CCOA Incident Detection And Response — 15 Questions

Question 1

Which TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?

Accepted Answer

Isolate the infected network segment to prevent lateral movement. Containment focuses on stopping the spread of the attack without destroying evidence.

Answer

Re-image the compromised server immediately to restore service

Answer

Shut down the entire corporate firewall

Answer

Notify the local police department

Question 2

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

Accepted Answer

Time window. In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.

Answer

Throttle field

Answer

Notable event urgency

Answer

Risk score adjustment

Question 3

You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?

Accepted Answer

Use the 'Top values' aggregation on the source IP field in a Lens visualization. The 'Lens' or 'Visualize' feature in Kibana allows for aggregation by field, which is the most efficient way to summarize top traffic sources.

Answer

Run an 'Update By Query' API call

Answer

Use a regex filter in the search bar

Answer

Export all logs to CSV and use Excel

Question 4

You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?

Accepted Answer

Process Tree view. Process tree visualization is a core feature of EDR platforms like Falcon or Defender for Endpoint, allowing analysts to trace execution lineage.

Answer

Host status dashboard

Answer

Network connections tab

Answer

Event search logs

Question 5

You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?

Accepted Answer

Process creation logs (e.g., Sysmon Event ID 1). LotL attacks use legitimate system tools like PowerShell or WMI; therefore, process execution logs with command-line arguments are essential.

Answer

Firewall denied logs

Answer

Physical access logs

Answer

SMTP gateway logs

Question 6

During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?

Accepted Answer

Modify the analytic rule logic using a 'where' clause to exclude the account entity from a Watchlist. In Sentinel, using a Watchlist allows you to maintain a list of excluded entities and reference them in KQL queries to filter out known noisy sources.

Answer

Delete the analytic rule and recreate it with a higher threshold

Answer

Disable the alert in the Data Connector settings

Answer

Set the incident severity to 'Informational'

Question 7

When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?

Accepted Answer

Loaded DLLs and system handles. Fileless malware resides in memory and often leaves traces in process structures, injected code, and handles.

Answer

Browser history files

Answer

Unallocated space in the master file table

Question 8

When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?

Accepted Answer

Host isolation. Network Containment in CrowdStrike isolates the host from the network but maintains a secure connection to the Falcon cloud for administrative actions.

Answer

File Quarantine

Answer

Credential revocation

Answer

Sensor uninstallation

Question 9

You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?

Accepted Answer

Manual status update via Action menu. In Splunk Enterprise Security, the Notable Event workflow status is controlled by the 'Status' field mapping in the incident review dashboard, which relies on the analyst's manual intervention through the 'Action' menu to change the status value.

Answer

Retention policy override

Answer

Real-time notable event aggregation

Answer

Automated workflow action trigger

Question 10

You are investigating a suspected data exfiltration incident. You need to analyze network traffic captured in a PCAP file. Which tool is the industry standard for performing deep packet inspection and protocol analysis during this investigation?

Accepted Answer

Wireshark. Wireshark is the standard tool for granular packet dissection and flow analysis.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 11

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

Accepted Answer

Event ID 1. Sysmon Event ID 1 tracks process creation, including command-line arguments and parent process information, which is essential for building a process tree.

Answer

Event ID 3

Answer

Event ID 11

Answer

Event ID 22

Question 12

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

Accepted Answer

Incident creation is toggled off in the rule configuration. If 'Incident creation' is disabled in the Microsoft Sentinel analytics rule settings, the rule will generate logs but will not group them into an incident for investigation.

Answer

The KQL query lacks a 'summarize' operator

Answer

Log Analytics workspace ingestion limit reached

Answer

The analytics rule is set to 'Disabled' instead of 'Enabled'

Question 13

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

Accepted Answer

Post-incident activity. The Post-Incident Activity phase (or Lessons Learned) is dedicated to documenting what happened and how to improve future responses.

Answer

Detection and Analysis

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 14

You are investigating an alert in CrowdStrike Falcon. To determine if a file was moved laterally after its initial execution, which feature provides the most accurate visualization?

Accepted Answer

Process Tree view. The Process Tree visualization in CrowdStrike Falcon allows analysts to trace the execution history and lateral movement paths of malicious files across different endpoints.

Answer

Indicator of Compromise (IOC) search

Answer

Detection dashboard filter

Answer

Host search history

Question 15

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

Accepted Answer

windows.malfind. The 'windows.malfind' plugin in Volatility 3 is designed to locate injected code segments by scanning for memory regions with suspicious permissions (e.g., PAGE_EXECUTE_READWRITE).

Answer

windows.info

Answer

windows.netscan

Answer

windows.pstree