CSX Detect and Respond to Cyber Incidents 2 — Questions and Answers
Question 1: Which log source is MOST useful for detecting lateral movement within a Windows environment?
- Firewall deny logs
- Windows Security Event logs (Event ID 4624/4648) (Correct answer)
- DNS query logs
- Web proxy logs
Correct answer: Windows Security Event logs (Event ID 4624/4648)
Windows Security Event IDs 4624 (logon) and 4648 (explicit credential logon) reveal authentication patterns indicative of lateral movement.
Question 2: During incident response, what is the PRIMARY purpose of memory forensics?
- Recover deleted files from disk
- Capture running processes, network connections, and encryption keys not stored on disk (Correct answer)
- Analyze firewall rule changes
- Identify misconfigured services
Correct answer: Capture running processes, network connections, and encryption keys not stored on disk
Memory forensics captures volatile artifacts such as running processes, open network sockets, and in-memory encryption keys that disappear when a system is powered off.
Question 3: An analyst observes a spike in outbound DNS TXT record queries to random-looking subdomains. What attack technique does this MOST likely indicate?
- DNS amplification DDoS
- DNS cache poisoning
- DNS tunneling for data exfiltration (Correct answer)
- BGP route hijacking
Correct answer: DNS tunneling for data exfiltration
DNS tunneling encodes data within DNS queries/responses to exfiltrate information, often using TXT records and algorithmically generated subdomains.
Question 4: Which containment strategy allows investigation to continue while limiting attacker movement?
- Hard shutdown of affected systems
- Network segmentation and isolation of compromised hosts (Correct answer)
- Immediately reimaging all affected machines
- Blocking all outbound traffic at the perimeter
Correct answer: Network segmentation and isolation of compromised hosts
Network segmentation isolates compromised systems to prevent spread while keeping them online for forensic investigation.
Question 5: What does a 'beaconing' pattern in network traffic MOST likely indicate?
- A misconfigured NTP server
- Malware regularly checking in with a command-and-control server (Correct answer)
- Normal software update polling
- A port scan in progress
Correct answer: Malware regularly checking in with a command-and-control server
Beaconing refers to malware making periodic, regular outbound connections to a C2 server to receive instructions or exfiltrate data.
Question 6: Which phase of the NIST incident response lifecycle focuses on implementing lessons learned and improving defenses?
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery
- Post-Incident Activity (Correct answer)
Correct answer: Post-Incident Activity
The Post-Incident Activity phase involves conducting a lessons-learned meeting and updating policies, procedures, and controls based on the incident.
Question 7: An IDS generates 500 alerts per day but only 5 are confirmed malicious. What is this phenomenon called?
- Alert fatigue due to false positives (Correct answer)
- True positive rate degradation
- Signature collision
- Baseline drift
Correct answer: Alert fatigue due to false positives
When security tools generate excessive false positive alerts, analysts experience alert fatigue, reducing their effectiveness at identifying real threats.
CSX Detect and Respond to Cyber Incidents 2
Which log source is MOST useful for detecting lateral movement within a Windows environment?