20+ practice questions focused on Incident Detection Response And Threat Prediction — one of the most tested topics on the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Incident Detection Response And Threat Prediction PracticeAn organization's Threat Intelligence platform ingests STIX/TAXII feeds to track Advanced Persistent Threat (APT) groups. An analyst needs to query indicators of compromise using the TAXII 2.1 protocol. Which HTTP method and endpoint structure is standard for retrieving collections in TAXII 2.1?
Explanation: TAXII 2.1 defines a RESTful API where collections are retrieved using an HTTP GET request to the /taxii2/collections/ endpoint. This endpoint returns the list of collections available on the TAXII server, and clients then use GET on /collections/{id}/objects/ to retrieve STIX objects. The GET method is correct because retrieving collections is a read operation with no side effects.
An organization experiences a data breach involving personal identifiable information (PII). Regulatory compliance mandates notifying authorities within 72 hours. Which phase of the incident response process includes fulfilling external reporting and stakeholder communication requirements?
Explanation: The Post-Incident Activity phase (also called Lessons Learned) is where the organization completes documentation, performs root-cause analysis, and fulfills any remaining external reporting and stakeholder communication obligations after the incident is resolved. Regulatory notification within 72 hours (e.g., GDPR) falls into this phase because it occurs after containment/eradication and involves formal reporting, making C correct.
A network defender is analyzing a suspicious packet capture (PCAP) in Wireshark. The attacker is executing a covert channel over ICMP. Which Wireshark display filter isolates ICMP packets whose payload data exceeds the standard 32-byte echo request size?
Explanation: The filter 'icmp && data.len > 32' combines a protocol check for ICMP with a length check on the ICMP payload data field, isolating echo requests or replies whose data exceeds the standard 32-byte payload. Standard ping uses 32 bytes of data by default, so anything larger is suspicious and may indicate a covert channel tunneling data inside ICMP. This filter directly targets the anomaly described.
A security engineer is performing threat hunting on Linux servers to detect hidden rootkits modifying system call tables. Which tool is specifically designed to check for Linux kernel module tampering and hidden processes by comparing user-space output with kernel-space data structures?
Explanation: Rkhunter (Rootkit Hunter) is purpose-built for Linux rootkit detection: it scans for hidden files, suspicious kernel modules, and compares user-space command output against raw kernel data structures to expose tampering such as modified syscall tables. It also checks file hashes against known-good baselines and flags LKM (loadable kernel module) anomalies. This makes it the correct tool for detecting kernel-level rootkits and hidden processes on Linux hosts.
An organization is updating its incident response policy based on NIST SP 800-61. Which TWO phases are part of the post-incident activity stage? (Choose TWO)
Explanation: In NIST SP 800-61, the post-incident activity stage is where the organization handles the aftermath of a resolved incident, and it explicitly includes Lessons Learned (E), the meeting/debrief that reviews what happened, what was effective, and what improvements are needed for future response. It also includes Evidence Retention and Reporting (C), which covers determining how long to retain logs, forensic images, and other incident artifacts and documenting the incident for legal, regulatory, and historical purposes. The other options belong to earlier stages: Containment (A) and System Eradication (D) are part of the containment, eradication, and recovery phase, while Vulnerability Assessment (B) is a separate security activity, not a NIST SP 800-61 post-incident phase.
+15 more Incident Detection Response And Threat Prediction questions available
Practice all Incident Detection Response And Threat Prediction questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Incident Detection Response And Threat Prediction. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Incident Detection Response And Threat Prediction questions on the CND frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Incident Detection Response And Threat Prediction is tested as part of the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) blueprint. Practicing with targeted Incident Detection Response And Threat Prediction questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CND practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Incident Detection Response And Threat Prediction is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Incident Detection Response And Threat Prediction practice session with instant scoring and detailed explanations.
Start Incident Detection Response And Threat Prediction Practice →