CND Incident Detection Response And Threat Prediction — 30 Questions

Question 1

An organization's Threat Intelligence platform ingests STIX/TAXII feeds to track Advanced Persistent Threat (APT) groups. An analyst needs to query indicators of compromise using the TAXII 2.1 protocol. Which HTTP method and endpoint structure is standard for retrieving collections in TAXII 2.1?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GET /taxii2/collections/. TAXII 2.1 defines a RESTful API where collections are retrieved using an HTTP GET request to the /taxii2/collections/ endpoint. This endpoint returns the list of collections available on the TAXII server, and clients then use GET on /collections/{id}/objects/ to retrieve STIX objects. The GET method is correct because retrieving collections is a read operation with no side effects.

Answer

PUT /taxii2/objects/

Answer

POST /taxii2/collections/

Answer

DELETE /taxii2/status/

Question 2

An organization experiences a data breach involving personal identifiable information (PII). Regulatory compliance mandates notifying authorities within 72 hours. Which phase of the incident response process includes fulfilling external reporting and stakeholder communication requirements?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase (also called Lessons Learned) is where the organization completes documentation, performs root-cause analysis, and fulfills any remaining external reporting and stakeholder communication obligations after the incident is resolved. Regulatory notification within 72 hours (e.g., GDPR) falls into this phase because it occurs after containment/eradication and involves formal reporting, making C correct.

Answer

Eradication

Answer

Preparation

Answer

Containment

Question 3

A network defender is analyzing a suspicious packet capture (PCAP) in Wireshark. The attacker is executing a covert channel over ICMP. Which Wireshark display filter isolates ICMP packets whose payload data exceeds the standard 32-byte echo request size?

Accepted Answer

icmp && data.len > 32. The filter 'icmp && data.len > 32' combines a protocol check for ICMP with a length check on the ICMP payload data field, isolating echo requests or replies whose data exceeds the standard 32-byte payload. Standard ping uses 32 bytes of data by default, so anything larger is suspicious and may indicate a covert channel tunneling data inside ICMP. This filter directly targets the anomaly described.

Answer

icmp.type == 8

Answer

udp.length > 32

Answer

ip.proto == 6 && tcp.len > 32

Question 4

A security engineer is performing threat hunting on Linux servers to detect hidden rootkits modifying system call tables. Which tool is specifically designed to check for Linux kernel module tampering and hidden processes by comparing user-space output with kernel-space data structures?

Accepted Answer

Rkhunter (Rootkit Hunter). Rkhunter (Rootkit Hunter) is purpose-built for Linux rootkit detection: it scans for hidden files, suspicious kernel modules, and compares user-space command output against raw kernel data structures to expose tampering such as modified syscall tables. It also checks file hashes against known-good baselines and flags LKM (loadable kernel module) anomalies. This makes it the correct tool for detecting kernel-level rootkits and hidden processes on Linux hosts.

Answer

Autopsy

Answer

Cisco Firepower

Answer

Volatility

Question 5

An organization is updating its incident response policy based on NIST SP 800-61. Which TWO phases are part of the post-incident activity stage? (Choose TWO)

Accepted Answer

Evidence Retention and Reporting. In NIST SP 800-61, the post-incident activity stage is where the organization handles the aftermath of a resolved incident, and it explicitly includes Lessons Learned (E), the meeting/debrief that reviews what happened, what was effective, and what improvements are needed for future response. It also includes Evidence Retention and Reporting (C), which covers determining how long to retain logs, forensic images, and other incident artifacts and documenting the incident for legal, regulatory, and historical purposes. The other options belong to earlier stages: Containment (A) and System Eradication (D) are part of the containment, eradication, and recovery phase, while Vulnerability Assessment (B) is a separate security activity, not a NIST SP 800-61 post-incident phase.

Answer

Containment

Answer

Vulnerability Assessment

Answer

System Eradication

Question 6

An incident responder is reviewing syslog data from a Linux web server and notices repeated failed SSH login attempts from an external IP address followed by a successful login. The responder decides to implement a threat hunting hypothesis using MITRE ATT&CK to categorize this behavior. Which specific technique ID best describes the adversary's initial access mechanism?

Accepted Answer

T1110 - Brute Force. T1110 - Brute Force is the correct technique because the log evidence shows repeated failed SSH authentication attempts followed by a successful login, which is the signature of credential guessing against a remote authentication service. MITRE ATT&CK classifies this under Initial Access (and also Credential Access) as T1110, with sub-techniques like T1110.001 (Password Guessing) and T1110.003 (Password Spraying). The successful login after the failures indicates the brute-force attempt succeeded, making T1110 the best fit for the adversary's initial access mechanism.

Answer

T1078 - Valid Accounts

Answer

T1021 - Remote Services

Answer

T1595 - Active Scanning

Question 7

An enterprise threat intelligence team is consuming a new threat feed formatted in STIX 2.1 to ingest indicators of compromise (IoCs) into their TIP (Threat Intelligence Platform). Which core STIX 2.1 domain object is specifically designed to encapsulate observable data such as file hashes, IP addresses, and domain names?

Accepted Answer

Cyber Observable Object (SCO). In STIX 2.1, the Cyber Observable Object (SCO) — specifically the 'observed-data' SDO wraps SCOs — is designed to represent observable artifacts like file hashes, IP addresses, domain names, and URLs. SCOs are the building blocks for indicators and observed data, making them the correct choice for encapsulating IoC observables.

Answer

Attack Pattern Object

Answer

Campaign Object

Answer

Threat Actor Object

Question 8

A network defender is implementing network-based detection for a suspected peer-to-peer botnet that uses a custom protocol over TCP. The defender wants to identify infected hosts by analyzing network traffic. Which of the following indicators should the defender monitor for? (Choose two.)

Accepted Answer

Regular beaconing intervals to a small set of external IP addresses. Regular beaconing to a small set of external IPs and unusual traffic on non-standard TCP ports with consistent packet sizes are strong indicators of a custom P2P botnet. Beaconing reveals the bot's need to communicate, while non-standard ports and consistent sizes reflect the custom protocol. These can be detected via network flow analysis and anomaly detection.

Answer

High volume of failed connection attempts to random internal IP addresses

Answer

Connections to known botnet C2 domains from threat intelligence feeds

Answer

Large outbound data transfers to multiple geographically diverse IP addresses

Question 9

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

Accepted Answer

stats sum(bytes) by dest_ip. The stats command in Splunk is used for aggregating and summarizing data. Using 'stats sum(bytes) by dest_ip' calculates the total outbound bytes for each destination IP address, directly fulfilling the requirement. This is the standard SPL syntax for grouped aggregation.

Answer

rex field=bytes max_match=1

Answer

table dest_ip, bytes

Answer

eval bytes_sum = sum(bytes)

Question 10

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

Accepted Answer

Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged. Ensuring kernel crash dumps are enabled and pre-staging a trusted memory acquisition utility like LiME directly supports forensic readiness by allowing volatile RAM contents to be captured during a live kernel attack. This preserves critical evidence that would otherwise be lost on reboot or shutdown. The other options do not address volatile memory acquisition.

Answer

Configuring automatic disk encryption using BitLocker with a TPM chip

Answer

Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

Answer

Enabling centralized syslog forwarding over encrypted TLS channels

Question 11

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

Accepted Answer

Signature-based detection. Snort is matching a specific string pattern ('SELECT * FROM users WHERE') against network traffic, which is the hallmark of signature-based detection — it compares packets against a database of known attack patterns. The rule in question is a content-match signature, not a statistical or behavioral model, so signature-based detection is the correct classification.

Answer

Heuristic detection

Answer

Behavioral analytics detection

Answer

Anomaly-based detection

Question 12

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

Accepted Answer

Microsoft-Windows-PowerShell/Operational, Event ID 4104. PowerShell script block logging writes events to the Microsoft-Windows-PowerShell/Operational log with Event ID 4104, containing the full text of executed script blocks. This is the primary source for inspecting PowerShell code executed on a Windows system, including obfuscated or malicious scripts.

Answer

Security log, Event ID 4688

Answer

System log, Event ID 7045

Answer

Microsoft-Windows-PowerShell/Operational, Event ID 4103

Question 13

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

Accepted Answer

Network-level containment. Isolating an infected subnet from the rest of the corporate network is a network-level containment strategy because it restricts the blast radius at the network layer rather than on individual hosts or applications. This approach segments the network so the worm cannot spread laterally to other subnets while the team remediates the infected systems. It is a common early step in worm outbreak response.

Answer

Host-level containment

Answer

Full enterprise quarantine

Answer

Application-level containment

Question 14

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

Accepted Answer

where. The `where` operator in KQL is the filtering operator — it returns only rows from a table that satisfy a given predicate, such as `DeviceProcessEvents | where FileName == 'cmd.exe'`. This is exactly the behavior required to include only rows where the file name matches 'cmd.exe'. It is the KQL equivalent of a SQL WHERE clause and is the standard operator used in Microsoft Defender for Endpoint advanced hunting queries.

Answer

extend

Answer

project

Answer

summarize

Question 15

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

Accepted Answer

Analyze the log files to verify if an unauthorized breach has occurred. NIST SP 800-61 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The first phase after preparation is Detection and Analysis, which in this scenario means analyzing log files to verify whether an unauthorized breach has actually occurred. Only after confirming the incident should containment, eradication, or lessons-learned activities begin.

Answer

Contain the compromised host to prevent lateral movement

Answer

Perform post-incident lessons learned activities

Answer

Eradicate the malware from the impacted SSH server

Question 16

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

Accepted Answer

Event ID 4624. Event ID 4624 is logged on successful logon and includes a Logon Type field (Type 3 for network, Type 9 for NewCredentials) plus an Authentication Package field that shows NTLM when a hash is used instead of a plaintext password. Analysts filter 4624 events for NTLM authentication to detect Pass-the-Hash activity.

Answer

Event ID 1102

Answer

Event ID 4698

Answer

Event ID 4720

Question 17

A threat hunter is searching for persistence mechanisms on a Windows system and needs to check Autoruns data. Which registry hive contains user-specific startup application entries?

Accepted Answer

HKEY_CURRENT_USER. HKEY_CURRENT_USER (HKCU) stores the profile-specific configuration for the currently logged-on user, including per-user startup entries under paths like HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce. Because these keys are tied to the user's profile (NTUSER.DAT), they are the correct hive to inspect when hunting for user-scoped persistence. HKLM holds machine-wide autoruns that apply to all users, not user-specific ones.

Answer

HKEY_LOCAL_MACHINE

Answer

HKEY_CLASSES_ROOT

Answer

HKEY_PERFORMANCE_DATA

Question 18

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting the make, model, serial number, and signing an evidence custody form is the immediate step required to establish and maintain chain of custody upon physical removal of the drive. This documentation creates the legal record of who had control of the evidence, when, and under what conditions, which is essential for evidentiary integrity in court.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 19

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

Accepted Answer

Command and Control. In the Cyber Kill Chain, the Command and Control (C2) phase involves the attacker establishing a communication channel with the compromised system to control it remotely. DNS tunneling is a common method for C2, so this alert represents the Command and Control phase.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Delivery

Question 20

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model of Intrusion Analysis, Infrastructure is one of the four core features, alongside Adversary, Capability, and Victim. It represents the physical or logical resources used by the adversary, such as command-and-control servers, and is directly connected to both Adversary and Victim in the diamond. This classification is fundamental to the model.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps