CCNA Security Operations Questions

AWS GuardDuty actively leverages continuously updated threat intelligence feeds, including lists of known malicious IP addresses, domains, and attack signatures, to identify suspicious activity. When an EC2 instance communicates with an IP address or domain identified as a known command and control (C2) server by these feeds, GuardDuty generates a finding, indicating a high probability of compromise and C2 communication.

Aggregating alerts by source IP and time window groups multiple failed login attempts into a single, consolidated alert, effectively suppressing repetitive notifications while still preserving detection of brute-force or credential-stuffing activity. This correlation technique condenses dozens or hundreds of individual events into one actionable incident, reducing analyst alert fatigue and allowing the security team to focus on the actual attack pattern rather than being overwhelmed by event-level noise.

Command and control (C2) beaconing involves an infected host periodically initiating outbound connections to a C2 server, often on a non-standard port like 4444, to check for new commands or upload data. These connections are typically regular, repetitive, and consistent in their destination and port, fitting the description of repeated connections to a single IP on port 4444. This behavior establishes a persistent communication channel for remote control of the compromised system.

A file size condition in YARA, such as `filesize < 300KB`, is a fast, cheap filter that eliminates unrelated files before more expensive scanning takes place. Since many malware families produce samples with a consistent size range, imposing a size bound helps the rule avoid flagging innocuous files that happen to share other attributes. This increases precision and reduces the false-positive rate.

DNS server logs are the primary source for detecting DNS tunneling because they contain the queried domain name, client IP, timestamp, record type (e.g., A, TXT, CNAME), and response size. Tunneling often manifests as base64-encoded subdomains, unusually long FQDNs, or high volumes of TXT/ANY queries with large response payloads—all visible directly in these logs. Correlating such patterns across multiple queries to the same domain from a single internal host provides strong, specific evidence of tunneling.

Cloud application audit logs (e.g., Microsoft 365's Unified Audit Log or Google Workspace's Admin Log) provide a tamper-evident record of every file access, download, share, and permission change linked to a user or session. By correlating the CASB alert's timestamp, source IP, and geolocation with these logs, the analyst can determine definitively whether sensitive files were opened, downloaded, or shared externally. This evidence-first approach confirms or refutes exfiltration and helps scope the incident without causing business disruption.

Reviewing the Windows Security Event Log for event ID 4698 is the most direct and effective method to detect the creation of new scheduled tasks. This specific event ID explicitly logs when a scheduled task is registered on the system, providing crucial forensic evidence of a potential persistence mechanism established by an attacker. Analyzing these logs allows analysts to identify the task name, creator, and associated command, which are vital details for incident response.

Active network connections enumerated via netstat are a primary indicator of remote access tools (RATs) and command-and-control communications, which often accompany lateral movement. The artifact lists both listening and established connections, allowing the hunter to correlate suspicious external IPs and ports with the specific process IDs that own them. In Velociraptor, this yields immediate, direct evidence of an attacker's current or recent remote access session.

Large DNS payload sizes are a classic indicator of tunneling because standard DNS queries and responses are deliberately small—classic UDP DNS is limited to 512 bytes without EDNS0, and even with EDNS0 typical resolvers rarely see TXT records exceeding a few hundred bytes. Tunneled traffic (via TXT or NULL records) packs encoded data into the payload, causing individual DNS messages to balloon in size and break from the statistical norm. This size anomaly is often detected when the maximum payload length or the distribution of payload sizes for a domain appears abnormal.

The "Run" and "RunOnce" Registry keys are classic and highly effective persistence mechanisms. Entries added to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` or `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` instruct Windows to automatically launch specified programs or scripts every time a user logs on. This direct Registry modification ensures the malicious payload executes without requiring user interaction, making it a prime target for attackers seeking to maintain access.

Scheduled tasks are a native Windows mechanism that can trigger a binary or script when a user logs on, at system startup, or at regular intervals. Attackers routinely create named or hidden tasks to rerun malware or maintain command-and-control, and these tasks survive a reboot (unless disabled). Because the task description, action, triggers, and run-as user are all stored in the Task Scheduler database, examining it with Velociraptor can reveal suspicious persistence. This makes scheduled tasks an essential artifact in any threat hunt.

The registry Run key (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is a classic autostart persistence mechanism; a command using reg.exe to add a value there explicitly indicates the attacker intends to execute a payload at user logon. Inspecting this key for the malicious entry is the highest-priority action because the observed telemetry directly aligns with this persistence method, and the associated binary path or command can be identified and remediated. This is not merely incidental—the command's purpose is to modify this specific key.

GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It ingests and analyzes VPC Flow Logs, DNS logs, and CloudTrail management events to identify threats like compromised EC2 instances, port scanning, or crypto mining. GuardDuty generates findings that a SOC can investigate, making it a core cloud-native security monitoring tool.

SMB traffic between workstations is a strong lateral movement indicator because in a well-managed environment, peer-to-peer file sharing or remote administration between endpoints is uncommon; most SMB flows are client-to-server (e.g., accessing a domain controller or file server). Attackers commonly use tools like PsExec or WMIC that create SMB connections from one compromised workstation to another to copy malicious payloads, execute remote services, or access shared resources, making this traffic a precise behavioral signature for lateral spread.

Disabling unnecessary plug-ins prevents the scanner from running checks that are not relevant to the environment, such as Windows-specific tests against Linux hosts. Each plug-in produces findings, and if it probes for software or services that are absent, it can generate false positives based on erroneous banner matches. By tailoring the active plug-in set to the actual asset inventory and exposed services, the analyst reduces meaningless alerts and focuses the scan on likely vulnerabilities. This is a core tuning step that directly reduces false positives while preserving comprehensive coverage.

Normal DNS responses are typically small, often under 512 bytes when using traditional UDP limits. During DNS tunneling, attackers encode exfiltrated data into TXT records or other response fields, causing responses to be several kilobytes or larger. Such unusually large payloads are a direct and strong indicator that DNS is being used to transfer unauthorized data, making this the correct sign of data exfiltration.

A definitive sign of code injection is the presence of an executable memory region that is not backed by an on-disk file. Malicious shellcode is often allocated with VirtualAllocEx and written via WriteProcessMemory, producing a private, executable page that does not map to any section object. Memory forensics tools like Volatility's malfind enumerate the Virtual Address Descriptor (VAD) tree to identify such executable pages without a backing file, making this technique a core method for detecting fileless injection.

Modifying the instance's security group to deny all inbound and outbound traffic effectively isolates it from the network. This containment strategy immediately stops any ongoing malicious activity from spreading or exfiltrating data, while crucially preserving the instance's current state, memory, and disk for subsequent forensic analysis. This allows security analysts to investigate the root cause, understand the attack vector, and gather evidence without destroying critical information.

Scheduled tasks allow the operating system to launch specified commands or executables on triggers such as system startup, user logon, or defined intervals. Attackers frequently create scheduled tasks that re-download or re-execute malicious payloads, and these tasks persist across reboots by being stored in the Task Scheduler database. Osquery can enumerate them through the scheduled_tasks table, revealing the task name, path, and schedule, which helps identify malicious creations with autorun capabilities.

AWS CloudTrail is the native governance, compliance, and audit service that records every API call made within an AWS account. It captures essential details such as the identity of the requester, source IP address, request parameters, and response elements, enabling a comprehensive history of user and service activity. For a security analyst investigating unusual API actions, CloudTrail is the primary source of truth because it delivers the complete, tamper-evident audit log required to trace who did what and when.

This is the correct YARA rule syntax. It defines a rule named detect_malware, declares a string identifier $a assigned to the literal byte sequence "evil" inside the strings section, and then uses that identifier as the condition. The condition $a evaluates to true if the string 'evil' is found anywhere in the scanned file. YARA requires a dollar-sign prefix for string identifiers, an equals sign to bind the literal value, and a condition that references the identifier without quotes or further assignment. This rule compiles and will trigger a match when the file contains the specified string.

mshta.exe is a Microsoft HTML Application host that runs .hta files containing VBScript or JavaScript. When invoked with a remote URL, it executes attacker-supplied script directly from the internet, bypassing many application control policies and acting as a living-off-the-land binary (LOLBin). This behavior is highly suspicious because legitimate mshta execution is typically local and user-initiated, not a network fetch of script code.

Sysmon Event ID 3 is the correct choice because it records every inbound and outbound TCP/UDP connection with source/destination IP and port, giving a direct network trace of lateral movement. In pass-the-hash, an attacker typically connects from one compromised host to many others on SMB port 445 (or RPC ports) to access admin shares and execute remote code; a single host rapidly spamming connections to many distinct internal IPs on port 445 is a strong indicator. Additionally, Event 3 includes the initiating process, so an analyst can link a suspicious process like a Mimikatz-injected one directly to the anomalous traffic.

Used to download files from a URL.

A sudden or sustained increase in outbound data volume compared to the server's rolling baseline is one of the strongest indicators of exfiltration. Attackers often stage, compress, and encrypt data before bulk transfer to avoid detection, which typically manifests as an anomalous spike in bytes sent from the server. This signal is only meaningful when juxtaposed with the server's historical traffic patterns, so without baselining, a high volume could be dismissed as routine maintenance or backup activity.

Frequent queries to domains with random-looking, long subdomains are a hallmark of Domain Generation Algorithms (DGAs). Malware uses DGAs to generate pseudorandom domain names as rendezvous points with command-and-control (C2) servers, often producing long, alphanumeric subdomains that appear nonsensical. The high query rate to such domains is a strong indicator of compromise because legitimate users rarely make repeated queries to random subdomains.

Services are a high-value persistence target because they can be set to AUTO_START, allowing an adversary to execute payloads with SYSTEM privileges at boot, before any user logs on. The osquery services table exposes fields such as name, path, start_type, and status, making it easy for hunters to spot anomalies like a non-standard executable path or a suspicious service name. Because services run independently of user sessions, survive reboots, and often run with the highest integrity level, they are one of the strongest and most frequently abused persistence techniques.

Authentication logs, specifically Windows Event ID 4624, are central to detecting pass-the-hash because they record successful and failed logon events, including the logon type, authentication package (e.g., NTLM), source workstation, and target account. In a PtH attack, an attacker uses an NTLM hash as if it were a password; the logon event will typically show a network logon (Type 3) using NTLM, often from a non-domain host or in conjunction with suspicious source IP addresses. Correlating these 4624 events with known user activity patterns can reveal an attacker authenticating with a hash from an unauthorized source.

Service accounts frequently generate legitimate failed-login noise from scheduled password rotations, expired credentials in automation scripts, or misconfigured connection strings, none of which represent an attacker probing for access. Suppressing these known, expected sources removes a large share of benign alert volume without weakening detection against genuine unauthorized login attempts from unexpected accounts or sources.