CCP Incident Response & Threat Management 2 — Questions and Answers
Question 1: During a ransomware incident, the IR team isolates affected hosts but discovers the malware has a kill-switch domain. What is the BEST immediate action?
- Sinkhole the kill-switch domain to prevent detonation (Correct answer)
- Block all outbound DNS at the perimeter firewall
- Reimage all affected hosts immediately
- Pay the ransom to obtain the decryption key
Correct answer: Sinkhole the kill-switch domain to prevent detonation
Sinkholing the kill-switch domain redirects C2 traffic to a controlled server, potentially halting further encryption while preserving forensic evidence.
Question 2: Which NIST SP 800-61 phase involves capturing memory dumps and preserving log files before shutting down compromised systems?
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery (Correct answer)
- Post-Incident Activity
Correct answer: Containment, Eradication, and Recovery
Containment activities include evidence collection such as memory dumps and log preservation before systems are taken offline or reimaged.
Question 3: A SOC analyst receives an alert that a privileged account logged in from two geographically impossible locations within 10 minutes. This is an example of which threat indicator?
- Beaconing pattern
- Impossible travel anomaly (Correct answer)
- Lateral movement
- Credential stuffing
Correct answer: Impossible travel anomaly
Impossible travel anomaly flags authentication events from locations that cannot be physically reached within the observed time window.
Question 4: What is the primary purpose of a threat intelligence feed in an IR workflow?
- To automate patch deployment on vulnerable systems
- To enrich IOCs with known adversary TTPs for faster triage (Correct answer)
- To replace manual log review in the SOC
- To generate compliance reports for auditors
Correct answer: To enrich IOCs with known adversary TTPs for faster triage
Threat intelligence feeds provide context such as known malicious IPs, hashes, and TTPs that help analysts quickly assess severity and attribution.
Question 5: During eradication, an analyst finds a web shell on a public-facing server. After removing it, what is the MOST important follow-up step?
- Notify law enforcement immediately
- Identify and patch the vulnerability that allowed the web shell installation (Correct answer)
- Rotate all enterprise passwords immediately
- Disable the web server until a full audit is complete
Correct answer: Identify and patch the vulnerability that allowed the web shell installation
Removing the web shell without closing the initial access vector leaves the system vulnerable to immediate re-compromise.
Question 6: Which triage method prioritizes IR resources by categorizing incidents based on their business impact and scope?
- OODA Loop
- Cyber Kill Chain mapping
- Incident severity classification matrix (Correct answer)
- MITRE ATT&CK Navigator heatmap
Correct answer: Incident severity classification matrix
A severity classification matrix assigns priority levels (P1–P4) based on criteria like data sensitivity, affected systems count, and regulatory impact.
Question 7: An attacker uses DNS TXT records to exfiltrate data. Which detection technique is MOST effective against this method?
- Blocking all TXT record queries at the firewall
- Analyzing DNS query length and frequency anomalies (Correct answer)
- Enabling DNSSEC on internal zones
- Deploying a web application firewall
Correct answer: Analyzing DNS query length and frequency anomalies
DNS exfiltration typically produces unusually long TXT queries or high query frequency that can be detected through behavioral DNS analytics.
CCP Incident Response & Threat Management 2
During a ransomware incident, the IR team isolates affected hosts but discovers the malware has a kill-switch domain.
What is the BEST immediate action?