CCP Security Operations & Incident Response 2

Question 1

During a security incident, the FIRST priority after detecting a compromise should be to:

Accepted Answer

Contain the affected systems to prevent further spread

Answer

Containment is the first operational priority to limit damage and prevent lateral movement before other steps.

Question 2

Which SIEM correlation rule would BEST detect a brute-force attack against SSH?

Accepted Answer

More than 5 failed logins from the same IP within 60 seconds

Answer

Brute-force is characterized by rapid repeated failures from the same source, so a threshold-based rule within a short timeframe is most accurate.

Question 3

A SOC analyst observes outbound traffic to an IP address flagged in threat intelligence feeds. What is the MOST appropriate initial response?

Accepted Answer

Block the IP at the firewall and investigate the affected host

Answer

Blocking the malicious IP stops ongoing communication while investigation of the host determines the scope and nature of compromise.

Question 4

In incident response, 'lessons learned' meetings are PRIMARILY conducted to:

Accepted Answer

Improve future detection and response capabilities

Answer

Post-incident reviews focus on identifying what worked, what failed, and how to improve processes and defenses going forward.

Question 5

Which log source would be MOST valuable when investigating potential data exfiltration via DNS?

Accepted Answer

DNS query logs from the recursive resolver

Answer

DNS query logs reveal unusually long subdomains or high query volumes to a single domain, both signatures of DNS tunneling exfiltration.

(CCP) Certified Cyber Professional Practice Test