CCP Incident Response & Threat Management 3 — Questions and Answers
Question 1: In the MITRE ATT&CK framework, which tactic describes an adversary's actions to maintain access after initial compromise?
- Initial Access
- Persistence (Correct answer)
- Privilege Escalation
- Defense Evasion
Correct answer: Persistence
The Persistence tactic covers techniques like scheduled tasks, registry run keys, and backdoors that allow attackers to survive reboots or credential changes.
Question 2: A security team is performing lessons learned after a breach. Which output is MOST valuable for improving future IR capability?
- A list of all IOCs discovered during the incident
- Updated playbooks reflecting gaps identified during the response (Correct answer)
- A timeline of attacker actions for law enforcement
- Metrics on mean time to detect and respond
Correct answer: Updated playbooks reflecting gaps identified during the response
Updated playbooks directly improve future response speed and consistency by codifying what worked and fixing what failed during the incident.
Question 3: Which containment strategy is BEST suited for a targeted APT intrusion where stealth and intelligence gathering are priorities?
- Hard containment — immediately isolate all affected systems
- Soft containment — monitor attacker activity while limiting spread (Correct answer)
- Eradication first — remove all malware before containment
- Public disclosure — notify all stakeholders immediately
Correct answer: Soft containment — monitor attacker activity while limiting spread
Soft containment allows defenders to observe adversary TTPs and collect intelligence while preventing lateral movement, which is valuable against sophisticated threat actors.
Question 4: What does a high ratio of failed-to-successful login attempts on a single account over a short period MOST likely indicate?
- Password spraying attack
- Brute-force or credential stuffing attack (Correct answer)
- Privilege escalation attempt
- Session hijacking
Correct answer: Brute-force or credential stuffing attack
Many failed attempts followed by a success on one account is the classic signature of brute-force or credential stuffing rather than a distributed spray.
Question 5: During forensic analysis of a compromised Linux server, which artifact would BEST reveal recently executed commands by the attacker?
- /var/log/auth.log
- ~/.bash_history for the compromised user account (Correct answer)
- /etc/passwd
- /proc/net/tcp
Correct answer: ~/.bash_history for the compromised user account
The .bash_history file records commands executed in the bash shell for the specific user, providing a direct log of attacker activity if not cleared.
Question 6: An IR team confirms data exfiltration occurred. Under GDPR, what is the maximum notification window to the supervisory authority after becoming aware of the breach?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in risk.
Question 7: Which tool category is MOST appropriate for correlating events across multiple log sources to detect multi-stage attacks?
- Vulnerability scanner
- SIEM (Security Information and Event Management) (Correct answer)
- DLP (Data Loss Prevention)
- PAM (Privileged Access Management)
Correct answer: SIEM (Security Information and Event Management)
A SIEM aggregates and correlates log data from diverse sources, enabling detection of attack patterns that span multiple systems and time windows.
CCP Incident Response & Threat Management 3
In the MITRE ATT&CK framework, which tactic describes an adversary's actions to maintain access after initial compromise?