CCNA Security Operations Questions

The environmental metric group modifies the base score using factors unique to the organisation's deployment, such as modified attack vector, confidentiality, integrity and availability requirements. It therefore reflects impact within a specific environment, exactly the constraint the question specifies.

Logs from different sources may use different time zones, formats, or clock settings. Normalizing timestamps to a common standard (e.g., UTC) is essential to accurately correlate events and establish a timeline. Without this step, the analyst might misinterpret the sequence of events. This is a fundamental step in incident response and forensic analysis to ensure data integrity and consistency across disparate sources.

Baselining normal authentication behaviour lets the rule flag deviations such as a single account authenticating to many hosts rapidly, which typifies pass-the-hash lateral movement. This behavioural axis, rather than static signature matching, suppresses benign administrative logons and reduces false positives while retaining true-positive detection.

psxview cross-references multiple process-listing sources, including EPROCESS linked lists, CSRSS handles and session structures, exposing processes hidden from any single view. Rootkits unlink entries from the standard list, so this plugin's comparison directly satisfies the requirement to detect hidden processes.

malfind scans process memory for injected code by locating regions with executable permissions lacking a mapped file on disk, the hallmark of process hollowing. Given the suspicious svchost.exe parented by explorer.exe, it directly tests the injected-code hypothesis pslist cannot confirm.

WDAC is a kernel-enforced code integrity feature that can enforce policies requiring all executables to be signed by trusted publishers with a valid certificate chain. It operates at the kernel level and cannot be bypassed by local administrators, making it suitable for this strict requirement. It also supports audit mode and multiple policy formats.

Privilege escalation is one of the fourteen enterprise tactics in MITRE ATT&CK, describing the adversary's goal of gaining higher-level permissions. It sits alongside discovery and lateral movement as a tactical category, under which specific techniques such as exploitation for privilege escalation are catalogued.

Extracting URLs and attachments, querying threat intelligence, then blocking indicators and isolating the endpoint chains deterministic enrichment and containment actions that require no human judgement, satisfying the stem's automation requirement. These steps execute faster than manual triage while preserving analyst review for ambiguous verdicts.

Motivations and objectives reveal why the actor targets the energy sector, guiding attribution and prioritisation of defences against likely campaigns. Including intent distinguishes state-sponsored espionage from financially driven crimeware, shaping the strategic response beyond raw indicators.

Recovery restores systems to normal operation after eradication, then monitors for recurrence. The stem's constraint — root cause identified and threat removed — places the incident exactly at the transition from eradication into recovery, where validated restoration and post-restoration monitoring occur.

The strings command extracts readable ASCII and Unicode sequences from a binary without executing it, revealing URLs, file paths and messages. This satisfies the stem's static analysis constraint, unlike dynamic tools that run the executable in a sandbox.

DNS exfiltration often encodes data in subdomains, resulting in long, random-looking strings. Analyzing DNS query logs for such patterns, especially repeated queries to a single domain, can reveal tunneling. This directly addresses the scenario and uses the appropriate data source.

The malfind plugin scans process memory for VAD regions marked both executable and writable, flagging likely injected code such as reflective DLL injection or shellcode. Other plugins enumerate handles, connections or loaded modules, but none specifically target executable-writable memory mappings.

STIX provides a structured language for describing indicators, actors and campaigns, while TAXII defines the transport protocol for exchanging that content. Together they let platforms ingest and act on intelligence automatically, removing manual reformatting between vendors.

Behavioural analysis and detection distinguishes EDR from signature-based antivirus, which matches only known file hashes. EDR continuously monitors process behaviour, registry changes and API calls, then correlates these events to identify anomalous activity such as living-off-the-land techniques that traditional antivirus, lacking behavioural telemetry, would miss entirely.

A honeypot is a decoy system deliberately exposed to attract attackers, letting defenders observe their tactics, techniques and procedures within a controlled, monitored environment. It satisfies the requirement to lure adversaries and record their behaviour without risking production assets.

A CVSS base score of 9.8 on an internet-facing server warrants immediate remediation; a WAF is a compensating detective or blocking control, not a substitute for patching, since bypasses and rule gaps exist. Delaying based on the WAF leaves the underlying exploitable flaw unaddressed.

Downloading the file and performing static analysis with a text editor and deobfuscation tools allows the analyst to understand the script's logic, identify obfuscation techniques, and extract indicators without executing it. This avoids any risk of infection and is a standard safe practice for analyzing potentially malicious scripts.

Banner grabbing and header inspection gather information about the target's technology stack without exploiting it, which is active reconnaissance within the reconnaissance phase. It precedes scanning, exploitation and post-exploitation, satisfying the lifecycle stage where target intelligence is collected.

Static analysis examines the file's structure, strings and headers without executing it, safely revealing the double extension and embedded indicators. This satisfies the stem's need to determine maliciousness first, before risking execution in a sandbox.

Recommending the patch gives the remediation team the specific fix that closes the exploited web application vulnerability, addressing the initial access vector. This satisfies the stem's requirement for actionable remediation steps in the technical report.

CVSS base scores measure intrinsic severity only, not real-world threat. Exploit availability and active exploitation are captured by temporal and threat metrics, which raise actual risk. Since B is being exploited in the wild, it poses immediate likelihood of compromise, so best practise prioritises it over higher-scoring but unexploited flaws.

The -sS flag initiates a TCP SYN scan (half-open scan), which is stealthy because it does not complete the TCP handshake. The -Pn flag disables host discovery (ping), treating all hosts as online. The -p 80,443 specifies ports 80 and 443. The target is the subnet 192.168.1.0/24. This command is used to quickly identify web servers on the network without performing a full port scan or host discovery, which can be noisy and slow.

Even with encryption, the size and timing of packets can reveal patterns. C2 channels often exhibit regular beaconing intervals, consistent packet sizes, or specific request-response patterns. Analyzing these metadata can indicate automated malicious communication. This technique is effective because it does not require payload decryption and can be automated in network monitoring tools.

XDR natively ingests and correlates telemetry from endpoints, network, cloud and identity into one console, satisfying the stem's cross-layer visibility requirement. EDR's scope stops at the endpoint agent, so it cannot surface network or cloud signals. This broader correlation is the defining architectural difference between the two.

The traffic is outbound on port 443 (HTTPS), occurs at a fixed time daily, and lasts a consistent duration. This pattern suggests an automated, scheduled exfiltration using a covert channel that blends with normal HTTPS traffic. The use of port 443 helps evade detection that focuses on non-standard ports, and the regularity indicates a scripted task rather than interactive user activity.

A honeypot is a decoy system with no legitimate production role, so any interaction with it is inherently suspicious. This lets the SOC detect unauthorised activity early, before attackers reach real assets, satisfying the requirement for early warning rather than prevention or attribution.

Detection covers monitoring and identifying security events, so receiving and triaging the SIEM alert places the analyst squarely in this phase. The failed logons followed by a successful domain admin logon constitute the indicator being detected, before any containment, eradication or recovery activity begins.

RAM is volatile and lost on power-off, so it must be captured before the hard drive, which retains data persistently. This ordering follows the RFC 3227 volatility principle, satisfying the stem's requirement to acquire the most perishable evidence first.

Reviewing the alert details and comparing with the employee's baseline behavior helps determine if the activity is anomalous. This initial triage provides context to decide if further investigation or escalation is needed. It is non-disruptive and gathers evidence before taking action, which is the correct first step in incident response.

A web proxy enforces URL filtering at the egress path, so adding the malicious URL to its blocklist stops any user from resolving or reaching that link. This satisfies the requirement to prevent other users accessing it, containing the campaign before further credentials or payloads are delivered.

WriteProcessMemory is the Windows API function used to write data to the memory of another process. Monitoring this API will directly detect attempts to inject code or modify memory in a remote process, which is a common step in fileless attacks. This aligns precisely with the requirement to detect memory writing to another process.

EDR solutions rely on continuous monitoring of endpoint activities such as process creation, file modifications, and network connections to detect malicious behavior in real-time. This telemetry is essential for identifying indicators of compromise and triggering automated responses. Without continuous monitoring, the EDR would lack the data needed to detect and block threats as they occur.

Static analysis examines a binary's code, imports, strings and structure without running it, directly satisfying the stem's constraint of determining capabilities without execution. Unlike dynamic analysis, which observes runtime behaviour in a sandbox, static analysis reveals potential functionality through inspection alone, making it the appropriate technique here.

Temporal metrics capture characteristics that change over time, such as exploit code maturity, remediation level and report confidence, modifying the Base score without altering the intrinsic vulnerability. CVSS v3 defines exactly three metric groups: Base, Temporal and Environmental.

Mimikatz extracts plaintext passwords, NTLM hashes and Kerberos tickets from LSASS memory on the compromised host. Reused local or domain credentials harvested this way frequently authenticate to the database server, satisfying the objective of finding valid reusable credentials.

URL sandboxing services, such as VirusTotal or URLScan.io, allow analysts to submit a URL and have it rendered in a controlled, isolated environment. This reveals the final destination, any drive-by downloads, and network connections without risking the corporate workstation. It is a safe and efficient method for initial triage of suspicious URLs.

Sysmon Event ID 10 logs process access, including when a process opens a handle to another process. If an unsigned process accesses lsass.exe, it is highly suspicious because legitimate processes accessing lsass are typically signed by Microsoft. This event is a strong indicator of credential dumping attempts, as tools like Mimikatz often run as unsigned binaries or injected code.

HTTP 200 responses to traversal attempts indicate the server processed the requests successfully, which may mean files outside the web root were accessed. This directly confirms potential success, unlike error codes. Correlating with file access logs can further validate, but the access logs are the primary source for web-based attacks.

Volatility performs memory forensics, parsing a captured RAM image to enumerate running processes, their network sockets and injected artefacts. That directly satisfies the requirement to analyse memory for network connections and potential exfiltration, which disk-based or live-response tools cannot reconstruct from volatile state.

Using a debugger to step through the script line by line allows the analyst to observe variable values, function calls, and execution flow in real time. This is a powerful dynamic analysis method for understanding obfuscated scripts. It can reveal decryption routines and network calls as they happen, without needing to fully deobfuscate statically.

EDR telemetry captures detailed endpoint activity, including process execution, file operations, network connections, and user context. This rich data enables correlation of user actions across systems, making it the most critical source for building a comprehensive timeline of insider activity.

Flooding the server with thousands of requests is a volumetric denial-of-service technique, consuming resources until legitimate users are denied service. The rules of engagement explicitly prohibit DoS, so this action falls squarely within the restriction, unlike enumeration or injection testing which do not deny availability.

RAM is the most volatile evidence, lost on power-down or reboot, so it must be captured before disk, logs or network state. Collecting memory first preserves running processes, injected code and encryption keys that would otherwise be irretrievable, satisfying the order-of-volatility constraint.

Hypothesis-driven hunting tests the specific process injection technique by examining memory and process activity for injected code, hollowed processes or anomalous API calls. This targeted approach suits an APT that evades signature-based defences, since it searches for behavioural evidence rather than known indicators.

Blocking the sender's domain at the gateway and deleting the email from all inboxes are automated response actions executed against infrastructure. An action step performs these containment tasks, satisfying the playbook requirement that step 3 remediate confirmed-malicious email rather than merely enrich or decide.

CreateRemoteThread and WriteProcessMemory are the canonical Windows API pair for injecting code into another process's address space. Their presence in the import table indicates the binary writes a payload into a remote process and starts it via a new thread, which is process injection.

LSASS (Local Security Authority Subsystem Service) stores credential material in memory, including password hashes and Kerberos tickets. Attackers often target lsass.exe to dump these credentials using tools like Mimikatz, ProcDump, or Task Manager. The scenario describes an unsigned binary accessing lsass.exe, which is a common indicator of credential dumping. This technique allows the attacker to obtain credentials for lateral movement and privilege escalation.

Querying the SIEM for the C2 domain leverages centralized log aggregation to identify all hosts that communicated with the malicious domain, providing immediate scope. This is a core incident response step: containment and eradication depend on understanding the blast radius. The SIEM retains historical network and endpoint logs, enabling rapid correlation across the environment without disrupting systems.

DNS tunneling often encodes data in subdomains, resulting in long, high-entropy labels. Analyzing DNS query patterns for these anomalies can reveal covert channels that bypass traditional perimeter controls. This technique is effective because DNS is frequently allowed outbound, and attackers abuse it to exfiltrate data or maintain C2. Monitoring for statistical anomalies in DNS queries is a key detection method.

FIDO2 security keys use public-key cryptography and are bound to the origin, making them highly resistant to phishing. The authentication is scoped to the legitimate website, so even if a user is tricked into visiting a phishing site, the key will not release credentials. This is the strongest phishing-resistant MFA method among the options.

STIX provides a structured, machine-readable schema for expressing indicators, malware and relationships, enabling automated exchange between platforms via TAXII. It satisfies the requirement to structure threat intelligence for automated sharing, unlike prose formats or vulnerability scoring systems.

Correlating multiple artifacts provides the most reliable timeline. The Windows Event Log gives system and security events, file system metadata shows file operations, and memory dump reveals running processes and network state. Together, they compensate for individual limitations and provide a more complete picture. This approach is standard in digital forensics to establish an accurate sequence of events.

Impossible travel detects the same credentials authenticating from geographically distant locations within a timeframe too short for physical transit. The 10-minute, two-country constraint makes concurrent credential theft and reuse the mechanism, since one user cannot be in both places.

The Environmental score adjusts the base metrics to reflect the assessed organisation's actual context, including mitigations and asset exposure. Since the server is internal-only and requires valid credentials, that reduced exploitability is captured here, not in the Temporal score, which covers exploit maturity and remediation level.

Blocking the sender's address at the gateway contains the campaign, preventing further delivery from that source to any recipient. This satisfies the playbook's containment requirement once triage confirms the email is malicious, limiting spread without manual intervention.

A documented access log records every individual who handles the evidence and when, forming the unbroken accountability trail that chain of custody demands for legal admissibility. Without this audit record, opposing counsel can challenge evidence integrity, so it directly satisfies the stem's legal-preservation constraint.

SSH local port forwarding binds a listener on the tester's host that relays traffic through the compromised dual-homed web server to the database server's internal port, exploiting the web server's DMZ and internal interfaces to cross the network boundary.

DNS tunneling often encodes data in subdomains of DNS queries, resulting in unusually long or high-entropy domain names. By analyzing query lengths and entropy, the analyst can identify anomalous DNS traffic that may indicate exfiltration. This technique is effective because DNS is commonly allowed through firewalls and can be used as a covert channel.

With TLS inspection enabled, the NGFW can decrypt and inspect the traffic. Examining the payload for sensitive data patterns (e.g., PII, credit card numbers) directly determines if exfiltration occurred. This is the most effective method because it analyzes content, not just metadata, and can confirm malicious intent.

UEBA baselines each user's normal login patterns, so a 3:00 AM session from an unusual remote location deviates sharply on time and geolocation axes. That behavioural anomaly indicates possible credential compromise, unlike routine activity matching established patterns.

LotL attacks abuse legitimate native tools, so signature and IOC matching fail. UEBA establishes behavioural baselines and flags deviations such as unusual tool invocation, odd hours or atypical data access, detecting misuse of trusted binaries without relying on known malware indicators.

WPA3-Personal with Simultaneous Authentication of Equals (SAE) replaces the pre-shared key handshake with a secure password-authenticated key exchange, which resists offline dictionary attacks. It is the latest Wi-Fi security standard and provides forward secrecy. This meets the requirement for robust encryption and protection against offline attacks.

Fileless malware and malicious PowerShell leave no executable on disk, so behavioural monitoring of script execution detects suspicious command patterns, encoded payloads and anomalous process behaviour in memory. This satisfies the stem's requirement to catch threats that evade signature-based file scanning.

Recording the system time and date is essential for establishing a timeline and correlating events across logs. Time discrepancies can affect the interpretation of evidence, so documenting the current system time (including timezone) before any changes is a fundamental forensic step. This helps maintain the integrity and context of the volatile data collected, ensuring that timestamps in memory or logs are accurately mapped.

A memory dump captures RAM contents, which are lost when the workstation powers off, making it the most volatile evidence. Collecting it first satisfies the stem's requirement to preserve volatile data before disk, logs or other less perishable sources.

A SOAR platform ingests EDR alerts and executes automated playbooks, enriching, correlating and remediating them without analyst intervention. This directly addresses the stated constraint of alert fatigue by reducing the volume requiring manual triage, while preserving the real-time endpoint visibility EDR already provides.

A scheduled task runs the reverse shell at defined intervals or logon, surviving reboots without a persistent service or startup folder entry. This satisfies maintaining access while blending into legitimate Windows Task Scheduler activity, evading detection better than always-on listeners or new local accounts.

A DGA is a technique used by malware to generate a large number of pseudo-random domain names to avoid detection and disruption of command-and-control (C2) servers. The malware attempts to resolve these domains until one resolves to an active C2 server. The high volume of NXDOMAIN responses and regular intervals are characteristic of DGA activity, as the malware periodically tries to contact its C2 infrastructure.

Volume and timing are the discriminators: bulk transfers to an external address outside business hours deviate from the insider's normal baseline. Encryption hides payload content, so NTA must rely on flow metadata such as byte counts and temporal patterns to flag exfiltration.

Sysmon, when configured with appropriate rules, logs process creation events including parent process ID, command-line arguments, and hashes. This data allows the analyst to trace the suspicious process's lineage and inspect its command line for malicious indicators. It directly answers the need to examine parent-child relationships and arguments, making it the best choice.

Post-exploitation covers actions taken after initial access, including privilege escalation, credential harvesting and lateral movement toward higher-value targets such as the database server. The tester already holds a foothold, so this phase matches the described activity.

The analyst starts from a stated proposition about adversary behaviour, then searches telemetry to confirm or refute it. That is hypothesis-driven hunting, distinct from intelligence-driven hunting (led by feeds) or baseline/anomaly approaches that flag deviations without a prior premise.

Out-of-order events in a SIEM are often caused by clock skew between log sources. If clocks are not synchronized, timestamps can be inaccurate, leading to events being sorted incorrectly. Implementing NTP ensures all systems have consistent time, which is critical for correlation. This is the most likely cause and the best solution to maintain event order.

Honeypots are decoy systems that deliberately expose fake vulnerabilities to lure attackers, logging their activity without risking real assets. This directly satisfies the stem's requirement for deception technology, since honeypots constitute the deception mechanism itself rather than a detection or prevention control layered alongside it.