CCNA Security Questions

A false positive occurs when a security control incorrectly flags benign, authorized activity as malicious. In this case, the SIEM generated an alert for legitimate SCP transfers, meaning the rule triggered on normal administrative behavior rather than an actual security incident.

DNS tunneling encapsulates non-DNS traffic, such as SSH, HTTP, or proprietary data exfiltration protocols, within DNS queries and responses. While standard DNS queries typically utilize UDP port 53, attackers frequently fall back to or abuse TCP port 53 to bypass standard UDP-based inspection filters and transmit larger payloads or maintain persistent, stateful connection channels.

The first phase of the incident response lifecycle following detection is analysis and validation. Analysts must investigate the CASB alert to rule out false positives, determine the classification of the downloaded file, and verify whether the activity constitutes actual unauthorized data exfiltration before initiating containment or eradication protocols.

A true positive occurs when a security monitoring tool correctly identifies and alerts on actual malicious or unauthorized activity. In this case, the SIEM alert successfully flagged a genuine security event that requires analyst triage and incident response. Validating true positives is a fundamental step in the incident handling lifecycle before escalating to containment.

Process hollowing is a defense evasion technique where an adversary spawns a legitimate process like svchost.exe in a suspended state, unmaps its memory, and replaces it with a malicious payload. This allows the malware to masquerade as a trusted system process, hiding its true nature from basic process-monitoring tools while executing unauthorized code.

When threat actors compromise AWS IAM credentials, they frequently target unused geographical regions to evade detection while spinning up high-performance EC2 instances for illicit cryptocurrency mining. This anomalous behavior is flagged in CloudTrail logs by API calls like RunInstances originating from unfamiliar IPs and targeting non-standard regions, which deviates sharply from established baseline activity.

When a user account suddenly executes unauthorized API calls to alter network configurations or security groups, it strongly suggests an adversary is attempting privilege escalation or lateral movement. By modifying these boundaries, the attacker aims to establish broader access to sensitive cloud resources or bypass existing security controls.

This is the correct YARA rule syntax. It defines a rule named detect_malware, declares a string identifier $a assigned to the literal byte sequence "evil" inside the strings section, and then uses that identifier as the condition. The condition $a evaluates to true if the string 'evil' is found anywhere in the scanned file. YARA requires a dollar-sign prefix for string identifiers, an equals sign to bind the literal value, and a condition that references the identifier without quotes or further assignment. This rule compiles and will trigger a match when the file contains the specified string.

Raising the risk score threshold means only IPs with very high threat-intelligence risk scores trigger alerts, filtering out lower-scored IPs that legitimate services use. This directly reduces the false positives described in the stem while retaining detection of genuinely high-risk connections.

Scheduled Tasks (T1053.005) represent a highly common persistence mechanism where adversaries abuse task scheduling utilities, such as Windows Task Scheduler, to execute malicious binaries at specific intervals or system events. This technique directly aligns with the threat hunter's hypothesis of identifying persistent execution methods that survive reboots and user logoffs.

Process hollowing specifically involves spawning a legitimate system process (like svchost.exe) in a suspended state using the CREATE_SUSPENDED flag, unmapping its original executable code from memory, writing a malicious payload into that hollowed space, and then resuming the thread. This allows the malware to masquerade as a trusted process while executing arbitrary code under its identity.

mshta.exe is a Microsoft HTML Application host that runs .hta files containing VBScript or JavaScript. When invoked with a remote URL, it executes attacker-supplied script directly from the internet, bypassing many application control policies and acting as a living-off-the-land binary (LOLBin). This behavior is highly suspicious because legitimate mshta execution is typically local and user-initiated, not a network fetch of script code.

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides threat hunters with a highly structured, granular matrix to map specific behaviors, identify coverage gaps in telemetry, and systematically formulate hypotheses regarding how advanced persistent threats (APTs) might execute actions within an environment.

Python paired with the Scapy library provides a powerful programmatic environment to parse packet capture (PCAP) files. It allows analysts to write custom scripts that target specific layers, extract HTTP payload data, programmatically decode base64-encoded strings, and automate the identification of exfiltrated data at scale.

Process hollowing involves spawning a legitimate process in a suspended state, unmapping its original executable image from memory, and replacing it with a malicious payload. Because the process's metadata and path point to a legitimate disk-backed executable while the memory contains unauthorized code, it creates a memory-only execution state that evades standard signature-based detection.

Sysmon Event ID 1 provides highly detailed telemetry regarding process creation, including the parent process, command-line arguments, and file hashes. This rich context is essential for Sigma rules designed to detect suspicious command-line flags or anomalous parent-child process relationships.

This is the correct classification because the SIEM generated an alert for behavior that, while anomalous or aggressive in appearance, is actually benign and pre-authorized. Vulnerability scanners frequently trigger brute-force or account-harvesting alerts during routine credentialed checks. Labeling this as a false positive allows analysts to tune the SIEM rules to exclude the scanner's IP address from future alerts.

When a critical vulnerability cannot be immediately patched, security analysts must evaluate the surrounding architecture. Isolating the affected system within a demilitarized zone (DMZ) acts as a compensating control that significantly reduces the threat vector and likelihood of exploitation. Consequently, formally accepting the residual risk is a valid temporary or permanent business decision when these alternative safeguards are active.

Correct. DGA malware generates hundreds or thousands of pseudo-random candidate domains per day to locate its command-and-control server, so a rule watching for high-entropy hostnames paired with a burst of NXDOMAIN responses (since most generated domains are never registered) is the defining behavioral fingerprint of DGA activity.

Process analysis specifically evaluates the execution lifecycle, metadata, and hierarchical relationships of running programs. By examining process trees, analysts can identify anomalous parent-child relationships, such as a web server spawning a command shell, which is a classic indicator of compromise.

Process hollowing involves spawning a legitimate system process in a suspended state, unmapping its original executable memory using APIs like NtUnmapViewOfSection, and writing malicious code into the hollowed-out space. Because the malicious payload is written directly into the allocated memory of the victim process without being loaded from a corresponding file on disk, memory analysis reveals executable regions that lack proper file backing. This allows the malware to masquerade as a trusted system process.

This is the correct approach because it maintains accurate risk visibility while acknowledging the temporary protection provided by the Web Application Firewall (WAF). Documenting the WAF as a compensating control justifies delaying immediate patching, but the vulnerability must still be tracked in the risk register. This ensures the flaw is eventually remediated permanently during scheduled maintenance, preventing exposure if the WAF is misconfigured or bypassed.

A SYN flood is a classic denial-of-service attack that exploits the TCP three-way handshake. The attacker floods the target with SYN packets using spoofed source IP addresses, forcing the victim to allocate resources and respond with SYN-ACKs, but never completes the connection with a final ACK. This rapidly exhausts the target's connection queue, preventing legitimate users from establishing connections.

Authentication logs, such as those generated by Active Directory, Kerberos, or RADIUS servers, explicitly record identity verification events, including usernames, source IPs, timestamps, and explicit success or failure codes. These logs are the definitive source for tracking credential usage, identifying brute-force attacks, and verifying successful access to systems. Analyzing these events allows security analysts to correlate login patterns with potential unauthorized access.

Large outbound transfers during off-hours deviate from the host's normal baseline, indicating possible automated exfiltration rather than legitimate business activity. Volume combined with unusual timing is the behavioural anomaly that distinguishes data theft from routine traffic in this scenario.

Wireshark captures and decodes packets in real time or from a saved capture file, reassembling TCP streams and, where the session is unencrypted or keys are available, rendering application-layer payload content, protocol fields, and TLS handshake metadata needed to determine what data is actually being exchanged with the malicious IP.

The primary objective of log normalization is to ingest disparate log formats from various vendors—such as firewalls, operating systems, and databases—and map them to a common schema, such as mapping "src_ip", "source", and "src" all to "source_ip". This standardization is essential for SIEM correlation engines to accurately analyze cross-platform events and detect complex attack patterns.

DNS tunneling protocols frequently abuse TXT records because they can carry arbitrary, unstructured text payloads up to 65,535 bytes in size. When an analyst observes unusually large TXT record responses, it strongly indicates that an external server is sending encapsulated payload data or command-and-control instructions back to a compromised internal host.

Checking the user's RBAC role assignments against Key Vault establishes whether Add-AzKeyVaultKey was actually within that person's authorized scope of duties, since a first-time use of a cmdlet by someone who legitimately holds a Key Vault Contributor or Crypto Officer role is far less suspicious than the same call from an account with no assigned Key Vault permissions.

PowerShell (T1059.001) is a sub-technique under Command and Scripting Interpreter that allows adversaries to execute commands, run scripts, and interact directly with the operating system. Threat hunters look for PowerShell commands utilizing cmdlets like 'Invoke-WebRequest' or 'Start-BitsTransfer' because they are commonly abused to download and execute malicious payloads directly into memory.

Sysmon Event ID 13 specifically monitors registry value modifications, making it highly effective for tracking persistence mechanisms. By targeting the \\CurrentVersion\\Run key path within the TargetObject field, this rule directly alerts on attempts to establish autostart execution points, regardless of the process initiating the change.

In a legitimate Windows environment, svchost.exe (Service Host) is always spawned by the Services Control Manager (services.exe). If the parent process is anything else, such as a web browser, user-space application, or command shell, it strongly indicates process hollowing, DLL injection, or malicious Living off the Land (LotL) activity. Verifying this lineage is the most effective way to confirm whether the process has been hijacked to establish the outbound C2 connection.

This is a false positive because the alert fired on a single failed login from a known, trusted internal IP that was immediately followed by successful authentication, a pattern far more consistent with a routine typo than malicious activity; the detection rule's threshold for triggering on just one failed attempt is overly sensitive and should likely be tuned to require multiple failures before alerting.

A true positive represents a successful detection where the SIEM security analytics engine correctly flags actual malicious behavior or policy violations. When an analyst validates that the triggered alert corresponds to genuine adversary activity, such as an active brute-force attack or unauthorized data exfiltration, it confirms a true positive state. This validation initiates the incident response lifecycle.

Threat actors frequently target registry Run and RunOnce keys located within HKLM or HKCU to ensure their malicious payloads execute automatically upon system boot or user logon. This mechanism allows the malware to survive system reboots and maintain a continuous presence within the compromised environment. Consequently, detecting unauthorized modifications to these specific registry paths is a high-fidelity indicator of a persistence establishment attempt.

DNS logs capture the complete transaction details, including the requested domain names, query types (such as TXT, MX, or CNAME), and the corresponding server responses. This granular payload visibility is essential for identifying the high-frequency, anomalously long, or encoded subdomains characteristic of DNS tunneling and data exfiltration techniques.

Creating a whitelist or exception within the SIEM correlation rule for validated, non-interactive service accounts is the most effective tuning strategy. This approach eliminates high-volume false positives generated by legitimate automated processes while maintaining strict, low-threshold monitoring for standard user accounts. It ensures that any anomalous lateral movement by human adversaries remains highly visible to the security operations center.

Process hollowing launches a legitimate process in a suspended state, unmaps its original executable image from memory, and writes malicious code and a new PE header into that same memory space before resuming execution, which is exactly why memory forensics reveals a legitimate process name like notepad.exe containing a PE header and code that does not match its original binary on disk.

Command and control (C2) beaconing is characterized by compromised internal hosts making periodic, highly consistent outbound connections to external malicious infrastructure to check for instructions. These regular intervals, often referred to as heartbeat signals, are designed to maintain persistence and bypass standard firewalls by masquerading as legitimate outbound HTTPS traffic.

Malicious VBA macros embedded in Office documents commonly use the Shell function or WScript.Shell object to launch powershell.exe directly as a child process of winword.exe, often passing obfuscated, base64-encoded, or download-cradle commands as arguments to retrieve a second-stage payload, which produces exactly the winword.exe-to-powershell.exe parent-child relationship seen in this alert and matches the well-documented email-delivered macro attack pattern.

By authenticating to the target, the scanner can query installed software versions, registry settings, running services, and local configuration files directly from the operating system, producing far more accurate and complete vulnerability data than an external, unauthenticated scan could infer from network responses alone.

This scenario represents a false positive because the SIEM's correlation rules triggered an alert on benign, authorized user activity. The system incorrectly classified a legitimate login attempt as a security threat, requiring the analyst to investigate and potentially tune the rule to prevent future noise.

A credentialed scan utilizes provided administrative or user credentials to log directly into the target operating system. This allows the scanner to perform deep local inspections, such as querying the registry, checking package manager databases, and auditing configuration files. Consequently, it provides a highly accurate assessment of missing patches and misconfigurations with minimal false positives.

Frequent queries to domains with random-looking, long subdomains are a hallmark of Domain Generation Algorithms (DGAs). Malware uses DGAs to generate pseudorandom domain names as rendezvous points with command-and-control (C2) servers, often producing long, alphanumeric subdomains that appear nonsensical. The high query rate to such domains is a strong indicator of compromise because legitimate users rarely make repeated queries to random subdomains.

Correct. Activity Logs record subscription-level control-plane operations performed by the account after authentication, so correlating them reveals whether the session was used to create, modify, or delete resources, which is a strong indicator of malicious intent versus benign access.

Authentication logs, specifically Windows Event ID 4624, are central to detecting pass-the-hash because they record successful and failed logon events, including the logon type, authentication package (e.g., NTLM), source workstation, and target account. In a PtH attack, an attacker uses an NTLM hash as if it were a password; the logon event will typically show a network logon (Type 3) using NTLM, often from a non-domain host or in conjunction with suspicious source IP addresses. Correlating these 4624 events with known user activity patterns can reveal an attacker authenticating with a hash from an unauthorized source.

This is correct because the registry Run key is a classic persistence mechanism used to ensure malware executes automatically when a user logs in. Furthermore, legitimate "svchost.exe" binaries must execute exclusively from the System32 directory; finding an executable with this name in a user-writable directory like the Public folder strongly indicates a masquerading technique.

Tuning the alert is the industry-standard method for managing false positives because it refines the detection logic to exclude benign, repetitive behavior. By adding specific exclusions, such as a trusted IP address or a known service account, the analyst reduces noise and alert fatigue without compromising the SIEM's ability to identify actual threats.

svchost.exe normally hosts service DLLs and does not spawn schtasks.exe. This parent-child pairing indicates a service being abused to create a scheduled task, a common lateral movement and persistence technique for executing code on a remote host.

Wireshark is a premier open-source packet analyzer that intercepts and decodes network traffic in real time. It allows security analysts to capture raw frames from a network interface card in promiscuous mode, filter traffic using display filters, and perform deep packet inspection to troubleshoot anomalies or detect malicious payloads.