You are investigating an alert in CrowdStrike Falcon. To determine if a file was moved laterally after its initial execution, which feature provides the most accurate visualization?
In a Palo Alto Networks environment, you need to identify if a specific internal host is beaconing to a command-and-control server. Which log type provides the necessary data?
When using Wireshark to investigate a data exfiltration incident, you want to filter for TCP streams involving a specific internal IP that are larger than 1MB. How is this achieved?
A security appliance flags a high volume of traffic from a single internal host to a series of random external IP addresses. This is a classic indicator of which activity?
A security analyst is configuring an alert in Splunk Enterprise Security to detect potential brute force attacks. The analyst must identify the specific notable event aggregate field that prevents the creation of duplicate alerts for the same source IP over a defined time window. Which field should be utilized?
During a digital forensics investigation of a Windows host, an analyst suspects an attacker used PowerShell 'Fileless' execution. Which artifact within the Windows Event Logs would provide the most definitive evidence of the specific command line arguments used during the execution?
An incident response team is performing containment on a compromised Linux server that is part of a containerized environment. Given that the container is running in a Kubernetes cluster, which action is the most appropriate initial containment step to preserve the volatile memory for forensics while preventing further data exfiltration?
A security analyst is reviewing a PCAP to investigate a suspected data exfiltration incident. The analyst observes a large number of DNS queries for randomly generated subdomains of a single domain, such as 'a1b2c3d4.example.com'. Which TWO of the following statements are true regarding this activity? (Choose two.)
A CCOA analyst is investigating an alert where an endpoint executed a signed binary that subsequently spawned a child process making outbound connections to an unknown IP. The binary's signature is valid and the file hash matches a known good application. Which technique is MOST likely being used by the attacker?
A CCOA analyst is reviewing a suspected compromised Windows server. The server's Security event log shows Event ID 4625 with Logon Type 3 and a source IP address of a known internal workstation, repeated every 30 seconds for the same service account. The account's password was changed 45 days ago and the service is still running. What is the MOST likely explanation for these repeated failures?
During an incident response investigation, a CCOA analyst discovers that an attacker used a compromised service account to create a new domain admin account and then deleted the Security event log on the domain controller. The analyst needs to determine the account name that was created. Which of the following is the BEST source to recover this information?
A CCOA analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unknown IP address over port 443. The analyst suspects the use of a covert channel. Which technique should the analyst prioritize to confirm whether the traffic is malicious?
You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?
You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?
You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?
You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?
During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?
When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?
You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?
You are investigating a suspected data exfiltration incident. You need to analyze network traffic captured in a PCAP file. Which tool is the industry standard for performing deep packet inspection and protocol analysis during this investigation?
During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?
While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?
A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?
You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?
You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?
You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?
A SIEM has triggered an alert for 'Excessive Failed Login Attempts' followed by a 'Successful Login'. Which technique is this most likely attempting to detect?
After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?
While investigating an incident in Google Workspace, you notice suspicious file sharing. Which log type should be queried to see which files were shared externally by a specific user?
You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?
You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?
You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?
You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?
You are investigating a potential credential harvesting site. Which tool is best suited to safely inspect the site without triggering a potential infection?
During a forensic analysis, you find a suspicious file that was renamed to look like a system file. What is the most reliable way to identify its true nature?
When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?
A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?
During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?
A CISO asks for a list of indicators that should be monitored in the SIEM to detect potential account takeover attempts. Which THREE indicators are most relevant?
When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?
A security analyst is reviewing a packet capture of an internal host that appears to be communicating with an external server. The analyst observes that the TCP three-way handshake completes successfully, but the session then becomes idle for approximately 30 seconds before a small application-layer message is sent. This pattern repeats consistently. Which type of malicious activity is most consistent with this behavior?
A CCOA analyst is reviewing a suspected credential-stuffing incident against the organization's customer portal. The web server logs show thousands of POST requests to /login with varying usernames but originating from a rotating set of source IPs. The analyst needs to determine whether the activity is a distributed brute-force attack or normal user behavior. Which data source would BEST provide the authoritative evidence of failed authentication attempts across all application instances?
A security operations center (SOC) analyst is triaging a potential endpoint compromise. The EDR console shows a suspicious process created by a Microsoft Word document that spawned a child process of 'powershell.exe' with the arguments '-nop -w hidden -enc JABjAGwAaQBlAG4AdA...'. The parent process has since exited. Which detection technique would best confirm whether this activity represents a true positive?
During an incident investigation, an analyst discovers that an attacker used a compromised service account to move laterally across multiple systems. The analyst needs to determine the extent of the compromise by identifying all systems where the account was used to authenticate. Which data source would be most effective for this purpose?
During a suspected data exfiltration incident, a CCOA analyst observes that a workstation is sending DNS queries for subdomains such as 'a1b2c3d4e5.exfil.example.com'. The queries are small and occur at irregular intervals. The analyst wants to confirm DNS tunneling rather than normal DNS resolution. Which characteristic of the DNS traffic would MOST reliably indicate tunneling?
A healthcare organization's incident response team is investigating a breach involving a compromised web server that may have exposed patient data. The team must determine the scope of the data exposure. Which of the following actions should be performed FIRST to preserve evidence while enabling analysis?
A security operations center (SOC) analyst is triaging an alert indicating a potential phishing email that was delivered to several users. The analyst needs to determine if any user interacted with the malicious link. Which two data sources would be most directly useful for this determination? (Choose two.)
A CCOA analyst is triaging an alert from the SIEM indicating that a user account was added to the Domain Admins group outside of a change window. The analyst needs to determine whether this is a malicious privilege escalation or an authorized administrative action. Which immediate step BEST supports this determination?
A security operations center (SOC) analyst receives an alert from the SIEM indicating that a domain controller has generated a high volume of Kerberos ticket-granting service (TGS) requests using RC4 encryption, with service principal names (SPNs) that do not exist. The analyst suspects a Kerberoasting attack. Which artifact should the analyst collect first to confirm the attack and identify the targeted service accounts?
A security analyst notices that a user's workstation is repeatedly connecting to an external IP address every 60 seconds, sending small amounts of data. The traffic pattern is consistent and occurs even when the user is not actively working. Which type of malware behavior is most likely indicated?
A CCOA analyst is responding to an incident involving a compromised web server that is part of a load-balanced cluster. The analyst needs to preserve volatile evidence before the server is rebooted for remediation. Which TWO actions should the analyst perform to capture volatile data? (Choose two.)
An analyst is reviewing a security incident and needs to determine the order of events. The analyst has collected logs from various sources with different timestamp formats and time zones. Which action should the analyst take first to ensure an accurate timeline?
A CCOA analyst receives an alert that the account 'svc_backup' performed an interactive logon (Type 2) to a domain controller at 02:17. The account is normally used only for scheduled backup jobs. The analyst needs to determine whether this is a credential misuse incident. Which Windows event should the analyst examine first to confirm the logon type and source workstation?
A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?
A security analyst is investigating a suspected data breach and needs to determine if sensitive data was exfiltrated. The analyst has access to full packet capture (PCAP) data from the network perimeter. Which technique would be most effective for identifying large outbound data transfers?
During incident response for a suspected data exfiltration, the team captures full packet data at the perimeter. The CCOA analyst needs to determine whether large outbound transfers occurred over an encrypted channel that cannot be inspected. Which network flow artifact should the analyst use to identify the volume and duration of the transfers while preserving the ability to correlate with other logs?
A financial institution's SOC is investigating a suspected data exfiltration incident. The team has collected network flow data, proxy logs, and endpoint logs. Which two of the following indicators are MOST indicative of data exfiltration over a covert channel? (Choose two.)
A CCOA analyst is triaging an alert about a workstation that repeatedly contacts a known malicious IP address. The analyst wants to quickly block further communication from that host while preserving volatile evidence for later analysis. Which action best meets both goals?
A security analyst is reviewing the Incident Response Plan (IRP) and notices that it lacks a defined communication protocol for notifying external stakeholders during a breach. Which phase of the incident response lifecycle does this gap primarily affect?
A security analyst is investigating a suspected insider threat. The analyst has collected volatile data from a suspect's workstation, including running processes, network connections, and logged-in users. Which of the following should the analyst do NEXT to maintain the integrity of the evidence for potential legal proceedings?
A CCOA analyst is investigating a suspected insider threat involving unauthorized access to a file server. The analyst needs to correlate user activity with file access events. Which two log sources should the analyst prioritize? (Choose two.)
A threat hunter is analyzing endpoint telemetry and notices a process that has established a network connection to an external IP address. The process is running from a temporary directory, has no digital signature, and its parent process is a known vulnerable service. Which of the following techniques is MOST consistent with this behavior?
A CCOA analyst is leading the lessons learned review after a major incident. The team wants to improve future detection and response. Which output of the lessons learned phase is most directly used to update detection capabilities?
A CCOA analyst is investigating a malware incident on a Windows 10 endpoint. The analyst needs to determine the persistence mechanism used by the malware to survive reboots. Which Windows artifact should the analyst examine first to identify programs configured to run automatically at user logon?
A CCOA analyst is triaging an alert from the SIEM indicating a potential malware outbreak on a Windows server. The analyst wants to quickly identify the parent process of a suspicious child process using Sysmon telemetry. Which Sysmon event field should the analyst focus on to establish the process lineage?
A CCOA analyst is examining a Linux server suspected of compromise. The analyst runs 'netstat -tulpn' and observes an unknown process listening on TCP port 4444. To identify the executable associated with this process, which command should the analyst use next?
A CCOA analyst is preparing to acquire volatile data from a compromised Windows system before shutting it down. Which two types of data should be collected first because they will be lost upon shutdown? (Choose two.)
A CCOA analyst receives an alert about a suspicious email attachment that was opened by a user. The analyst wants to determine if the attachment executed and established persistence. Which Windows artifact would provide the most direct evidence of the executable's file path and creation time?
A CCOA analyst receives an alert about a possible phishing email that bypassed the secure email gateway. The analyst needs to extract and analyze the email headers to determine the true sender. Which email header field should the analyst examine to find the originating IP address of the sender?
A CCOA analyst is reviewing a suspected data exfiltration incident. The analyst needs to identify the command and control (C2) channel used by malware. Which network artifact would best reveal the domain names and IP addresses contacted by the malware?
A CCOA analyst is responding to an incident involving a compromised Linux server. The analyst needs to collect volatile data for forensic analysis. Which two commands should the analyst use to capture running processes and network connections? (Choose two.)
A CCOA analyst is reviewing network traffic logs and notices a series of DNS queries for randomly generated domain names that are subdomains of a single domain. The queries are frequent and the responses are often NXDOMAIN. Which technique should the analyst suspect?