CCOA Incident Detection And Response — 20 Questions

Question 1

You are investigating an alert in CrowdStrike Falcon. To determine if a file was moved laterally after its initial execution, which feature provides the most accurate visualization?

Accepted Answer

Process Tree view. The Process Tree visualization in CrowdStrike Falcon allows analysts to trace the execution history and lateral movement paths of malicious files across different endpoints.

Answer

Indicator of Compromise (IOC) search

Answer

Detection dashboard filter

Answer

Host search history

Question 2

In a Palo Alto Networks environment, you need to identify if a specific internal host is beaconing to a command-and-control server. Which log type provides the necessary data?

Accepted Answer

Traffic logs. Traffic logs in Palo Alto Networks provide the session-level details required to perform frequency analysis and detect beaconing patterns.

Answer

Data filtering logs

Answer

Threat logs

Answer

URL filtering logs

Question 3

When using Wireshark to investigate a data exfiltration incident, you want to filter for TCP streams involving a specific internal IP that are larger than 1MB. How is this achieved?

Accepted Answer

Use 'Statistics > Conversations > TCP' and sort by bytes. Wireshark provides flow-level statistics via 'Statistics > Conversations > TCP', which allows for filtering and viewing stream sizes.

Answer

Apply a filter: 'data.len > 1MB'

Answer

Apply a display filter: 'ip.addr == 10.0.0.5 && tcp.len > 1048576'

Answer

Use 'Analyze > Expert Info'

Question 4

In the context of the NIST Incident Response lifecycle, which phase involves the identification of the root cause?

Accepted Answer

Detection and Analysis. The Analysis phase involves determining the nature, scope, and magnitude of the incident, which leads to understanding the root cause.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 5

A security appliance flags a high volume of traffic from a single internal host to a series of random external IP addresses. This is a classic indicator of which activity?

Accepted Answer

Network scanning. A single internal host sending high-volume traffic to many random external IP addresses is a hallmark of network scanning, where an attacker or compromised machine probes for open ports and vulnerable services across the internet. The random destination pattern distinguishes it from normal browsing, which typically targets a small set of known domains. This behavior is often the reconnaissance phase of an attack.

Answer

Normal web browsing

Answer

VPN connection

Answer

Data exfiltration

Question 6

You are analyzing an incident where a user's machine was compromised via a malicious document. Which Windows log indicates that a macro was executed?

Accepted Answer

Office application logs. Office application logs, specifically the Microsoft Office Alerts and Microsoft Office Sessions logs under Applications and Services Logs, record events related to Office applications, including macro execution. When a macro runs, Office generates events such as 'Document Open' and 'Macro Execution' in these logs, providing direct evidence of the malicious activity. The Application log would not capture this level of detail, and the Security log focuses on authentication and access auditing, not application-specific macro events.

Answer

Application log

Answer

System log

Answer

Security log

Question 7

Which THREE phases of the incident response lifecycle involve the most interaction with stakeholders?

Accepted Answer

Preparation. Option B (Preparation) is correct because this phase requires establishing stakeholder relationships, defining communication channels, roles, and escalation paths with legal, HR, PR, and management before any incident occurs. Option D (Communications/Reporting) is correct because it is explicitly centered on informing and coordinating with internal and external stakeholders, including regulators, customers, and law enforcement, throughout the incident. Option E (Post-Incident Activity) is correct because lessons-learned reviews, reporting, and follow-up meetings require extensive interaction with stakeholders to improve future response and satisfy obligations. Options A (Detection and Analysis) and C (Containment and Eradication) are more technically focused on identifying, scoping, and removing the threat, with less direct stakeholder engagement than the phases above.

Answer

Detection and Analysis

Answer

Containment and Eradication

Question 8

Which TWO of the following Windows log types are most useful for detecting lateral movement?

Accepted Answer

System logs. Lateral movement is often detected by monitoring authentication logs (logons/logoffs) and process creation events (for remote execution tools like PsExec).

Answer

Power management logs

Answer

Windows Update logs

Answer

DNS client logs

Question 9

A security analyst is configuring an alert in Splunk Enterprise Security to detect potential brute force attacks. The analyst must identify the specific notable event aggregate field that prevents the creation of duplicate alerts for the same source IP over a defined time window. Which field should be utilized?

Accepted Answer

groupby. In Splunk Enterprise Security, the 'groupby' field in a notable event aggregation is used to specify fields that group events together, preventing duplicate alerts for the same source IP within a defined time window. By setting groupby to the source IP, the correlation search will aggregate events and create a single notable event per source IP, reducing alert fatigue.

Answer

notable_event_id

Answer

drilldown_search

Answer

suppression_period

Question 10

During a digital forensics investigation of a Windows host, an analyst suspects an attacker used PowerShell 'Fileless' execution. Which artifact within the Windows Event Logs would provide the most definitive evidence of the specific command line arguments used during the execution?

Accepted Answer

Event ID 4104. Event ID 4104 records Script Block Logging, which captures the full content of executed PowerShell blocks, including obfuscated code.

Answer

Event ID 4688 with Command Line Auditing enabled

Answer

Event ID 1102

Answer

Event ID 4624

Question 11

An incident response team is performing containment on a compromised Linux server that is part of a containerized environment. Given that the container is running in a Kubernetes cluster, which action is the most appropriate initial containment step to preserve the volatile memory for forensics while preventing further data exfiltration?

Accepted Answer

Pause the container process using container runtime tools. Pausing the container allows for the preservation of current memory states, whereas deletion or isolation via network policies might trigger cleanup scripts or lose memory artifacts.

Answer

Remove the container image from the registry

Answer

Update the Kubernetes NetworkPolicy to deny all ingress and egress

Answer

Delete the pod immediately to stop the communication

Question 12

During the post-incident recovery phase, which TWO actions are essential to ensure the environment is returned to a secure state?

Accepted Answer

Implementing enhanced monitoring on the affected systems. Option D is correct because implementing enhanced monitoring on the affected systems during post-incident recovery helps detect any residual attacker activity, backdoors, or re-compromise attempts, ensuring the environment remains secure after remediation. Option E is correct because validating restored files against pre-incident hashes (e.g., SHA-256 baselines) confirms that recovered data has not been tampered with or corrupted, verifying the integrity of the restoration process. Option A is incorrect because deleting incident logs destroys forensic evidence and violates chain-of-custody and retention requirements, hindering root-cause analysis and compliance. Option B is incorrect because decommissioning the entire production network is a disproportionate, disruptive action that is not a standard recovery step and would cause unnecessary business impact. Option C is incorrect because, while changing the domain administrator password may be a useful containment or remediation step, it is not by itself an essential action to return the environment to a verified secure state during recovery.

Answer

Deleting all incident logs to preserve storage space

Answer

Decommissioning the entire production network

Answer

Changing the domain administrator password

Question 13

A security analyst is reviewing a PCAP to investigate a suspected data exfiltration incident. The analyst observes a large number of DNS queries for randomly generated subdomains of a single domain, such as 'a1b2c3d4.example.com'. Which TWO of the following statements are true regarding this activity? (Choose two.)

Accepted Answer

The activity is consistent with a domain generation algorithm (DGA) used by malware.. The high volume of DNS queries for randomly generated subdomains under a single domain is a strong indicator of DNS tunneling, often used for command-and-control or data exfiltration. While DGAs can also generate random domains, the use of a single parent domain with random subdomains suggests tunneling rather than DGA. Both behaviors are malicious and require further investigation.

Answer

The DNS queries are likely the result of a misconfigured application performing reverse DNS lookups.

Answer

This behavior is indicative of a DNS amplification attack targeting the internal network.

Answer

The queries are benign because they are directed to a single domain and not to multiple external domains.

Question 14

A CCOA analyst is investigating an alert where an endpoint executed a signed binary that subsequently spawned a child process making outbound connections to an unknown IP. The binary's signature is valid and the file hash matches a known good application. Which technique is MOST likely being used by the attacker?

Accepted Answer

Living-off-the-land binary abuse. When a signed binary with a known good hash spawns a suspicious child process, the attacker is abusing a legitimate system tool rather than modifying it. This living-off-the-land technique evades signature and hash detection because the binary itself is trustworthy. Detection must focus on anomalous parent-child relationships and network behavior from child processes.

Answer

Process injection into the signed binary

Answer

DLL search order hijacking

Answer

Code signing certificate compromise

Question 15

A CCOA analyst is reviewing a suspected compromised Windows server. The server's Security event log shows Event ID 4625 with Logon Type 3 and a source IP address of a known internal workstation, repeated every 30 seconds for the same service account. The account's password was changed 45 days ago and the service is still running. What is the MOST likely explanation for these repeated failures?

Accepted Answer

A scheduled task on the workstation is using stale cached credentials for the service account.. Repeated Security event ID 4625 failures with Logon Type 3 from a single internal IP at fixed intervals are a classic signature of an automated process using outdated credentials. The correct option identifies the stale cached credential as the cause, which explains both the network logon type and the consistent timing. Other choices involve attacks or policy issues that would produce different artifacts.

Answer

A pass-the-hash attack is being attempted against the service account from the workstation.

Answer

The service account password was changed on the workstation but not replicated to the domain controller.

Answer

The server's account lockout policy is misconfigured and is generating false 4625 events.

Question 16

During an incident response investigation, a CCOA analyst discovers that an attacker used a compromised service account to create a new domain admin account and then deleted the Security event log on the domain controller. The analyst needs to determine the account name that was created. Which of the following is the BEST source to recover this information?

Accepted Answer

The domain controller's Security event log backup stored on a separate log server.. Security event log forwarding to a central server or SIEM ensures that critical events like account creation are preserved even if the local log is deleted. The correct option leverages that external copy to recover the account name. Other sources either lack the event detail (ntds.dit, System log) or track unrelated file system changes (USN journal).

Answer

The NTFS USN journal on the domain controller's system volume, which tracks file and directory changes.

Answer

The Windows System event log on the domain controller, which records account management changes.

Answer

The Active Directory database file (ntds.dit) from a recent system state backup.

Question 17

A CCOA analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unknown IP address over port 443. The analyst suspects the use of a covert channel. Which technique should the analyst prioritize to confirm whether the traffic is malicious?

Accepted Answer

Inspect TLS certificate details and JA3 fingerprints. TLS certificate details and JA3 fingerprints are powerful indicators for detecting malicious encrypted traffic. They can reveal self-signed certificates, expired certificates, or known malware fingerprints. This method is effective without decrypting the traffic, making it suitable for confirming a covert channel over port 443.

Answer

Perform full packet capture and analyze payload entropy

Answer

Run a vulnerability scan against the destination IP

Answer

Check firewall logs for allowed outbound connections

Question 18

Which TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?

Accepted Answer

Isolate the infected network segment to prevent lateral movement. Option B is correct because isolating the infected network segment during Containment limits an attacker's ability to move laterally to other hosts, a core containment objective that preserves evidence while stopping the spread. Option E is correct because disabling compromised user accounts revokes the attacker's authenticated access and prevents further abuse of those credentials, which is a standard containment action. Option A is not a containment best practice since immediately re-imaging the server destroys volatile evidence and is properly a recovery/eradication step. Option C is wrong because shutting down the entire corporate firewall would disrupt all network traffic and remove a key defensive control rather than contain the incident. Option D is incorrect because notifying law enforcement is a coordination/communication activity, not a technical containment action, and is only done when warranted.

Answer

Re-image the compromised server immediately to restore service

Answer

Shut down the entire corporate firewall

Answer

Notify the local police department

Question 19

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

Accepted Answer

Time window. In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.

Answer

Throttle field

Answer

Notable event urgency

Answer

Risk score adjustment

Question 20

You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?

Accepted Answer

Use the 'Top values' aggregation on the source IP field in a Lens visualization. Using the 'Top values' aggregation on the source IP field in a Lens visualization is the most efficient way to get the top 10 unique source IPs for a specific destination over the last hour in Kibana. Lens allows you to create a chart that aggregates and ranks values, and you can filter by destination and time range.

Answer

Run an 'Update By Query' API call

Answer

Use a regex filter in the search bar

Answer

Export all logs to CSV and use Excel