CCOA Incident Detection And Response — Timed 10 Questions

Question 1

You are investigating an alert in CrowdStrike Falcon. To determine if a file was moved laterally after its initial execution, which feature provides the most accurate visualization?

Accepted Answer

Process Tree view. The Process Tree visualization in CrowdStrike Falcon allows analysts to trace the execution history and lateral movement paths of malicious files across different endpoints.

Answer

Indicator of Compromise (IOC) search

Answer

Detection dashboard filter

Answer

Host search history

Question 2

In a Palo Alto Networks environment, you need to identify if a specific internal host is beaconing to a command-and-control server. Which log type provides the necessary data?

Accepted Answer

Traffic logs. Traffic logs in Palo Alto Networks provide the session-level details required to perform frequency analysis and detect beaconing patterns.

Answer

Data filtering logs

Answer

Threat logs

Answer

URL filtering logs

Question 3

When using Wireshark to investigate a data exfiltration incident, you want to filter for TCP streams involving a specific internal IP that are larger than 1MB. How is this achieved?

Accepted Answer

Use 'Statistics > Conversations > TCP' and sort by bytes. Wireshark provides flow-level statistics via 'Statistics > Conversations > TCP', which allows for filtering and viewing stream sizes.

Answer

Apply a filter: 'data.len > 1MB'

Answer

Apply a display filter: 'ip.addr == 10.0.0.5 && tcp.len > 1048576'

Answer

Use 'Analyze > Expert Info'

Question 4

In the context of the NIST Incident Response lifecycle, which phase involves the identification of the root cause?

Accepted Answer

Detection and Analysis. The Analysis phase involves determining the nature, scope, and magnitude of the incident, which leads to understanding the root cause.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 5

A security appliance flags a high volume of traffic from a single internal host to a series of random external IP addresses. This is a classic indicator of which activity?

Accepted Answer

Network scanning. A single internal host sending high-volume traffic to many random external IP addresses is a hallmark of network scanning, where an attacker or compromised machine probes for open ports and vulnerable services across the internet. The random destination pattern distinguishes it from normal browsing, which typically targets a small set of known domains. This behavior is often the reconnaissance phase of an attack.

Answer

Normal web browsing

Answer

VPN connection

Answer

Data exfiltration

Question 6

You are analyzing an incident where a user's machine was compromised via a malicious document. Which Windows log indicates that a macro was executed?

Accepted Answer

Office application logs. Office application logs, specifically the Microsoft Office Alerts and Microsoft Office Sessions logs under Applications and Services Logs, record events related to Office applications, including macro execution. When a macro runs, Office generates events such as 'Document Open' and 'Macro Execution' in these logs, providing direct evidence of the malicious activity. The Application log would not capture this level of detail, and the Security log focuses on authentication and access auditing, not application-specific macro events.

Answer

Application log

Answer

System log

Answer

Security log

Question 7

Which THREE phases of the incident response lifecycle involve the most interaction with stakeholders?

Accepted Answer

Preparation. Option B (Preparation) is correct because this phase requires establishing stakeholder relationships, defining communication channels, roles, and escalation paths with legal, HR, PR, and management before any incident occurs. Option D (Communications/Reporting) is correct because it is explicitly centered on informing and coordinating with internal and external stakeholders, including regulators, customers, and law enforcement, throughout the incident. Option E (Post-Incident Activity) is correct because lessons-learned reviews, reporting, and follow-up meetings require extensive interaction with stakeholders to improve future response and satisfy obligations. Options A (Detection and Analysis) and C (Containment and Eradication) are more technically focused on identifying, scoping, and removing the threat, with less direct stakeholder engagement than the phases above.

Answer

Detection and Analysis

Answer

Containment and Eradication

Question 8

Which TWO of the following Windows log types are most useful for detecting lateral movement?

Accepted Answer

System logs. Lateral movement is often detected by monitoring authentication logs (logons/logoffs) and process creation events (for remote execution tools like PsExec).

Answer

Power management logs

Answer

Windows Update logs

Answer

DNS client logs

Question 9

A security analyst is configuring an alert in Splunk Enterprise Security to detect potential brute force attacks. The analyst must identify the specific notable event aggregate field that prevents the creation of duplicate alerts for the same source IP over a defined time window. Which field should be utilized?

Accepted Answer

groupby. In Splunk Enterprise Security, the 'groupby' field in a notable event aggregation is used to specify fields that group events together, preventing duplicate alerts for the same source IP within a defined time window. By setting groupby to the source IP, the correlation search will aggregate events and create a single notable event per source IP, reducing alert fatigue.

Answer

notable_event_id

Answer

drilldown_search

Answer

suppression_period

Question 10

During a digital forensics investigation of a Windows host, an analyst suspects an attacker used PowerShell 'Fileless' execution. Which artifact within the Windows Event Logs would provide the most definitive evidence of the specific command line arguments used during the execution?

Accepted Answer

Event ID 4104. Event ID 4104 records Script Block Logging, which captures the full content of executed PowerShell blocks, including obfuscated code.

Answer

Event ID 4688 with Command Line Auditing enabled

Answer

Event ID 1102

Answer

Event ID 4624