CNDA Intrusion Detection and Incident Response 3

Question 1

Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Accepted Answer

Advanced Persistent Threat (APT)

Answer

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

Question 2

A SOC analyst receives an alert about an impossible travel event — a user logged in from New York and Tokyo within 30 minutes. What should be the FIRST response step?

Accepted Answer

Disable the account temporarily and contact the user to verify legitimacy

Answer

The first step is to disable access to prevent potential ongoing compromise while verifying whether the activity was legitimate, such as VPN use.

Question 3

What is a 'threat hunting' program in the context of network defense?

Accepted Answer

Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Answer

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Question 4

Which log source is MOST valuable for detecting privilege escalation on a Windows system?

Accepted Answer

Windows Security Event Log (Event ID 4672 - Special Privileges Assigned)

Answer

Windows Security Event ID 4672 is generated whenever special privileges are assigned to a new logon, indicating potential privilege escalation.

Question 5

What is the MITRE ATT&CK framework used for in incident response?

Accepted Answer

Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs)

Answer

MITRE ATT&CK provides a structured knowledge base of adversary TTPs that analysts use to understand, detect, and attribute attacks.

CNDA - Certified Network Defense Architect Practice Test

CNDA - Certified Network Defense Architect Practice Test

CNDA Intrusion Detection and Incident Response 3