CCD Security Operations & Monitoring 2 — Questions and Answers
Question 1: A SOC analyst notices a spike in outbound DNS queries to randomly generated domain names. What attack technique does this most likely indicate?
- SQL injection campaign
- Domain generation algorithm (DGA) malware (Correct answer)
- ARP spoofing
- Pass-the-hash attack
Correct answer: Domain generation algorithm (DGA) malware
DGA malware generates large numbers of pseudo-random domain names to locate C2 servers, resulting in high-volume DNS queries to non-existent or newly registered domains.
Question 2: Which SIEM correlation rule best detects a brute-force attack against an SSH service?
- Single failed login from one IP
- Multiple failed logins from one IP within a short time window (Correct answer)
- Successful login after a failed login
- Port scan followed by a connection
Correct answer: Multiple failed logins from one IP within a short time window
Brute-force attacks generate repeated authentication failures from the same source IP in a compressed timeframe, making threshold-based correlation rules effective.
Question 3: What does a high rate of ICMP echo requests from a single internal host to many destinations most likely indicate?
- Normal patch management activity
- Internal network reconnaissance or ping sweep (Correct answer)
- DNS cache poisoning
- SSL stripping attack
Correct answer: Internal network reconnaissance or ping sweep
A ping sweep sends ICMP echo requests to multiple hosts to discover live systems, which is a common reconnaissance technique used before lateral movement.
Question 4: An analyst reviews logs and finds repeated 'Account Locked Out' events for the same username across multiple workstations within minutes. What does this suggest?
- A user forgot their password on one machine
- A credential stuffing or password spray attack (Correct answer)
- Normal Active Directory synchronization
- A DNS resolution failure
Correct answer: A credential stuffing or password spray attack
Lockouts triggered on multiple workstations simultaneously for the same account indicate an automated attack spraying credentials across systems.
Question 5: Which log source is most valuable for detecting lateral movement via Windows Remote Management (WinRM)?
- Web server access logs
- Windows Security Event Log (Event ID 4624 with logon type 3) (Correct answer)
- DHCP server logs
- Firewall deny logs
Correct answer: Windows Security Event Log (Event ID 4624 with logon type 3)
WinRM remote logins generate Windows Security Event ID 4624 with logon type 3 (network logon), making the Security Event Log the primary detection source.
Question 6: A Zeek (Bro) log shows a very large 'resp_bytes' value for an otherwise unremarkable HTTP GET request. What should the analyst investigate?
- Server-side request forgery
- Data exfiltration via HTTP response body (Correct answer)
- Cross-site scripting
- XML external entity injection
Correct answer: Data exfiltration via HTTP response body
Unusually large response sizes to simple GET requests can indicate data being exfiltrated by embedding it in HTTP responses, a technique used in covert channels.
Question 7: Which metric in a SOC dashboard best indicates the effectiveness of the detection pipeline in minimizing attacker dwell time?
- Total number of alerts generated per day
- Mean Time to Detect (MTTD) (Correct answer)
- Number of open tickets
- Firewall throughput in Mbps
Correct answer: Mean Time to Detect (MTTD)
MTTD measures how quickly the SOC identifies a compromise; lower MTTD directly reduces attacker dwell time and limits potential damage.
CCD Security Operations & Monitoring 2
A SOC analyst notices a spike in outbound DNS queries to randomly generated domain names.
What attack technique does this most likely indicate?