CCD Security Operations & Monitoring 3 — Questions and Answers
Question 1: Which Windows Event ID should be monitored to detect the creation of a new local administrator account?
- Event ID 4625
- Event ID 4720 followed by 4732 (Correct answer)
- Event ID 4663
- Event ID 7045
Correct answer: Event ID 4720 followed by 4732
Event ID 4720 logs account creation and Event ID 4732 logs a user being added to a security-enabled local group (such as Administrators), together indicating a new local admin.
Question 2: A SOC analyst observes that a Windows host is communicating with an external IP on port 443 using a self-signed certificate with a 1-day validity. What is the most concerning interpretation?
- A misconfigured internal application
- Command-and-control (C2) traffic using HTTPS to blend in (Correct answer)
- Legitimate certificate renewal traffic
- A CDN caching server
Correct answer: Command-and-control (C2) traffic using HTTPS to blend in
Adversaries often configure C2 servers with short-lived self-signed certificates to avoid detection while blending with legitimate HTTPS traffic.
Question 3: What does the security monitoring concept of 'baselining' primarily enable?
- Real-time blocking of malicious traffic
- Detection of anomalies by comparing current activity to normal behavior (Correct answer)
- Encryption of log files at rest
- Automatic patch deployment
Correct answer: Detection of anomalies by comparing current activity to normal behavior
Baselining establishes a normal behavior profile so that deviations — such as unusual login times or data transfer volumes — can be flagged as potential threats.
Question 4: An EDR alert fires on a host showing 'cmd.exe spawned by excel.exe'. Why is this significant?
- Excel routinely uses cmd.exe for macro execution
- It suggests a malicious macro or exploit leveraging Excel to execute shell commands (Correct answer)
- This is normal Windows update behavior
- It indicates a failed software installation
Correct answer: It suggests a malicious macro or exploit leveraging Excel to execute shell commands
Office applications spawning command-line interpreters is a hallmark of macro-based malware or file-based exploits executing arbitrary commands.
Question 5: Which protocol is most commonly abused for DNS tunneling to exfiltrate data?
- TCP port 80
- UDP port 53 DNS TXT or NULL record queries (Correct answer)
- ICMP type 8
- TCP port 25 SMTP
Correct answer: UDP port 53 DNS TXT or NULL record queries
DNS tunneling encodes data in DNS query and response fields (especially TXT records) sent over UDP port 53, which is rarely blocked at perimeter firewalls.
Question 6: A threat hunter finds that a legitimate system binary (e.g., certutil.exe) is downloading files from the internet. Which attack technique does this exemplify?
- Credential dumping
- Living-off-the-land (LotL) binary abuse (Correct answer)
- Kernel exploit
- DLL search-order hijacking
Correct answer: Living-off-the-land (LotL) binary abuse
Living-off-the-land attacks abuse trusted, pre-installed system tools to perform malicious actions while evading security products that whitelist these binaries.
Question 7: When triaging a potential ransomware incident, which log artifact would confirm mass file encryption activity?
- A spike in DNS NX-domain responses
- High volume of file rename/modify events in Windows Security audit logs (Event ID 4663) (Correct answer)
- Increased LDAP queries to a domain controller
- Repeated SMB null sessions
Correct answer: High volume of file rename/modify events in Windows Security audit logs (Event ID 4663)
Ransomware generates a massive burst of file write and rename operations (adding encryption extensions) that appear as Event ID 4663 (file access audited) in Windows logs.
CCD Security Operations & Monitoring 3
Which Windows Event ID should be monitored to detect the creation of a new local administrator account?