CCD Log Analysis & Forensics 3

Question 1

An analyst reviews Apache access logs and sees repeated requests for '/../../../etc/passwd'. What attack is being attempted?

Accepted Answer

Directory traversal

Answer

Sequences of '../' in URLs are the signature pattern of directory traversal attacks attempting to read files outside the web root.

Question 2

In network forensics, what does a high volume of DNS TXT record queries to a single external domain suggest?

Accepted Answer

DNS-based data exfiltration (DNS tunneling)

Answer

Unusually high DNS TXT queries—especially with encoded or high-entropy subdomains—are a primary indicator of DNS tunneling used for C2 or data exfiltration.

Question 3

Which chain-of-custody principle ensures that digital evidence remains admissible in court?

Accepted Answer

A documented, unbroken record of evidence handling from collection to presentation

Answer

An unbroken chain of custody documents every person who handled the evidence, preventing claims of tampering and ensuring legal admissibility.

Question 4

During log analysis you notice an internal host making outbound connections on port 443 to 10 different external IPs every 30 minutes. What C2 technique does this resemble?

Accepted Answer

Beaconing

Answer

Regular, periodic outbound connections from a compromised host to external IPs is the defining characteristic of C2 beaconing.

Question 5

What tool is commonly used on Linux to capture and analyze raw network packets during a live forensic investigation?

Accepted Answer

tcpdump

Answer

tcpdump is a command-line packet analyzer used to capture and inspect raw network traffic in real time on Linux systems.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Log Analysis & Forensics 3