CND Incident Detection Response And Threat Prediction Practice Test 3 — 15 Questions

Question 1

An incident response investigator is analyzing a Linux server compromised via a web shell. To determine when the web shell file was last accessed or modified, the investigator examines file timestamps. Which Linux command displays the complete file status including access, modification, and change (mtime, atime, ctime) times?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

stat. The stat command displays detailed file metadata including all three timestamps: atime (last access), mtime (last content modification), and ctime (last inode/status change). This is exactly what an investigator needs to build a timeline of when a web shell was dropped, accessed, or altered. Unlike ls, stat shows full-precision timestamps and the inode change time, which is critical for forensic timeline reconstruction.

Answer

find / -name '*.php'

Answer

ls -la

Answer

cat

Question 2

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Option C, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, is correct because this machine-wide Run key causes listed programs to execute automatically at system startup for all users, a classic autostart location abused for persistence. Option D, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, is correct because the per-user Run key launches listed programs at logon of that user, and it is frequently used since it often requires no administrative privileges. Option E, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, is correct because values such as Shell, Userinit, and Notify in this key are hijacked to execute malicious code during the logon process. Option A, HKEY_CLASSES_ROOT\.txt\DefaultIcon, is not a standard autostart persistence location; it only defines the default icon for .txt files and does not trigger execution at boot or logon. Option B, HKEY_PERFORMANCE_DATA\CurrentPerformance, is a volatile performance-counter hive used for system metrics, not a persistence mechanism, so it does not belong.

Answer

HKEY_CLASSES_ROOT\.txt\DefaultIcon

Answer

HKEY_PERFORMANCE_DATA\CurrentPerformance

Question 3

An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)

Accepted Answer

It is hypothesis-driven, focusing on assumptions that adversaries are already inside the network. Option A is correct because proactive threat hunting is fundamentally hypothesis-driven: hunters assume adversaries may already be present and form testable hypotheses (e.g., 'attackers are using living-off-the-land binaries for lateral movement') to guide their searches, rather than waiting for an alert. Option C is correct because threat hunting is a human-led, iterative process in which analysts manually and repeatedly query endpoint telemetry (EDR process trees, command lines) and network telemetry (NetFlow, DNS, proxy logs) to validate or refute hypotheses, refining the hunt as findings emerge. These two traits distinguish hunting from reactive SOC monitoring, which is alert-driven and typically triggered by SIEM correlation rules or IDS signatures after suspicious activity is detected. Option B is wrong because hunting is proactive and occurs before or independent of a completed ransomware event, not only afterward. Option D is wrong because hunting complements, but does not replace, preventive controls such as firewalls and endpoint protection agents. Option E is wrong because exclusive reliance on automated SIEM alerts describes reactive monitoring, the very approach hunting is meant to augment.

Answer

It is performed only after a major ransomware encryption event completes

Answer

It replaces network firewalls and endpoint protection agents completely

Answer

It relies exclusively on automated SIEM alerts to trigger response actions

Question 4

A security analyst is hardening an enterprise network to support robust forensic readiness. Which THREE administrative or technical controls should be implemented to ensure successful post-incident investigations? (Choose THREE)

Accepted Answer

Implementing centralized and write-once-read-many (WORM) log storage repositories. Option B is correct because centralized WORM log repositories preserve audit records in an immutable, tamper-evident form, ensuring log integrity and availability for post-incident analysis even if an attacker compromises individual hosts. Option D is correct because synchronized NTP timestamps across all devices provide a consistent, correlatable timeline, which is essential for reconstructing the sequence of events during an investigation. Option E is correct because predefined procedures and tooling for volatile memory and disk acquisition enable rapid, forensically sound evidence capture before volatile data (RAM, network connections, running processes) is lost. Option A is wrong because disabling auditing destroys the very evidence needed for investigations and violates forensic readiness principles. Option C is wrong because granting users local administrative privileges increases the attack surface and lets insiders alter or delete evidence, undermining forensic integrity.

Answer

Disabling all system auditing to maximize storage capacity for business applications

Answer

Allowing users local administrative privileges to troubleshoot their own workstations

Question 5

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

Accepted Answer

AlienVault Open Threat Exchange (OTX). AlienVault Open Threat Exchange (OTX) is correct because it is a free, publicly accessible community platform where researchers share indicators of compromise (IOCs) such as IP addresses, domains, and file hashes, making it a classic OSINT source for network defenders. The National Vulnerability Database (NVD), maintained by NIST, is also correct because it publicly publishes CVE records, CVSS severity scores, and CPE applicability data that defenders use for vulnerability management without any restricted access. Internal employee performance reviews are not OSINT since they are private organizational records, not publicly available intelligence. Proprietary zero-day broker feeds requiring an NDA and subscription fees are closed-source (commercial) intelligence, not open-source. Classified military signals intelligence intercepts are classified government intelligence, which by definition falls outside OSINT.

Answer

Internal employee performance reviews

Answer

Proprietary zero-day broker feeds requiring signed NDA and high subscription fees

Answer

Classified military signals intelligence intercepts

Question 6

An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)

Accepted Answer

Server Name Indication (SNI) fields in the TLS Client Hello message. Option C is correct because the SNI field in the TLS Client Hello is sent in cleartext even when the rest of the session is encrypted, so the analyst can see which hostnames a client is contacting and flag anomalous or DGA-like domains. Option D is correct because JA3 (client) and JA3S (server) fingerprints are derived from the TLS Client Hello and Server Hello parameters (version, cipher suites, extensions, elliptic curves), letting the analyst detect malware families or non-browser TLS stacks even without decrypting traffic. Option E is correct because X.509 certificate metadata such as issuer, validity dates, and self-signed status is observable during the handshake and can reveal suspicious or internally generated certificates used by C2 or exfiltration channels. Option A does not belong because HTTPS payload bodies are encrypted by TLS, so plaintext passwords are not directly extractable from captured traffic without decryption keys or a TLS-terminating proxy. Option B does not belong because raw ICMP echo payload strings are unrelated to TLS handshake anomalies and would not identify encrypted-channel exfiltration.

Answer

Plaintext passwords extracted from HTTPS payload bodies

Answer

Raw ICMP echo payload strings

Question 7

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

Accepted Answer

Potential operational downtime and business impact. Option A is correct because selecting a containment strategy requires weighing the operational downtime and business impact of taking the compromised web server offline, since containment actions such as isolating the host, blocking ports, or shutting it down can disrupt critical services and must be balanced against the severity of the threat. Option D is correct because evidence preservation is a key containment consideration; volatile data such as RAM contents, running processes, and network connections can be lost if the server is powered off or rebooted, so defenders may choose network isolation over shutdown to preserve forensic artifacts. The remaining options are not relevant: Ethernet cable color (B), the IT director's desk location (C), and the server manufacturer's brand name (E) have no bearing on containment strategy selection.

Answer

The color of the Ethernet cables connected to the rack

Answer

The office desk location of the IT director

Answer

The brand name of the server manufacturer

Question 8

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

Accepted Answer

Executing automated containment playbooks (e.g., isolating a host upon high-fidelity alert). Option C is correct because SOAR platforms are built to run orchestrated playbooks that trigger automated containment actions, such as isolating an endpoint via EDR API or disabling an account when a high-fidelity alert fires, reducing mean time to respond. Option D is correct because SOAR natively performs automated IOC enrichment by querying external threat intelligence APIs (e.g., VirusTotal, MISP, Recorded Future) to add context like reputation, geolocation, and related campaigns to alerts. Option E is correct because SOAR integrates with ITSM and case management tools such as Jira and ServiceNow to auto-create, update, and track incident tickets, streamlining workflow and documentation. Option A is incorrect because designing marketing websites is a web development function unrelated to security orchestration or incident response. Option B is incorrect because SOAR is software orchestration, not physical robotics, and it does not replace data center firewalls with robotic hardware arms.

Answer

Designing corporate marketing websites

Answer

Replacing physical data center firewalls with robotic hardware arms

Question 9

A network security administrator is configuring intrusion detection systems. Which TWO operational benefits does anomaly-based detection offer compared to signature-based detection? (Choose TWO)

Accepted Answer

Ability to detect previously unknown (zero-day) attacks based on baseline deviations. Option B is correct because anomaly-based detection compares live traffic against a learned baseline of normal behavior, so deviations can reveal zero-day or previously unknown attacks for which no signature exists yet. Option E is correct because anomaly-based systems build profiles from the organization's own traffic, allowing detection thresholds and models to reflect that environment's unique protocols, hosts, and usage patterns. Options A, C, and D are not correct: anomaly-based detection does not name exact malware families instantaneously (that is signature matching), it typically consumes significant CPU/memory for baselining and statistical analysis, and it is well known for generating false positives when legitimate behavior deviates from the baseline.

Answer

Instantaneous identification of exact malware families by name without analysis

Answer

Zero computational resource overhead

Answer

Complete absence of false positive alerts in any network environment

Question 10

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

Accepted Answer

Memory regions containing executable code that do not back to any file on disk (unbacked memory). Option A is correct because process hollowing and similar injection techniques often leave executable memory regions that have no corresponding backing file on disk (unbacked memory), which is a strong indicator of injected code since legitimate executable pages normally map to a PE image on disk. Option D is correct because a thread's start address that falls outside the bounds of any loaded module image indicates the thread was created to execute injected code rather than legitimate module code, a hallmark of injection. Option E is correct because memory regions allocated with PAGE_EXECUTE_READWRITE (RWX) permissions in non-system processes are suspicious, as legitimate code pages are typically RX or read-only, and RWX allocations often host injected shellcode. Option B is not relevant because $MFT file creation timestamps only reflect file system activity and do not reveal in-memory code injection. Option C is not relevant because wallpaper configuration settings have no bearing on detecting process injection.

Answer

Standard file creation timestamps in the $MFT

Answer

Default Windows system wallpaper configuration settings

Question 11

A security analyst is investigating a suspected malware outbreak on a domain controller. To ensure forensic integrity and maintain a proper chain of custody before powering down the machine, what is the correct sequence of volatility when acquiring volatile evidence using live response tools such as FTK Imager or LiME?

Accepted Answer

CPU registers and cache, routing tables and network connections, system memory (RAM), hard disk storage. The order of volatility, from most volatile to least volatile, is: CPU registers and cache, routing tables and network connections, system memory (RAM), and then hard disk storage. This sequence ensures that the most perishable evidence is captured first before it is lost due to power-down or ongoing system activity. Option B correctly lists this order.

Answer

Running processes, hard disk storage, system memory (RAM), CPU registers

Answer

Hard disk image, system memory (RAM), network connections, running processes

Answer

System memory (RAM), hard disk storage, running processes, CPU registers

Question 12

An organization's Security Operations Center (SOC) receives an alert regarding an unusual outbound connection to a known command-and-control (C2) IP address. According to the NIST SP 800-61 Rev. 2 incident response lifecycle, which phase immediately follows the Containment, Eradication, and Recovery phase?

Accepted Answer

Post-Incident Activity. The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The question asks which phase immediately follows Containment, Eradication, and Recovery. According to the standard, Post-Incident Activity is the final phase, where lessons learned are captured and improvements are made to prevent future incidents.

Answer

Preparation

Answer

Detection and Analysis

Answer

Threat Hunting

Question 13

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

Accepted Answer

alert tcp any any -> $HOME_NET 80 (msg:"Directory Traversal Attempt"; content:"../"; http_uri; sid:100001; rev:1;). It uses the proper Snort rule structure for detecting a payload pattern in HTTP traffic: an 'alert' action, TCP protocol, port 80 (HTTP), and the 'http_uri' buffer modifier to inspect only the URI component of the request. The 'content:"../"' matches the directory traversal string, and 'http_uri' ensures the match occurs specifically in the URI, which is where traversal attempts typically appear. This configuration accurately detects the attack without false positives from other parts of the HTTP request.

Answer

pass tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"Traversal"; content:"../"; http_client_body; sid:100001; rev:1;)

Answer

alert ip any any -> any any (msg:"Directory Traversal"; uricontent:"../"; sid:100001; rev:1;)

Answer

log udp any any -> $HOME_NET 80 (msg:"Directory Traversal"; content:"../"; depth:2; sid:100001; rev:1;)

Question 14

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

Accepted Answer

sha256sum evidence.raw. The sha256sum command computes a SHA-256 cryptographic hash of the specified file, producing a unique fixed-length digest that serves as a digital fingerprint. Any modification to the evidence file—even a single bit flip—will produce a completely different hash value, allowing an analyst to later re-hash the file and compare digests to prove integrity. SHA-256 is collision-resistant and widely accepted in forensic and legal contexts as a standard for evidence authentication. Unlike MD5 or SHA-1, it has no known practical collision attacks, making it suitable for cryptographic proof.

Answer

dd if=/dev/sdb of=/evidence.raw --hash=md5

Answer

ftk_imager --verify --md5 evidence.raw

Answer

volatility -f evidence.raw --hash

Question 15

A CND analyst is deploying a centralized Security Information and Event Management (SIEM) solution. To enable proactive threat hunting and rapid incident detection across distributed network segments, what is the primary function of deploying forwarders or agents on endpoints?

Accepted Answer

To locally compress, encrypt, and forward normalized log telemetry to the central SIEM collector. Forwarders or agents on endpoints are designed to collect, normalize, compress, and encrypt log telemetry locally, then forward it to the central SIEM collector. This enables the SIEM to ingest data from distributed segments without requiring direct network access to each endpoint, supporting proactive threat hunting and rapid detection. The agent handles buffering during network outages and ensures data integrity in transit.

Answer

To act as a stateful firewall blocking unauthorized inbound and outbound network packets on the host

Answer

To perform full disk encryption key escrow and manage endpoint certificate lifecycles

Answer

To automatically execute remediation scripts and isolate compromised endpoints without human intervention