CNDA Intrusion Detection and Incident Response 2

Question 1

During a forensic investigation, which principle ensures the integrity of digital evidence?

Accepted Answer

Chain of custody and hashing evidence with SHA-256 upon acquisition

Answer

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

Question 2

What is 'lateral movement' in the context of a network intrusion?

Accepted Answer

An attacker traversing from the initial foothold to other systems within the network

Answer

Lateral movement describes techniques attackers use to progressively access additional systems after gaining initial access, often using stolen credentials.

Question 3

Which tool is used by a CNDA to capture and analyze live network traffic during an incident?

Accepted Answer

Wireshark or tcpdump

Answer

Wireshark and tcpdump capture raw network packets, allowing analysts to reconstruct sessions and identify malicious traffic patterns.

Question 4

What does 'mean time to detect' (MTTD) measure in a security operations context?

Accepted Answer

The average time between an attacker gaining access and the defender detecting the intrusion

Answer

MTTD measures detection latency — a lower MTTD means attackers spend less time undetected and can cause less damage.

Question 5

During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Accepted Answer

Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Answer

Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.

CNDA - Certified Network Defense Architect Practice Test

CNDA - Certified Network Defense Architect Practice Test

CNDA Intrusion Detection and Incident Response 2