CCD Security Operations & Monitoring 2

Question 1

A SOC analyst notices a spike in outbound DNS queries to randomly generated domain names. What attack technique does this most likely indicate?

Accepted Answer

Domain generation algorithm (DGA) malware

Answer

DGA malware generates large numbers of pseudo-random domain names to locate C2 servers, resulting in high-volume DNS queries to non-existent or newly registered domains.

Question 2

Which SIEM correlation rule best detects a brute-force attack against an SSH service?

Accepted Answer

Multiple failed logins from one IP within a short time window

Answer

Brute-force attacks generate repeated authentication failures from the same source IP in a compressed timeframe, making threshold-based correlation rules effective.

Question 3

What does a high rate of ICMP echo requests from a single internal host to many destinations most likely indicate?

Accepted Answer

Internal network reconnaissance or ping sweep

Answer

A ping sweep sends ICMP echo requests to multiple hosts to discover live systems, which is a common reconnaissance technique used before lateral movement.

Question 4

An analyst reviews logs and finds repeated 'Account Locked Out' events for the same username across multiple workstations within minutes. What does this suggest?

Accepted Answer

A credential stuffing or password spray attack

Answer

Lockouts triggered on multiple workstations simultaneously for the same account indicate an automated attack spraying credentials across systems.

Question 5

Which log source is most valuable for detecting lateral movement via Windows Remote Management (WinRM)?

Accepted Answer

Windows Security Event Log (Event ID 4624 with logon type 3)

Answer

WinRM remote logins generate Windows Security Event ID 4624 with logon type 3 (network logon), making the Security Event Log the primary detection source.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Security Operations & Monitoring 2