CCP Incident Response & Threat Management 2

Question 1

During a ransomware incident, the IR team isolates affected hosts but discovers the malware has a kill-switch domain. What is the BEST immediate action?

Accepted Answer

Sinkhole the kill-switch domain to prevent detonation

Answer

Sinkholing the kill-switch domain redirects C2 traffic to a controlled server, potentially halting further encryption while preserving forensic evidence.

Question 2

Which NIST SP 800-61 phase involves capturing memory dumps and preserving log files before shutting down compromised systems?

Accepted Answer

Containment, Eradication, and Recovery

Answer

Containment activities include evidence collection such as memory dumps and log preservation before systems are taken offline or reimaged.

Question 3

A SOC analyst receives an alert that a privileged account logged in from two geographically impossible locations within 10 minutes. This is an example of which threat indicator?

Accepted Answer

Impossible travel anomaly

Answer

Impossible travel anomaly flags authentication events from locations that cannot be physically reached within the observed time window.

Question 4

What is the primary purpose of a threat intelligence feed in an IR workflow?

Accepted Answer

To enrich IOCs with known adversary TTPs for faster triage

Answer

Threat intelligence feeds provide context such as known malicious IPs, hashes, and TTPs that help analysts quickly assess severity and attribution.

Question 5

During eradication, an analyst finds a web shell on a public-facing server. After removing it, what is the MOST important follow-up step?

Accepted Answer

Identify and patch the vulnerability that allowed the web shell installation

Answer

Removing the web shell without closing the initial access vector leaves the system vulnerable to immediate re-compromise.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Incident Response & Threat Management 2