CCD System & Endpoint Security 3

Question 1

Which Linux command displays currently active network connections and the processes that own them, useful for detecting backdoors?

Accepted Answer

ss -antp

Answer

The `ss -antp` command shows all TCP sockets with process information, and is the modern replacement for netstat on Linux systems.

Question 2

An attacker uses LOLBins (Living-off-the-Land Binaries) to execute malicious code. Which Windows binary is most commonly abused for this?

Accepted Answer

certutil.exe

Answer

Certutil.exe is a trusted Windows binary frequently abused to download files and decode base64-encoded payloads, bypassing basic security controls.

Question 3

Which type of rootkit operates at the kernel level by modifying the System Service Descriptor Table (SSDT) to hide malicious activity?

Accepted Answer

SSDT-hooking kernel rootkit

Answer

SSDT-hooking rootkits redirect system calls by patching kernel function pointers, allowing them to intercept and filter API results.

Question 4

A defender wants to detect DLL hijacking attempts. Which monitoring approach is most effective?

Accepted Answer

Watch for DLL loads from non-standard paths (e.g., application directory vs System32)

Answer

DLL hijacking places a malicious DLL in a directory that is searched before the legitimate path; monitoring DLL load paths exposes this technique.

Question 5

Which Windows security feature prevents untrusted code from executing by using cryptographic signatures to validate software before load?

Accepted Answer

Code Integrity / Windows Code Signing

Answer

Windows Code Integrity checks cryptographic signatures on executables and drivers, blocking unsigned or improperly signed code from running.

(CCD) Certified Cyber Defender Practice Test