CCP Incident Response & Threat Management 3

Question 1

In the MITRE ATT&CK framework, which tactic describes an adversary's actions to maintain access after initial compromise?

Accepted Answer

Persistence

Answer

The Persistence tactic covers techniques like scheduled tasks, registry run keys, and backdoors that allow attackers to survive reboots or credential changes.

Question 2

A security team is performing lessons learned after a breach. Which output is MOST valuable for improving future IR capability?

Accepted Answer

Updated playbooks reflecting gaps identified during the response

Answer

Updated playbooks directly improve future response speed and consistency by codifying what worked and fixing what failed during the incident.

Question 3

Which containment strategy is BEST suited for a targeted APT intrusion where stealth and intelligence gathering are priorities?

Accepted Answer

Soft containment — monitor attacker activity while limiting spread

Answer

Soft containment allows defenders to observe adversary TTPs and collect intelligence while preventing lateral movement, which is valuable against sophisticated threat actors.

Question 4

What does a high ratio of failed-to-successful login attempts on a single account over a short period MOST likely indicate?

Accepted Answer

Brute-force or credential stuffing attack

Answer

Many failed attempts followed by a success on one account is the classic signature of brute-force or credential stuffing rather than a distributed spray.

Question 5

During forensic analysis of a compromised Linux server, which artifact would BEST reveal recently executed commands by the attacker?

Accepted Answer

~/.bash_history for the compromised user account

Answer

The .bash_history file records commands executed in the bash shell for the specific user, providing a direct log of attacker activity if not cleared.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Incident Response & Threat Management 3