CCD Security Operations & Monitoring 3

Question 1

Which Windows Event ID should be monitored to detect the creation of a new local administrator account?

Accepted Answer

Event ID 4720 followed by 4732

Answer

Event ID 4720 logs account creation and Event ID 4732 logs a user being added to a security-enabled local group (such as Administrators), together indicating a new local admin.

Question 2

A SOC analyst observes that a Windows host is communicating with an external IP on port 443 using a self-signed certificate with a 1-day validity. What is the most concerning interpretation?

Accepted Answer

Command-and-control (C2) traffic using HTTPS to blend in

Answer

Adversaries often configure C2 servers with short-lived self-signed certificates to avoid detection while blending with legitimate HTTPS traffic.

Question 3

What does the security monitoring concept of 'baselining' primarily enable?

Accepted Answer

Detection of anomalies by comparing current activity to normal behavior

Answer

Baselining establishes a normal behavior profile so that deviations — such as unusual login times or data transfer volumes — can be flagged as potential threats.

Question 4

An EDR alert fires on a host showing 'cmd.exe spawned by excel.exe'. Why is this significant?

Accepted Answer

It suggests a malicious macro or exploit leveraging Excel to execute shell commands

Answer

Office applications spawning command-line interpreters is a hallmark of macro-based malware or file-based exploits executing arbitrary commands.

Question 5

Which protocol is most commonly abused for DNS tunneling to exfiltrate data?

Accepted Answer

UDP port 53 DNS TXT or NULL record queries

Answer

DNS tunneling encodes data in DNS query and response fields (especially TXT records) sent over UDP port 53, which is rarely blocked at perimeter firewalls.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Security Operations & Monitoring 3