CCP Security Operations & Incident Response 2 — Questions and Answers
Question 1: During a security incident, the FIRST priority after detecting a compromise should be to:
- Notify law enforcement immediately
- Contain the affected systems to prevent further spread (Correct answer)
- Perform a full forensic analysis of all logs
- Restore systems from backup
Correct answer: Contain the affected systems to prevent further spread
Containment is the first operational priority to limit damage and prevent lateral movement before other steps.
Question 2: Which SIEM correlation rule would BEST detect a brute-force attack against SSH?
- Single failed login from any IP
- More than 5 failed logins from the same IP within 60 seconds (Correct answer)
- Any login from a foreign country
- Successful login after business hours
Correct answer: More than 5 failed logins from the same IP within 60 seconds
Brute-force is characterized by rapid repeated failures from the same source, so a threshold-based rule within a short timeframe is most accurate.
Question 3: A SOC analyst observes outbound traffic to an IP address flagged in threat intelligence feeds. What is the MOST appropriate initial response?
- Immediately shut down the affected workstation
- Block the IP at the firewall and investigate the affected host (Correct answer)
- Submit a report to management and wait for approval
- Reimage the workstation and close the ticket
Correct answer: Block the IP at the firewall and investigate the affected host
Blocking the malicious IP stops ongoing communication while investigation of the host determines the scope and nature of compromise.
Question 4: In incident response, 'lessons learned' meetings are PRIMARILY conducted to:
- Assign blame for security failures
- Improve future detection and response capabilities (Correct answer)
- Document the incident for legal purposes
- Satisfy regulatory audit requirements
Correct answer: Improve future detection and response capabilities
Post-incident reviews focus on identifying what worked, what failed, and how to improve processes and defenses going forward.
Question 5: Which log source would be MOST valuable when investigating potential data exfiltration via DNS?
- Windows Security Event Log
- DNS query logs from the recursive resolver (Correct answer)
- Web proxy logs
- Firewall allow/deny logs
Correct answer: DNS query logs from the recursive resolver
DNS query logs reveal unusually long subdomains or high query volumes to a single domain, both signatures of DNS tunneling exfiltration.
Question 6: A 'runbook' in security operations is BEST described as:
- A physical notebook for on-call engineers
- A documented set of procedures for responding to specific incident types (Correct answer)
- A log of all past security incidents
- An automated threat hunting script
Correct answer: A documented set of procedures for responding to specific incident types
Runbooks are step-by-step procedural guides that standardize analyst response to known incident scenarios.
Question 7: What is the purpose of a 'canary token' in a security operations context?
- To test the speed of intrusion detection systems
- To detect unauthorized access by triggering an alert when accessed (Correct answer)
- To encrypt sensitive files against ransomware
- To authenticate privileged users via multi-factor
Correct answer: To detect unauthorized access by triggering an alert when accessed
Canary tokens are fake credentials or files that alert defenders when accessed, indicating an attacker is moving through the environment.
CCP Security Operations & Incident Response 2
During a security incident, the FIRST priority after detecting a compromise should be to: