CCD System & Endpoint Security 3 — Questions and Answers
Question 1: Which Linux command displays currently active network connections and the processes that own them, useful for detecting backdoors?
- netstat -tulnp
- ps aux --forest
- lsof -i
- ss -antp (Correct answer)
Correct answer: ss -antp
The `ss -antp` command shows all TCP sockets with process information, and is the modern replacement for netstat on Linux systems.
Question 2: An attacker uses LOLBins (Living-off-the-Land Binaries) to execute malicious code. Which Windows binary is most commonly abused for this?
- notepad.exe
- mstsc.exe
- certutil.exe (Correct answer)
- mmc.exe
Correct answer: certutil.exe
Certutil.exe is a trusted Windows binary frequently abused to download files and decode base64-encoded payloads, bypassing basic security controls.
Question 3: Which type of rootkit operates at the kernel level by modifying the System Service Descriptor Table (SSDT) to hide malicious activity?
- Bootkit
- User-mode rootkit
- SSDT-hooking kernel rootkit (Correct answer)
- Firmware/UEFI rootkit
Correct answer: SSDT-hooking kernel rootkit
SSDT-hooking rootkits redirect system calls by patching kernel function pointers, allowing them to intercept and filter API results.
Question 4: A defender wants to detect DLL hijacking attempts. Which monitoring approach is most effective?
- Monitor registry Run keys for new entries
- Watch for DLL loads from non-standard paths (e.g., application directory vs System32) (Correct answer)
- Block all unsigned executables via AppLocker
- Enable Windows Defender real-time protection
Correct answer: Watch for DLL loads from non-standard paths (e.g., application directory vs System32)
DLL hijacking places a malicious DLL in a directory that is searched before the legitimate path; monitoring DLL load paths exposes this technique.
Question 5: Which Windows security feature prevents untrusted code from executing by using cryptographic signatures to validate software before load?
- Data Execution Prevention (DEP)
- Address Space Layout Randomization (ASLR)
- Code Integrity / Windows Code Signing (Correct answer)
- Control Flow Guard (CFG)
Correct answer: Code Integrity / Windows Code Signing
Windows Code Integrity checks cryptographic signatures on executables and drivers, blocking unsigned or improperly signed code from running.
Question 6: An analyst investigates a Windows host and finds scheduled tasks running under SYSTEM context with encoded PowerShell commands. What persistence technique is this?
- Registry Run key persistence
- COM object hijacking
- Scheduled task abuse for persistence (Correct answer)
- WMI event subscription
Correct answer: Scheduled task abuse for persistence
Attackers create scheduled tasks under SYSTEM context with obfuscated commands to maintain persistence across reboots while blending with legitimate admin tasks.
Question 7: Which tool is used to analyze Windows memory dumps offline to find injected code, hidden processes, and active network connections?
- Wireshark
- Volatility (Correct answer)
- Sysinternals Process Explorer
- KAPE
Correct answer: Volatility
Volatility is a framework for offline memory forensics that extracts processes, network connections, and artifacts from raw memory dumps.
CCD System & Endpoint Security 3
Which Linux command displays currently active network connections and the processes that own them, useful for detecting backdoors?