CND Incident Detection Response And Threat Prediction — 15 Questions

Question 1

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

stats sum(bytes) by dest_ip. The 'stats' command in Splunk is used for statistical aggregation, such as summing total bytes per destination IP.

Answer

rex field=bytes max_match=1

Answer

table dest_ip, bytes

Answer

eval bytes_sum = sum(bytes)

Question 2

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

Accepted Answer

Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged. Pre-installed memory acquisition tools or kernel crash dump configurations enable capturing volatile RAM before a reboot.

Answer

Configuring automatic disk encryption using BitLocker with a TPM chip

Answer

Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

Answer

Enabling centralized syslog forwarding over encrypted TLS channels

Question 3

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

Accepted Answer

Signature-based detection. Snort uses signature-based detection (pattern matching) to identify known attack patterns in network traffic.

Answer

Heuristic detection

Answer

Behavioral analytics detection

Answer

Anomaly-based detection

Question 4

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

Accepted Answer

Microsoft-Windows-PowerShell/Operational, Event ID 4104. PowerShell Script Block Logging writes to Microsoft-Windows-PowerShell/Operational with Event ID 4104.

Answer

Security log, Event ID 4688

Answer

System log, Event ID 7045

Answer

Microsoft-Windows-PowerShell/Operational, Event ID 4103

Question 5

An organization's Threat Intelligence platform ingests STIX/TAXII feeds to track Advanced Persistent Threat (APT) groups. An analyst needs to query indicators of compromise using the TAXII 2.1 protocol. Which HTTP method and endpoint structure is standard for retrieving collections in TAXII 2.1?

Accepted Answer

GET /taxii2/collections/. TAXII 2.1 REST API uses the GET method on the /collections/ endpoint to retrieve available collections of threat data.

Answer

PUT /taxii2/objects/

Answer

POST /taxii2/collections/

Answer

DELETE /taxii2/status/

Question 6

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

Accepted Answer

Network-level containment. Isolating a subnet or segment of the network to prevent propagation while maintaining internal analysis capabilities is a form of network segmentation and physical/logical isolation.

Answer

Host-level containment

Answer

Full enterprise quarantine

Answer

Application-level containment

Question 7

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

Accepted Answer

where. The KQL 'where' operator is used to filter records based on a boolean expression.

Answer

extend

Answer

project

Answer

summarize

Question 8

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

Accepted Answer

Analyze the log files to verify if an unauthorized breach has occurred. According to NIST SP 800-61, Preparation is the first phase, but when actively handling an event, the first operational phase of the incident response lifecycle is Detection and Analysis.

Answer

Contain the compromised host to prevent lateral movement

Answer

Perform post-incident lessons learned activities

Answer

Eradicate the malware from the impacted SSH server

Question 9

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

Accepted Answer

Event ID 4624. Event ID 4624 logs successful logons, and the 'Authentication Package' field specifies NTLM (or Negotiate falling back to NTLM).

Answer

Event ID 1102

Answer

Event ID 4698

Answer

Event ID 4720

Question 10

A threat hunter is searching for persistence mechanisms on a Windows system and needs to check Autoruns data. Which registry hive contains user-specific startup application entries?

Accepted Answer

HKEY_CURRENT_USER. HKEY_CURRENT_USER (HKCU) contains settings specific to the currently logged-on user, including user-level Run and RunOnce keys.

Answer

HKEY_LOCAL_MACHINE

Answer

HKEY_CLASSES_ROOT

Answer

HKEY_PERFORMANCE_DATA

Question 11

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting all serial numbers, model details, and completing a proper evidence custody form is vital for maintaining the legal chain of custody.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 12

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

Accepted Answer

Command and Control. Establishing command and control channels after successful exploitation is classified under the Command and Control phase of the Cyber Kill Chain.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Delivery

Question 13

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model, Infrastructure and Capability are core meta-features that describe how the Adversary and Victim are connected.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 14

An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?

Accepted Answer

windows.netstat. In Volatility 3, the 'windows.netstat' plugin is used to scan kernel memory structures for active network connections and sockets.

Answer

windows.dlllist

Answer

windows.pslist

Answer

windows.registry.printkey

Question 15

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

Accepted Answer

Recovery. Following Eradication comes the Recovery phase, where systems are restored to normal operation and validated.

Answer

Detection and Analysis

Answer

Preparation

Answer

Post-Incident Activity