CCD Network Defense & Monitoring 2

Question 1

A SOC analyst notices a spike in outbound DNS queries to randomly generated domain names. Which attack technique does this most likely indicate?

Accepted Answer

Domain generation algorithm (DGA) malware

Answer

DGA malware generates large numbers of pseudo-random domain names to locate C2 servers, producing the characteristic spike in DNS queries.

Question 2

Which NetFlow field is MOST useful for detecting port scanning activity on a network?

Accepted Answer

Number of unique destination ports per source IP

Answer

Port scanning produces many short flows to unique destination ports from a single source, making destination port diversity the key indicator.

Question 3

A network defender wants to detect lateral movement using Windows Event Logs. Which Event ID is most relevant for tracking pass-the-hash attacks?

Accepted Answer

4624 with Logon Type 3

Answer

Event ID 4624 with Logon Type 3 (network logon) using NTLM authentication is the primary indicator of pass-the-hash lateral movement.

Question 4

What is the primary purpose of a network tap compared to a SPAN port for traffic monitoring?

Accepted Answer

Taps provide full-duplex traffic capture without affecting the monitored link

Answer

Network taps passively copy all traffic on a link in both directions without impacting performance, unlike SPAN ports which can drop packets under load.

Question 5

An IDS generates an alert every time a legitimate vulnerability scanner runs on the network. This is an example of:

Accepted Answer

False positive

Answer

A false positive occurs when the IDS flags benign activity — in this case, an authorized scanner — as malicious.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Network Defense & Monitoring 2