CCP SOC Operations & Alert Triage 3

Question 1

An analyst notices PowerShell commands with Base64-encoded arguments in endpoint logs. What is the MOST appropriate immediate action?

Accepted Answer

Isolate the host and escalate for deeper investigation

Answer

Base64-encoded PowerShell is a common obfuscation technique used by attackers, warranting host isolation and escalation to prevent further compromise.

Question 2

Which framework is MOST commonly used by SOC teams to map adversary tactics and techniques during alert triage?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK provides a structured knowledge base of adversary tactics and techniques that SOC teams use to classify and contextualize observed behaviors.

Question 3

A SOC receives an alert that a user downloaded an executable from a file-sharing site. Which data source BEST helps determine if the file is malicious?

Accepted Answer

Threat intelligence feed and file hash lookup

Answer

Cross-referencing the file's hash against threat intelligence feeds and reputation databases provides rapid malware classification.

Question 4

What does 'dwell time' refer to in the context of SOC operations?

Accepted Answer

Duration between initial compromise and threat detection

Answer

Dwell time is the period an attacker remains undetected within a network after initial compromise, and reducing it is a key SOC goal.

Question 5

Which type of analysis involves examining the behavior of a suspicious file in a controlled, isolated environment?

Accepted Answer

Dynamic (sandbox) analysis

Answer

Dynamic or sandbox analysis executes the suspicious file in an isolated environment to observe its runtime behavior without risking production systems.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP SOC Operations & Alert Triage 3