CCD System & Endpoint Security 2

Question 1

Which Windows feature creates read-only snapshots of files that can help recover from ransomware if not deleted by the attacker?

Accepted Answer

Shadow Volume Copies (VSS)

Answer

Volume Shadow Copy Service (VSS) creates point-in-time snapshots of files, which ransomware often targets for deletion before encrypting data.

Question 2

An analyst discovers an endpoint is beaconing to an external IP every 60 seconds. Which technique best describes this C2 communication pattern?

Accepted Answer

Periodic beaconing with a fixed sleep interval

Answer

Periodic beaconing with a fixed interval is a common C2 pattern where malware checks in at regular, predictable intervals.

Question 3

Which Windows registry hive stores autorun entries that persist malware across reboots for the current user?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run stores per-user autorun entries executed at login.

Question 4

A security team wants to prevent attackers from dumping credentials from LSASS memory. Which Windows 10/11 mitigation should they enable?

Accepted Answer

Credential Guard using virtualization-based security

Answer

Credential Guard isolates LSASS secrets in a virtualization-based security enclave, preventing tools like Mimikatz from reading them.

Question 5

Which file system artifact on Windows records the last 1,024 programs executed on a system and is invaluable for forensic investigations?

Accepted Answer

Prefetch files (.pf)

Answer

Windows Prefetch files store execution metadata for up to 1,024 applications to speed up subsequent launches and are a key forensic artifact.

(CCD) Certified Cyber Defender Practice Test