CCNA Security Operations Questions

Ransomware's destructive sequence — rapid mass file encryption followed by vssadmin.exe deleting shadow copies — is a behavioural pattern, not a signature. Detecting that combination of mass modification and shadow-copy deletion catches the attack regardless of malware family, satisfying the requirement to detect this specific behaviour.

Injecting a single quote is a safe, non-destructive way to test for SQL injection. If the application returns a database error, it indicates improper input sanitization and potential SQL injection. This method validates the finding without extracting data or modifying the database, making it suitable for a production environment. It is a standard manual validation technique.

A honeytoken is a decoy artefact, not a full system, that alerts on unauthorised access. A planted credential file triggers detection the moment an attacker opens or exfiltrates it, satisfying the requirement for a lure that reveals insider intrusion without exposing real assets.

DNS tunneling encodes data in DNS query names or responses. Capturing full packets allows the analyst to extract the query strings, decode them (e.g., Base64), and examine the payload. This confirms tunneling and reveals exfiltrated or command-and-control data. Other methods may indicate tunneling but do not provide the actual content for analysis.

A WHOIS lookup queries public registrar databases rather than the target's own infrastructure, so no packets reach the web application and production services remain untouched. This satisfies the rules of engagement constraint prohibiting disruption, making it suitable for initial passive information gathering before any active enumeration begins.

User Behaviour Analytics baselines each user's normal login patterns — location, time, device — and flags statistically anomalous deviations. The 3 AM foreign VPN login falls outside the established baseline, so UBA generates the alert rather than static correlation rules.

Tamper protection prevents unauthorized disabling of the EDR agent, and automated response actions such as host isolation can be triggered when tampering is detected. This directly addresses the requirement to alert and isolate. Other features like signature updates or forensic analysis do not provide real-time tamper detection and response.

STIX (Structured Threat Information Expression) is purpose-built to represent cyber threat intelligence as structured, machine-readable JSON, covering indicators, campaigns, threat actors and relationships. It satisfies the stem's requirement for a standardised, machine-readable sharing format, unlike document-centric or transport protocols such as TAXII, which merely conveys STIX.

psxview cross-references multiple process-listing sources — such as EPROCESS, PspCidTable and CSRSS handles — and highlights discrepancies where a process appears in some lists but not others. That mismatch exposes processes hidden by rootkits, satisfying the requirement to identify a malicious process absent from the standard listing.

Wireshark can open PCAP files, reassemble TCP streams, and export objects from HTTP, SMB, and other protocols. Its 'Export Objects' feature allows the analyst to extract files transferred over HTTP, which can then be analyzed. This directly meets the requirement of extracting files from the PCAP for further inspection.

PowerShell running a script to download tools is adversary-controlled code running on the victim host, which maps to the Execution tactic. Initial access was already achieved via spearphishing; the script's purpose is to execute further payloads, satisfying the stem's requirement to categorise this behaviour.

Scanning external networks for open ports is a technical reconnaissance activity that does not involve deceiving or manipulating people, so it satisfies the rules of engagement prohibiting social engineering. It maps the attack surface through direct network probing rather than human interaction, making it permissible alongside other non-social techniques.

Digital evidence is only admissible if its provenance is provable. An unbroken chain of custody documents every transfer, handler and storage condition from seizure to court, so any tampering or contamination can be ruled out. Hashing proves integrity, but the chain of custody is what satisfies the court's admissibility constraint.

RAM contents are volatile and lost on shutdown, so capturing memory with LiME or fmem first preserves evidence that would otherwise vanish. Order of volatility demands memory acquisition before disk imaging on a live system.

ISACs are sector-specific non-profit bodies through which member organisations share threat indicators, incidents and mitigation guidance. Consuming their feeds satisfies the stem's requirement for a commonly used threat intelligence sharing mechanism, alongside ISAO and CERT channels.

The MITRE ATT&CK Navigator and website host the full technique matrix with IDs, letting the analyst map the observed lateral movement technique to its corresponding identifier. It is the authoritative source for ATT&CK technique IDs, satisfying the stem's mapping requirement.

TTP-based intelligence describes adversary behaviours and tradecraft, which change far more slowly than email subjects, sender domains or attachment hashes. This satisfies the stem's constraint that rapidly shifting IOCs give only short-lived value, providing durable detection for the phishing campaign.

Network isolation with strict firewall rules is a compensating control: it blocks the exploit paths a CVSS 9.8 vulnerability would use, reducing exposure without patching. This satisfies the vendor constraint preventing immediate remediation while the server keeps operating.

Disassembly with IDA Pro reveals anti-debugging checks, encrypted string routines and dynamic API resolution logic in the code itself, without executing the sample. This exposes the obfuscation and evasion mechanisms the malware uses, which behavioural observation alone cannot fully map.

DNS tunneling often encodes data in subdomains, resulting in long, random-looking strings. Reviewing DNS logs for such patterns from a single host can quickly validate the alert. This is a direct and efficient first step because it uses existing log data without disrupting operations, and it can confirm whether the traffic is anomalous.

The Rules of Engagement document is the formal agreement that scopes a penetration test, listing authorised targets, permitted techniques, timing windows and prohibited actions. It satisfies the stem's requirement for a document defining scope, rules and restrictions, protecting both tester and client legally.

Honeypots only detect lateral movement if attackers believe they are genuine targets. Populating them with realistic services, banners, credentials and data sustains attacker engagement long enough to record techniques and tooling, directly satisfying the stem's requirement that the deployment attract and deceive intruders effectively.

Nmap scanning from the compromised host enumerates live neighbours, open ports and services across internal subnets, directly satisfying the requirement to find lateral-movement targets. External reconnaissance cannot reach internal-only systems, and passive sniffing reveals only traffic already traversing the segment.

This sequence is the classic remote process injection pattern: OpenProcess obtains a handle to the target process, VirtualAllocEx allocates memory in its address space, WriteProcessMemory writes the payload, and CreateRemoteThread starts execution. Monitoring these API calls in sequence is a reliable indicator of remote thread injection, commonly used by malware to execute code in another process.

Regular outbound connections to multiple external IPs on port 443 with small data transfers are characteristic of C2 beaconing. Malware often uses HTTPS to blend in with normal traffic. The periodic nature and multiple destinations suggest a compromised host attempting to communicate with its controller, possibly using domain generation algorithms (DGAs) or fast-flux.

NAC with posture assessment checks the health of devices, such as ensuring antivirus is up-to-date and patches are installed, before allowing network access. When integrated with VPN, it can enforce health policies for remote workers. This directly meets the requirement for strong authentication and device health validation.

A playbook is a predefined, automated workflow that executes a series of actions based on triggers and conditions. Here, the trigger is a reported phishing email, and the actions include URL extraction, threat intelligence lookup, and conditional quarantine. This directly matches the requirement to define a sequence of automated actions.

STIX provides a structured, machine-readable schema for describing indicators, threat actors and relationships, while TAXII defines the transport protocol for exchanging that content between servers and clients. Together they satisfy the stem's requirement for a standardised, automated format for sharing APT indicators, unlike document-centric or proprietary feed formats.

Deception fidelity depends on distinguishing authorized tooling from adversary behavior. By fingerprinting the deterministic traffic patterns and source addresses of sanctioned scanners and backup agents and suppressing only those events, the team removes expected noise without blinding the environment to novel or anomalous connections. All other honeypot interactions remain high-signal indicators worth forwarding to the SIEM for correlation and triage.

Identifying the phishing email as the initial access vector is analysis of collected evidence to determine how the intrusion occurred, which falls within detection and analysis. This phase scopes the incident and informs later containment and eradication decisions.

Static analysis examines the binary's strings, headers and structure without running it, directly satisfying the stem's constraint of determining capabilities without execution. Dynamic or behavioural analysis would require detonating the sample in a sandbox, which the analyst explicitly wants to avoid.

Extracting strings examines the binary's raw bytes without executing it, revealing embedded artefacts such as the C2 server address. That places it firmly in static analysis, which inspects code and metadata at rest, distinct from the dynamic sandbox observation already performed.

Network segmentation places the unpatched legacy application in an isolated segment with restricted inbound and outbound traffic, limiting lateral movement and reducing exploitability. This compensates for the vendor-imposed inability to patch while addressing the high likelihood of exploitation.

Preparation covers establishing logging, monitoring and detection capabilities before incidents occur. Insufficient logging on critical servers is a preparation gap, so strengthening log collection and alerting in this phase directly addresses the 72-hour detection failure identified in the review.

Event ID 4769 logs Kerberos service ticket requests, showing which services the account accessed. Since service accounts often use Kerberos, this can reveal lateral movement to servers. Correlating with logon events provides a comprehensive view of accessed systems.

DNS tunnelling encodes exfiltrated data into DNS records, inflating responses well beyond the 512-byte UDP limit and often forcing TCP fallback. Large response packets therefore satisfy the stem's requirement for network indicators supporting the DNS tunnelling hypothesis.

STIX defines a structured language for describing threat indicators, actors and campaigns, while TAXII specifies the transport protocol for exchanging that content between systems. Together they give vendors and sharing communities a common format and delivery mechanism for cyber threat intelligence.

System call auditing logs, such as those generated by auditd on Linux, record detailed information about system calls, including process execution, file access, and network activity. They provide a comprehensive and tamper-resistant record of the attacker's actions after initial access. This is the most direct evidence for forensic analysis.

Automated actions execute without analyst intervention, which satisfies the stem's requirement that quarantine and domain blocking occur automatically upon detection. Unlike manual or semi-automated playbooks, this removes human approval from the response path, enabling immediate containment. Microsoft Entra ID and email security controls are invoked programmatically by the SOAR platform.

Behavioural analysis continuously baselines normal endpoint activity and flags deviations, catching fileless malware and living-off-the-land techniques that signature matching misses. This satisfies the SOC's need for detection beyond known indicators, enabling EDR to surface novel threats in real time rather than waiting for updated signatures.

Blocking malicious IP addresses at the firewall satisfies the containment constraint by severing the network path attackers use for command-and-control and lateral movement. Perimeter filtering stops inbound exploitation attempts and outbound callbacks immediately, limiting blast radius while forensic investigation continues. This is a standard, reversible containment action that preserves evidence on affected hosts.

Decoding the base64 string reveals the actual PowerShell commands, allowing the analyst to understand the script's intent without execution. This is a safe, static analysis step that can quickly expose malicious actions like downloading payloads or establishing persistence. It is the logical first step before any dynamic analysis or containment.

NtQueryInformationProcess with ProcessDebugPort (0x07) returns a non-zero port when a debugger is present. Malware uses this to detect debugging. Bypassing can be done by patching the API to always return zero or using a plugin that hides the debug port. This is a known anti-debugging technique, and the described bypass is effective in many cases.

Pass-the-Hash reuses captured NTLM password hashes to authenticate to remote Windows systems without cracking the plaintext password, enabling lateral movement between hosts. This satisfies the scenario's Windows lateral-movement requirement by leveraging credential material already obtained during initial access.

Signature-based detection uses predefined patterns to identify known attack payloads for SQL injection and XSS. It is effective for common attacks and is a standard WAF feature. Enabling this helps block well-known malicious requests based on their structure and content.

Honeytokens are decoy credentials, files or records that have no legitimate use, so any access or use signals an attacker already inside the network. This matches the requirement to detect breached attackers, unlike honeypots, which are decoy systems rather than planted data artefacts.

ISAC membership gives sector-specific sharing between peers facing comparable threats, so members receive timely, relevant threat data — indicators and tactics — far faster than public feeds, directly satisfying the requirement to collect intelligence from multiple industry-relevant centres.

Blocking outbound traffic to known malicious IPs and domains via firewall or DNS sinkhole rules halts command-and-control communication and data exfiltration, directly satisfying the containment requirement while leaving internal business services untouched. This limits ransomware spread without disrupting legitimate user access, unlike broad network isolation.

The analyst forms a specific proposition about adversary behaviour, PowerShell execution, then hunts for evidence supporting or refuting it. This structured, hypothesis-first method is hypothesis-driven hunting, matching the stem's constraint of starting from a stated theory rather than an indicator or alert.

Tuning the rule to understand the application's expected input, such as allowing single quotes in search parameters but still detecting SQL injection patterns like ' OR '1'='1', reduces false positives while maintaining protection. This contextual approach is a best practice for WAF tuning, balancing security and usability.

Static code analysis examines the script's source code without executing it. The analyst can read the PowerShell commands, identify obfuscation, and understand the script's intent. Tools like PowerShell's AST parser or manual review can be used. This directly fulfills the requirement to analyze without execution, making it the correct choice.

Event ID 4104 is generated when PowerShell logs a script block, capturing the actual code being executed. This is crucial for detecting fileless malware because the malicious script may never touch disk. Monitoring this event allows the team to see the script content and identify malicious patterns, even if the script is obfuscated or executed in memory.

Segmentation with strict ACLs restricts reachability to the vulnerable legacy application, shrinking the attack surface while it stays available to authorised internal users. Since patching is impossible, this compensating control limits lateral movement and exploitation attempts, satisfying the availability constraint better than disabling the service.

The playbook executes quarantine, sender blocking and ticket creation without human intervention, which is machine-driven execution of a predefined workflow. That distinguishes automation from orchestration, which coordinates multiple tools, and from case management or threat intelligence enrichment.

Sysmon provides detailed process creation events including command-line arguments, parent process, and hashes, which are critical for detecting suspicious LOLBin execution and fileless techniques. Network connection events from Sysmon also help identify command-and-control traffic. This data source is essential for advanced threat detection because it captures rich context that native Windows event logs may lack.

JuicyPotato exploits the SeImpersonatePrivilege token by coercing a privileged service into authenticating, then impersonating its token via COM server abuse. Since the stem confirms the service account holds SeImpersonatePrivilege, this satisfies the exact prerequisite, enabling escalation to SYSTEM or root without needing kernel exploits.

Honeytokens are decoy credentials, files or records seeded across systems; any access triggers an alert, since legitimate users have no reason to touch them. This satisfies the stem's detection requirement, giving high-fidelity, low-false-positive signals of attacker reconnaissance or lateral movement without delaying normal business activity.

Anomaly-based correlation baselines normal behaviour and alerts on statistically significant deviations, rather than matching fixed signatures or thresholds. Accessing sensitive data at unusual hours deviates from the established behavioural baseline, which is precisely what this rule type detects.

Event ID 4769 logs a Kerberos service ticket request. The encryption type 0x17 corresponds to RC4-HMAC, which is weaker and faster to crack than AES. Attackers performing Kerberoasting often request RC4-encrypted tickets for service accounts with SPNs, then extract and crack them offline. Thus, seeing RC4 where AES is expected is a strong indicator of Kerberoasting.

This is correct because comsvcs.dll MiniDump is a known LOLBin technique to dump LSASS memory using rundll32.exe, a signed Microsoft binary. It avoids dropping custom tools and can bypass some application whitelisting. The command-line arguments are a strong indicator of credential dumping, aligning with MITRE ATT&CK T1003.001.

Tactics represent the adversary's tactical goal — the 'why' behind an action — with entries such as Initial Access, Execution and Credential Access. Techniques, by contrast, describe the 'how'. The stem asks which component categorises the 'why', so Tactics is the matching category.

Running the sample inside an isolated virtual machine with network monitoring captures real behavioural indicators — process creation, registry writes, file drops and command-and-control traffic — without risking the production host. This satisfies the stem's safe-environment constraint, since the VM can be snapshotted and reverted after execution.

A LOLBin such as schtasks.exe creates the scheduled task using a signed Microsoft binary, so the registry run key is never touched. This satisfies evading the EDR's registry-change monitoring while still achieving persistence through Task Scheduler.

Wireshark provides deep packet inspection with protocol dissectors, allowing the analyst to view application-layer payloads, reassemble TCP streams, and analyze session flow. It supports custom protocol analysis through user-defined dissectors and is the most appropriate tool for this scenario.

Impossible travel is the classic UBA signal: the same credentials authenticating from two distant locations faster than physical travel allows. This pattern indicates the account's credentials have been compromised and reused by an attacker, directly matching the impossible-login constraint described in the stem.

Hypothesis-driven hunting starts from an informed theory about attacker tactics, techniques or targets, then queries telemetry for evidence confirming or refuting it. This differs from indicator-led hunting, which searches for known IoCs rather than testing a reasoned proposition about adversary behaviour.

Input validation ensures that user-supplied data conforms to expected formats, while output encoding (e.g., HTML entity encoding) ensures that any data rendered in the browser is treated as data, not executable code. Together, they prevent XSS by stopping malicious scripts from being injected and executed. This is a fundamental and effective mitigation for XSS.

Modified Attack Vector (MAV) is a valid CVSS environmental metric that adjusts the base Attack Vector to reflect how the vulnerability is actually exploitable in the organisation's environment, directly satisfying the stem's requirement to tailor the 7.5 base score.

INetSim simulates common internet services, allowing malware to receive responses as if it were communicating with real servers. This can trick the malware into revealing its C2 behavior, such as HTTP requests or DNS queries. It is a safe way to observe network activity without allowing actual external connections, which is essential in a sandbox environment.

Phishing remains the primary initial access vector for ransomware, so training employees to recognise and report suspicious messages directly reduces the likelihood of successful compromise. This satisfies the preparation phase's requirement to build preventive human controls before an incident occurs, complementing technical safeguards such as email filtering and endpoint detection.

UEBA baselines each user's and entity's normal activity, then flags statistical deviations such as logons outside business hours and anomalous data volumes. Unlike static correlation rules, it detects subtle, gradual changes in behaviour, directly satisfying the requirement to identify off-hours access and unusual transfer patterns.

Authentication logs from Microsoft Entra ID or Active Directory record who logged on, when, from where and whether attempts failed. These identity events form the core behavioural baseline UBA needs to flag anomalous insider sign-in patterns, such as impossible travel or off-hours access, satisfying the stem's requirement for normal user behaviour data.

$MFT contains metadata for every file on an NTFS volume, including timestamps for creation, modification, and access. It is a primary source for file system timeline analysis. Other artifacts like prefetch or registry hives provide program execution or configuration data but are not as comprehensive for file system activity timelines.

Event ID 4624 records successful logons and includes the Logon Type and Source Network Address. A Type 3 (network) or Type 10 (RemoteInteractive) logon from an unusual source would confirm suspicious remote access, while a Type 2 (interactive) logon at the console would suggest a different scenario. This directly addresses the anomaly and is the fastest way to validate or dismiss the alert.

WPA3-Personal with Simultaneous Authentication of Equals (SAE) provides strong encryption and resistance to offline dictionary attacks. SAE replaces the pre-shared key handshake in WPA2, offering forward secrecy and protecting against brute-force attempts. This meets the requirements for authorized device access and encrypted traffic, making it the most secure choice for a small office wireless network.