CSX Detect and Respond to Cyber Incidents 2

Question 1

Which log source is MOST useful for detecting lateral movement within a Windows environment?

Accepted Answer

Windows Security Event logs (Event ID 4624/4648)

Answer

Windows Security Event IDs 4624 (logon) and 4648 (explicit credential logon) reveal authentication patterns indicative of lateral movement.

Question 2

During incident response, what is the PRIMARY purpose of memory forensics?

Accepted Answer

Capture running processes, network connections, and encryption keys not stored on disk

Answer

Memory forensics captures volatile artifacts such as running processes, open network sockets, and in-memory encryption keys that disappear when a system is powered off.

Question 3

An analyst observes a spike in outbound DNS TXT record queries to random-looking subdomains. What attack technique does this MOST likely indicate?

Accepted Answer

DNS tunneling for data exfiltration

Answer

DNS tunneling encodes data within DNS queries/responses to exfiltrate information, often using TXT records and algorithmically generated subdomains.

Question 4

Which containment strategy allows investigation to continue while limiting attacker movement?

Accepted Answer

Network segmentation and isolation of compromised hosts

Answer

Network segmentation isolates compromised systems to prevent spread while keeping them online for forensic investigation.

Question 5

What does a 'beaconing' pattern in network traffic MOST likely indicate?

Accepted Answer

Malware regularly checking in with a command-and-control server

Answer

Beaconing refers to malware making periodic, regular outbound connections to a C2 server to receive instructions or exfiltrate data.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Detect and Respond to Cyber Incidents 2