CCD Incident Response & Threat Detection 3

Question 1

An IDS generates 5,000 alerts per day but analysts confirm only 12 true positives per week. What does this scenario BEST illustrate?

Accepted Answer

Alert fatigue caused by high false positive rate

Answer

When the vast majority of alerts are false positives, analysts become desensitized—this is the classic definition of alert fatigue.

Question 2

Which forensic artifact on a Windows system BEST reveals recently accessed files even if the files themselves have been deleted?

Accepted Answer

Prefetch files and LNK (shell link) files

Answer

Prefetch files record program execution metadata, and LNK files track recently opened documents, both persisting after the original files are deleted.

Question 3

A defender uses YARA rules to scan memory dumps. What is a YARA rule primarily designed to detect?

Accepted Answer

Malware patterns via string and byte sequence matching

Answer

YARA rules define patterns—strings, byte sequences, and logical conditions—that match malware families or suspicious code in files and memory.

Question 4

During triage, an analyst finds a scheduled task that runs a Base64-encoded PowerShell command. What evasion technique does this represent?

Accepted Answer

Obfuscation via encoding

Answer

Base64 encoding the command payload is a common obfuscation technique to evade signature-based detection that looks for plaintext malicious strings.

Question 5

Which NIST SP 800-61 incident response phase focuses specifically on stopping the spread of an incident to additional systems?

Accepted Answer

Containment, Eradication, and Recovery

Answer

The Containment, Eradication, and Recovery phase includes steps to isolate affected systems and prevent further spread of the incident.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Incident Response & Threat Detection 3