CND Incident Detection Response And Threat Prediction Practice Test 2 — 15 Questions

Question 1

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Event ID 4624. Event ID 4624 is logged on successful logon and includes a Logon Type field (Type 3 for network, Type 9 for NewCredentials) plus an Authentication Package field that shows NTLM when a hash is used instead of a plaintext password. Analysts filter 4624 events for NTLM authentication to detect Pass-the-Hash activity.

Answer

Event ID 1102

Answer

Event ID 4698

Answer

Event ID 4720

Question 2

A threat hunter is searching for persistence mechanisms on a Windows system and needs to check Autoruns data. Which registry hive contains user-specific startup application entries?

Accepted Answer

HKEY_CURRENT_USER. HKEY_CURRENT_USER (HKCU) stores the profile-specific configuration for the currently logged-on user, including per-user startup entries under paths like HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce. Because these keys are tied to the user's profile (NTUSER.DAT), they are the correct hive to inspect when hunting for user-scoped persistence. HKLM holds machine-wide autoruns that apply to all users, not user-specific ones.

Answer

HKEY_LOCAL_MACHINE

Answer

HKEY_CLASSES_ROOT

Answer

HKEY_PERFORMANCE_DATA

Question 3

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting the make, model, serial number, and signing an evidence custody form is the immediate step required to establish and maintain chain of custody upon physical removal of the drive. This documentation creates the legal record of who had control of the evidence, when, and under what conditions, which is essential for evidentiary integrity in court.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 4

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

Accepted Answer

Command and Control. In the Cyber Kill Chain, the Command and Control (C2) phase involves the attacker establishing a communication channel with the compromised system to control it remotely. DNS tunneling is a common method for C2, so this alert represents the Command and Control phase.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Delivery

Question 5

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model of Intrusion Analysis, Infrastructure is one of the four core features, alongside Adversary, Capability, and Victim. It represents the physical or logical resources used by the adversary, such as command-and-control servers, and is directly connected to both Adversary and Victim in the diamond. This classification is fundamental to the model.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 6

An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?

Accepted Answer

windows.netstat. In Volatility 3, the windows.netstat plugin enumerates network artifacts from a Windows memory image by walking the kernel's TCP/UDP endpoint and listener structures (e.g., tcpip.sys pools). It lists active connections, listening ports, and associated PIDs, which is exactly what an incident responder needs to identify command-and-control channels or exfiltration sockets. Volatility 3 uses a plugin naming convention of ., so windows.netstat is the correct choice for Windows network sockets.

Answer

windows.dlllist

Answer

windows.pslist

Answer

windows.registry.printkey

Question 7

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

Accepted Answer

Recovery. After eradication, the next immediate phase in the NIST SP 800-61 lifecycle is Recovery. Recovery involves restoring systems to normal operation, validating that they are clean, and monitoring for any residual issues. This follows containment and eradication.

Answer

Detection and Analysis

Answer

Preparation

Answer

Post-Incident Activity

Question 8

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

Accepted Answer

MISP. MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed to structure, store, and share IoCs in machine-readable formats like STIX and MISP JSON. It supports taxonomies, galaxies, and feeds that let ISACs and SOCs exchange indicators at scale. This makes it the correct answer for structuring and sharing threat intelligence.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Question 9

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

Accepted Answer

Querying authentication logs for service accounts logging in interactively via remote desktop. MITRE ATT&CK T1078 (Valid Accounts) describes adversaries using legitimate credentials to authenticate, so the best hunting methodology is to look for anomalous authentication behavior — such as service accounts logging in interactively via RDP, which violates normal service-account usage patterns. Querying authentication logs for that behavior directly aligns with detecting misuse of valid accounts, making B correct.

Answer

Scanning internal subnets for unpatched EternalBlue vulnerabilities

Answer

Searching endpoint logs for known ransomware string signatures

Answer

Checking firewall rules for outbound traffic on port 443

Question 10

A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?

Accepted Answer

alert. The 'alert' rule action keyword in Snort generates an alert and logs the packet when a rule matches, without dropping or blocking the traffic. This is the default and most common action for intrusion detection mode. When Snort runs in IDS mode, 'alert' is the appropriate keyword to detect and notify without interfering with the packet flow.

Answer

sdrop

Answer

reject

Answer

drop

Question 11

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

Accepted Answer

Strategic threat intelligence. Strategic threat intelligence is high-level, long-term intelligence focused on the adversary's intent, motivations, campaign histories, and overall risk posture. It is consumed by executives and decision-makers to shape security strategy and investment. The scenario describes detailed campaign histories and adversary motivations, which are hallmarks of strategic intelligence rather than operational, tactical, or technical feeds.

Answer

Operational threat intelligence

Answer

Tactical threat intelligence

Answer

Technical threat intelligence

Question 12

An incident responder identifies a compromised workstation and determines that isolating the machine from the network is necessary. Which tool native to Windows allows an administrator to block all inbound and outbound network traffic except for pre-configured exceptions?

Accepted Answer

Windows Defender Firewall. Windows Defender Firewall is the native Windows tool that can block all inbound and outbound traffic except for explicitly configured exceptions. An administrator can create rules to allow specific ports, IP addresses, or applications while blocking everything else, effectively isolating the workstation at the network layer. This is a common containment technique during incident response when full network isolation is required but some management or monitoring traffic must be permitted.

Answer

Disk Management

Answer

Device Manager

Answer

Task Manager

Question 13

An incident response team is performing disk forensics on an NTFS-formatted hard drive. The analyst needs to recover deleted files that were too large to fit in the Recycle Bin. Which internal NTFS metadata structure contains file record attributes including timestamps, permissions, and resident/non-resident data locations?

Accepted Answer

Master File Table (MFT). The Master File Table (MFT) is the core NTFS metadata structure; it contains one file record per file and directory, storing attributes such as $STANDARD_INFORMATION (timestamps, permissions), $FILE_NAME, and $DATA (resident or non-resident data locations). When files are deleted, their MFT records are marked as unallocated but often remain intact, enabling forensic recovery of files too large for the Recycle Bin.

Answer

File Allocation Table (FAT)

Answer

Superblock

Answer

Inode table

Question 14

A security analyst is reviewing alerts generated by an Endpoint Detection and Response (EDR) agent. The agent flags a process spawning cmd.exe with encoded arguments. Which phase of incident response involves triaging this alert to determine if it is a true positive?

Accepted Answer

Detection and Analysis. The Detection and Analysis phase of incident response involves monitoring alerts, validating whether they are true or false positives, and determining scope and impact. Triaging an EDR alert about cmd.exe with encoded arguments—a common living-off-the-land technique—falls squarely in this phase. Eradication and Recovery occur after a confirmed incident, and Preparation is the pre-incident readiness stage.

Answer

Eradication

Answer

Recovery

Answer

Preparation

Question 15

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

Accepted Answer

dc3dd. dc3dd is a forensically enhanced fork of GNU dd that creates bit-for-bit disk images while simultaneously computing cryptographic hashes (MD5, SHA-1, SHA-256) in a single pass, which is exactly what the question requires. It is purpose-built for incident response and forensic imaging, supporting progress reporting, split output, and hash verification without a second read of the source disk.

Answer

diskpart clean

Answer

chkdsk /f /r

Answer

sfc /scannow