Incident Detection Response And Threat Prediction

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

A security architect is designing an enterprise threat hunting program. Which TWO activities are considered core, proactive components of a mature threat hunting methodology rather than standard automated alerting? (Choose two)

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

During the preparation and detection phases of incident response, a CND analyst must gather and analyze multiple sources of telemetry to identify the root cause of a suspected breach. Which THREE data sources are typically classified as network-based telemetry rather than host-based telemetry? (Choose three)

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

A CND analyst is investigating a breach where the attacker exfiltrated data over DNS queries to an external authoritative server. The analyst wants to detect similar activity in the future by monitoring DNS traffic for anomalous patterns. Which of the following is the MOST effective indicator to monitor for DNS tunneling?

During an incident, a network defender needs to collect volatile evidence from a compromised Linux server before shutting it down. Which of the following commands should be used to capture the current network connections and listening ports?

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

A network defender is reviewing logs from a Cisco IOS router and notices numerous ICMP echo requests with varying source IP addresses and large payloads. The defender suspects an ICMP tunneling attack. Which of the following is the BEST method to confirm and analyze this activity?

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

A network security administrator is configuring intrusion detection systems. Which TWO operational benefits does anomaly-based detection offer compared to signature-based detection? (Choose TWO)

An organization is establishing forensic readiness to ensure that digital evidence can be legally and technically sound during an investigation. Which THREE practices directly contribute to organizational forensic readiness? (Choose three)

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

A threat hunter is searching for persistence mechanisms on a Windows system and needs to check Autoruns data. Which registry hive contains user-specific startup application entries?

An incident response team is performing disk forensics on an NTFS-formatted hard drive. The analyst needs to recover deleted files that were too large to fit in the Recycle Bin. Which internal NTFS metadata structure contains file record attributes including timestamps, permissions, and resident/non-resident data locations?

An incident responder identifies a compromised workstation and determines that isolating the machine from the network is necessary. Which tool native to Windows allows an administrator to block all inbound and outbound network traffic except for pre-configured exceptions?

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)

An incident response investigator is analyzing a Linux server compromised via a web shell. To determine when the web shell file was last accessed or modified, the investigator examines file timestamps. Which Linux command displays the complete file status including access, modification, and change (mtime, atime, ctime) times?

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

A security analyst is reviewing alerts generated by an Endpoint Detection and Response (EDR) agent. The agent flags a process spawning cmd.exe with encoded arguments. Which phase of incident response involves triaging this alert to determine if it is a true positive?

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

A security analyst is hardening an enterprise network to support robust forensic readiness. Which THREE administrative or technical controls should be implemented to ensure successful post-incident investigations? (Choose THREE)

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

A CND analyst is deploying a centralized Security Information and Event Management (SIEM) solution. To enable proactive threat hunting and rapid incident detection across distributed network segments, what is the primary function of deploying forwarders or agents on endpoints?

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

A security analyst is examining a memory dump from a compromised Windows 10 host. The analyst suspects that a malicious process injected code into a legitimate process. Which of the following memory analysis techniques is MOST effective for identifying injected code?

A security analyst is investigating a suspected malware outbreak on a domain controller. To ensure forensic integrity and maintain a proper chain of custody before powering down the machine, what is the correct sequence of volatility when acquiring volatile evidence using live response tools such as FTK Imager or LiME?

A CND analyst is conducting post-incident threat prediction after a recent breach. The analyst needs to identify which internal host initiated the most outbound connections to known malicious IP addresses over the past 72 hours to prioritize containment and predict future attack paths. Which data source and analysis technique should the analyst use?

An organization's Security Operations Center (SOC) receives an alert regarding an unusual outbound connection to a known command-and-control (C2) IP address. According to the NIST SP 800-61 Rev. 2 incident response lifecycle, which phase immediately follows the Containment, Eradication, and Recovery phase?