CCP Security Operations & Incident Response 3

Question 1

Which of the following BEST describes the difference between a 'false positive' and a 'false negative' in intrusion detection?

Accepted Answer

A false positive alerts on benign activity; a false negative fails to alert on real attacks

Answer

False positives create alert fatigue by flagging legitimate activity, while false negatives are more dangerous as real threats go undetected.

Question 2

When performing memory forensics on a compromised Windows host, which tool is commonly used to capture a volatile memory image?

Accepted Answer

WinPmem / DumpIt

Answer

WinPmem and DumpIt are live memory acquisition tools that capture a raw memory image; Volatility is then used to analyze the resulting dump.

Question 3

A security analyst discovers that an attacker used 'living off the land' techniques. This MOST likely means the attacker:

Accepted Answer

Used legitimate OS tools like PowerShell and WMI to avoid detection

Answer

Living-off-the-land attacks leverage built-in OS utilities to blend in with normal operations and evade signature-based defenses.

Question 4

The MITRE ATT&CK framework is PRIMARILY used by SOC teams to:

Accepted Answer

Map observed adversary behaviors to known tactics and techniques

Answer

ATT&CK provides a structured taxonomy of adversary TTPs that analysts use to categorize detections and identify coverage gaps.

Question 5

During incident triage, what does 'scoping' refer to?

Accepted Answer

Determining the full extent of systems and data affected by the incident

Answer

Scoping defines the blast radius of an incident by identifying all compromised assets, accounts, and data to guide containment and remediation.

(CCP) Certified Cyber Professional Practice Test