file (~/.bash_history)
- Auditd with execve syscall rules (Correct answer)
- Cron job logs (/var/log/cron)
Correct answer: Auditd with execve syscall rules
Auditd configured to capture execve syscalls records every command execution at the kernel level and cannot be trivially cleared by the user like bash_history.
Question 4: An analyst receives a threat intelligence feed indicating a new C2 domain. What is the FASTEST defensive action that blocks communication without requiring endpoint changes?
- Deploy a new EDR signature to all endpoints
- Add the domain to DNS RPZ (Response Policy Zone) sinkhole (Correct answer)
- Block the domain's ASN at the perimeter firewall
- Quarantine all endpoints that queried the domain
Correct answer: Add the domain to DNS RPZ (Response Policy Zone) sinkhole
A DNS RPZ sinkhole immediately intercepts and redirects DNS queries for the malicious domain across the entire network without touching individual endpoints.
Question 5: After eradication of malware, what is the CRITICAL step before returning a system to production?
- Resetting all local user passwords
- Restoring from a known-good backup or rebuilding the system (Correct answer)
- Running a full antivirus scan on the cleaned system
- Notifying the user that the incident is resolved
Correct answer: Restoring from a known-good backup or rebuilding the system
Malware can leave persistent backdoors invisible to scanners; restoring from a pre-incident clean backup or rebuilding ensures a trustworthy baseline.
Question 6: A threat hunter notices PowerShell launching from within Microsoft Word. Which detection technique most directly identifies this parent-child process anomaly?
- Signature-based antivirus detection
- Process lineage / parent-child process analysis (Correct answer)
- Network flow baseline anomaly detection
- File hash reputation lookup via VirusTotal
Correct answer: Process lineage / parent-child process analysis
Parent-child process analysis examines the spawning relationship between processes, making it ideal for catching living-off-the-land techniques like Office → PowerShell.
Question 7: During lessons-learned, the team identifies that dwell time was 47 days. Which control failure MOST likely contributed to the extended dwell time?
- Lack of a vulnerability management program
- Insufficient SIEM alerting and threat hunting cadence (Correct answer)
- Absence of multi-factor authentication on VPN
- Failure to patch a known critical CVE within SLA
Correct answer: Insufficient SIEM alerting and threat hunting cadence
Long dwell time indicates that detection mechanisms—SIEM tuning, alert triage, and proactive threat hunting—were insufficient to surface attacker activity sooner.
CCD Incident Response & Threat Detection 2
During a containment phase, a responder isolates an infected host by removing it from the network.
What is the PRIMARY risk of this action?