CCD Incident Response & Threat Detection 2

Question 1

During a containment phase, a responder isolates an infected host by removing it from the network. What is the PRIMARY risk of this action?

Accepted Answer

Destroying volatile memory evidence before capture

Answer

Network isolation can disrupt live memory, which holds ephemeral artifacts like running processes, open connections, and encryption keys crucial to the investigation.

Question 2

A SIEM alert fires on repeated failed logins followed immediately by a successful login from a foreign IP. Which MITRE ATT&CK tactic does this pattern most directly map to?

Accepted Answer

Credential Access via Brute Force

Answer

Repeated failed logins succeeded by a success from an unusual IP is the classic signature of brute-force credential access (T1110).

Question 3

Which log source is MOST valuable for reconstructing the exact sequence of commands an attacker ran on a compromised Linux host?

Accepted Answer

Auditd with execve syscall rules

Answer

Auditd configured to capture execve syscalls records every command execution at the kernel level and cannot be trivially cleared by the user like bash_history.

Question 4

An analyst receives a threat intelligence feed indicating a new C2 domain. What is the FASTEST defensive action that blocks communication without requiring endpoint changes?

Accepted Answer

Add the domain to DNS RPZ (Response Policy Zone) sinkhole

Answer

A DNS RPZ sinkhole immediately intercepts and redirects DNS queries for the malicious domain across the entire network without touching individual endpoints.

Question 5

After eradication of malware, what is the CRITICAL step before returning a system to production?

Accepted Answer

Restoring from a known-good backup or rebuilding the system

Answer

Malware can leave persistent backdoors invisible to scanners; restoring from a pre-incident clean backup or rebuilding ensures a trustworthy baseline.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Incident Response & Threat Detection 2