CCD System & Endpoint Security 2 — Questions and Answers
Question 1: Which Windows feature creates read-only snapshots of files that can help recover from ransomware if not deleted by the attacker?
- BitLocker
- Shadow Volume Copies (VSS) (Correct answer)
- Windows Defender Credential Guard
- Secure Boot
Correct answer: Shadow Volume Copies (VSS)
Volume Shadow Copy Service (VSS) creates point-in-time snapshots of files, which ransomware often targets for deletion before encrypting data.
Question 2: An analyst discovers an endpoint is beaconing to an external IP every 60 seconds. Which technique best describes this C2 communication pattern?
- Fast flux DNS
- Domain fronting
- Periodic beaconing with a fixed sleep interval (Correct answer)
- HTTP tunneling over port 443
Correct answer: Periodic beaconing with a fixed sleep interval
Periodic beaconing with a fixed interval is a common C2 pattern where malware checks in at regular, predictable intervals.
Question 3: Which Windows registry hive stores autorun entries that persist malware across reboots for the current user?
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (Correct answer)
- HKEY_LOCAL_MACHINE\SAM
- HKEY_CLASSES_ROOT\CLSID
Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run stores per-user autorun entries executed at login.
Question 4: A security team wants to prevent attackers from dumping credentials from LSASS memory. Which Windows 10/11 mitigation should they enable?
- Windows Firewall with Advanced Security
- Credential Guard using virtualization-based security (Correct answer)
- AppLocker whitelist policies
- Controlled Folder Access
Correct answer: Credential Guard using virtualization-based security
Credential Guard isolates LSASS secrets in a virtualization-based security enclave, preventing tools like Mimikatz from reading them.
Question 5: Which file system artifact on Windows records the last 1,024 programs executed on a system and is invaluable for forensic investigations?
- Event Log (Security)
- Prefetch files (.pf) (Correct answer)
- AppCompatCache (ShimCache)
- Amcache.hve
Correct answer: Prefetch files (.pf)
Windows Prefetch files store execution metadata for up to 1,024 applications to speed up subsequent launches and are a key forensic artifact.
Question 6: A Linux system shows an unknown process with a deleted binary (shown as /proc/<pid>/exe pointing to a deleted file). What does this indicate?
- The process crashed and its binary was cleaned up
- A fileless or in-memory malware technique to evade disk-based detection (Correct answer)
- Normal behavior when package managers update binaries in use
- The process is a kernel thread with no associated binary
Correct answer: A fileless or in-memory malware technique to evade disk-based detection
Malware often deletes its binary after execution to remain resident only in memory, reducing its on-disk footprint and evading file-based AV scans.
Question 7: Which endpoint detection capability specifically monitors and logs the sequence of parent-child process relationships to detect process injection?
- File Integrity Monitoring (FIM)
- Network Traffic Analysis (NTA)
- Process lineage / process tree analysis (Correct answer)
- Memory forensics with Volatility
Correct answer: Process lineage / process tree analysis
Process lineage tracking records parent-child relationships, revealing anomalies like Word spawning PowerShell, a common injection indicator.
CCD System & Endpoint Security 2
Which Windows feature creates read-only snapshots of files that can help recover from ransomware if not deleted by the attacker?