CCD Incident Response & Threat Detection 3 ā Questions and Answers
Question 1: An IDS generates 5,000 alerts per day but analysts confirm only 12 true positives per week. What does this scenario BEST illustrate?
- High false negative rate
- Alert fatigue caused by high false positive rate (Correct answer)
- Insufficient sensor coverage
- Misconfigured logging pipeline
Correct answer: Alert fatigue caused by high false positive rate
When the vast majority of alerts are false positives, analysts become desensitizedāthis is the classic definition of alert fatigue.
Question 2: Which forensic artifact on a Windows system BEST reveals recently accessed files even if the files themselves have been deleted?
- Windows Event Log (Security)
- Prefetch files and LNK (shell link) files (Correct answer)
- Registry CurrentVersion\Run keys
- Volume Shadow Copy snapshots
Correct answer: Prefetch files and LNK (shell link) files
Prefetch files record program execution metadata, and LNK files track recently opened documents, both persisting after the original files are deleted.
Question 3: A defender uses YARA rules to scan memory dumps. What is a YARA rule primarily designed to detect?
- Network packet anomalies by protocol deviation
- Malware patterns via string and byte sequence matching (Correct answer)
- Unauthorized user account modifications
- Lateral movement via Kerberos ticket abuse
Correct answer: Malware patterns via string and byte sequence matching
YARA rules define patternsāstrings, byte sequences, and logical conditionsāthat match malware families or suspicious code in files and memory.
Question 4: During triage, an analyst finds a scheduled task that runs a Base64-encoded PowerShell command. What evasion technique does this represent?
- Process injection
- Obfuscation via encoding (Correct answer)
- DLL side-loading
- Token impersonation
Correct answer: Obfuscation via encoding
Base64 encoding the command payload is a common obfuscation technique to evade signature-based detection that looks for plaintext malicious strings.
Question 5: Which NIST SP 800-61 incident response phase focuses specifically on stopping the spread of an incident to additional systems?
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery (Correct answer)
- Post-Incident Activity
Correct answer: Containment, Eradication, and Recovery
The Containment, Eradication, and Recovery phase includes steps to isolate affected systems and prevent further spread of the incident.
Question 6: A ransomware incident has encrypted files on a file server. The FIRST priority after confirming the incident should be:
- Notifying law enforcement
- Preserving forensic evidence and isolating affected systems (Correct answer)
- Determining the ransom amount and negotiating
- Rebuilding the file server from backup
Correct answer: Preserving forensic evidence and isolating affected systems
Evidence preservation and containment must come first to prevent further encryption, protect forensic artifacts, and understand the full scope before remediation.
Question 7: A threat model rates a risk as HIGH likelihood but LOW impact. How should this influence prioritization in an IR runbook?
- Treat it as a top-tier critical incident requiring immediate all-hands response
- Automate detection and response but assign lower analyst priority than high-impact events (Correct answer)
- Deprioritize entirely since low impact makes it negligible
- Escalate to executive leadership for approval before responding
Correct answer: Automate detection and response but assign lower analyst priority than high-impact events
High-likelihood/low-impact events are candidates for automated playbooks that handle them efficiently without consuming analyst bandwidth reserved for high-impact incidents.
CCD Incident Response & Threat Detection 3
An IDS generates 5,000 alerts per day but analysts confirm only 12 true positives per week.
What does this scenario BEST illustrate?