Knowledge + Practice

CCNA Incident Detection Response And Threat Prediction Questions

45 questions · Incident Detection Response And Threat Prediction topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

A.Scanning internal subnets for unpatched EternalBlue vulnerabilities

B.Querying authentication logs for service accounts logging in interactively via remote desktop

C.Searching endpoint logs for known ransomware string signatures

D.Checking firewall rules for outbound traffic on port 443

AnswerB

T1078 abuse involves legitimate credentials, so detection hinges on anomalous authentication behaviour. Service accounts logging in interactively via RDP violate their non-interactive design, producing a high-fidelity signal that aligns directly with the technique's credential-misuse pattern.

Why this answer

MITRE ATT&CK T1078 (Valid Accounts) describes adversaries using legitimate credentials to authenticate, so the best hunting methodology is to look for anomalous authentication behavior — such as service accounts logging in interactively via RDP, which violates normal service-account usage patterns. Querying authentication logs for that behavior directly aligns with detecting misuse of valid accounts, making B correct.

Exam trap

CND often tests whether candidates confuse vulnerability scanning or signature detection with threat hunting, so the trap is selecting a technical scan (EternalBlue) instead of an authentication-log behavioral query that matches the T1078 technique.

How to eliminate wrong answers

Option A is wrong because scanning for EternalBlue (MS17-010) vulnerabilities relates to exploitation of a specific SMB vulnerability (T1210/T1190), not to abuse of valid accounts. Option C is wrong because searching for ransomware string signatures is signature-based detection of malware artifacts, not hunting for credential misuse. Option D is wrong because checking firewall rules for outbound port 443 is a network-perimeter review and does not address authentication anomalies associated with T1078.

Practice this question →

2

Multi-Selecthard

A security architect is designing an enterprise threat hunting program. Which TWO activities are considered core, proactive components of a mature threat hunting methodology rather than standard automated alerting? (Choose two)

Select 2 answers

A.Formulating a threat hypothesis based on recent adversary tactics, techniques, and procedures (TTPs)

B.Relying entirely on out-of-the-box SIEM correlation alerts for immediate notification

C.Configuring automated firewall rule drops for known malicious IP feeds

D.Conducting iterative, hypothesis-driven data queries and artifact analysis to uncover undetected threats

E.Executing routine scheduled vulnerability scans against external perimeter assets

AnswersA, D

Formulating a hypothesis from recent adversary TTPs gives hunting its proactive direction, focusing investigation on plausible attacker behaviour rather than waiting for automated alerts. This satisfies the stem's requirement for a core, proactive threat hunting methodology component.

Why this answer

Option A is correct because mature threat hunting begins with a hypothesis derived from current adversary TTPs (e.g., MITRE ATT&CK techniques), which directs hunters toward plausible, high-value threats rather than waiting for alerts. Option D is correct because hunting is an iterative, hypothesis-driven process of querying telemetry (SIEM, EDR, network data) and analyzing artifacts to surface threats that automated detection missed. These two activities are proactive and analyst-led, distinguishing them from reactive alert handling.

Option B is not correct because out-of-the-box SIEM correlation alerts are automated, reactive detection rather than proactive hunting. Option C is not correct because automated firewall drops based on malicious IP feeds are preventive, signature-based controls, not hunting. Option E is not correct because scheduled vulnerability scans are routine, automated assessment activities, not hypothesis-driven threat hunting.

Exam trap

CND often tests the distinction between proactive hunting and reactive detection/prevention — the trap is selecting automated alerting or vulnerability scanning because they sound security-related, when the question specifically asks for hypothesis-driven hunting activities.

Practice this question →

3

MCQhard

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

A.Microsoft-Windows-PowerShell/Operational, Event ID 4104

B.Security log, Event ID 4688

C.System log, Event ID 7045

D.Microsoft-Windows-PowerShell/Operational, Event ID 4103

AnswerA

Microsoft-Windows-PowerShell/Operational with Event ID 4104 records script block text when logging captures executed code, including de-obfuscated content, satisfying the requirement to inspect full LotLBin script blocks. Event ID 4103 only logs pipeline execution details, not the complete block text, so 4104 is the precise channel and ID.

Why this answer

PowerShell script block logging writes events to the Microsoft-Windows-PowerShell/Operational log with Event ID 4104, containing the full text of executed script blocks. This is the primary source for inspecting PowerShell code executed on a Windows system, including obfuscated or malicious scripts.

Exam trap

CND often tests the confusion between Event ID 4104 (script block logging) and 4103 (module logging), or between PowerShell operational logs and Security 4688 process creation events.

How to eliminate wrong answers

Option B is wrong because Security log Event ID 4688 logs process creation, including the command line, but not the full script block content executed by PowerShell. Option C is wrong because System log Event ID 7045 logs service installation, unrelated to PowerShell script block logging. Option D is wrong because Event ID 4103 logs module logging and pipeline execution details, which is less complete than 4104 for full script block text; 4104 is the specific event for script block logging.

Practice this question →

4

Multi-Selectmedium

During the preparation and detection phases of incident response, a CND analyst must gather and analyze multiple sources of telemetry to identify the root cause of a suspected breach. Which THREE data sources are typically classified as network-based telemetry rather than host-based telemetry? (Choose three)

Select 3 answers

A.NetFlow and IPFIX traffic flow records

B.Master File Table ($MFT) filesystem journals

C.Full Packet Capture (PCAP) files from network taps

D.DNS query and response logs collected at the recursive resolver

E.Windows Security Event Logs (Event ID 4624)

AnswersA, C, D

NetFlow and IPFIX export flow metadata from routers and switches, capturing source, destination, port and byte counts without inspecting endpoint internals. This makes them network-based telemetry, unlike host artefacts such as process logs or file system records.

Why this answer

Network-based telemetry is data collected from the network fabric rather than from an endpoint's operating system. Option A (NetFlow and IPFIX traffic flow records) is correct because these are flow-export protocols generated by routers, switches, and firewalls that summarize IP conversations (5-tuple, byte/packet counts, timestamps) without touching host internals. Option C (Full Packet Capture (PCAP) files from network taps) is correct because PCAPs are captured at taps, SPAN ports, or inline sensors and contain raw packet payloads and headers traversing the wire.

Option D (DNS query and response logs collected at the recursive resolver) is correct because resolver logs record network name-resolution transactions (query name, type, client IP, response) observed on the network infrastructure, not on the endpoint. Option B (Master File Table ($MFT) filesystem journals) is host-based, as the $MFT is an NTFS metadata structure on a Windows volume, and Option E (Windows Security Event Logs, Event ID 4624) is host-based, since 4624 is a logon event written to the endpoint's Security log.

Exam trap

CND often tests the boundary between host-based and network-based telemetry; candidates must recognize that $MFT and Windows Event Logs are host artifacts, while flow records, PCAP, and DNS resolver logs are network-derived.

Practice this question →

5

MCQhard

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

A.As a core feature directly connected to Adversary and Victim

B.As a confidence value assigned to the intelligence report

C.As an external social-political requirement

D.As a meta-feature used exclusively for tracking timestamps

AnswerA

In the Diamond Model, Infrastructure is one of the four core features, positioned as a vertex connected by edges to Adversary and Victim, describing the physical or logical resources the adversary uses to deliver capabilities.

Why this answer

In the Diamond Model of Intrusion Analysis, Infrastructure is one of the four core features, alongside Adversary, Capability, and Victim. It represents the physical or logical resources used by the adversary, such as command-and-control servers, and is directly connected to both Adversary and Victim in the diamond. This classification is fundamental to the model.

Exam trap

The trap is mixing up core features with meta-features—candidates may incorrectly classify Infrastructure as a meta-feature or confidence value, but it is one of the four core vertices.

How to eliminate wrong answers

Option B is wrong because confidence values are meta-features (socio-political, technology, etc.) that describe the reliability of intelligence, not core features. Option C is wrong because external social-political requirements are meta-features, not core features like Infrastructure. Option D is wrong because timestamps are part of the meta-features (e.g., date/time), not a core feature, and Infrastructure is not a meta-feature.

Practice this question →

6

MCQmedium

A CND analyst is investigating a breach where the attacker exfiltrated data over DNS queries to an external authoritative server. The analyst wants to detect similar activity in the future by monitoring DNS traffic for anomalous patterns. Which of the following is the MOST effective indicator to monitor for DNS tunneling?

A.DNS queries using TCP instead of UDP for large responses

B.Frequent DNS zone transfers (AXFR) from internal to external servers

C.Repeated DNS queries for the same domain with identical transaction IDs

D.High volume of DNS queries with long subdomain labels and high entropy

AnswerD

DNS tunneling encodes data in subdomains, producing queries with unusually long labels (often exceeding 50 characters) and high entropy due to base64 or hex encoding. Monitoring for these patterns, along with query volume to a single domain, is a reliable detection method. This directly addresses the scenario where data is exfiltrated via DNS.

Why this answer

DNS tunneling exfiltrates data by encoding it into DNS queries, often using long, high-entropy subdomains. Monitoring for such patterns, along with query volume and domain reputation, helps detect this activity. The other options describe less relevant or non-specific indicators that would not effectively identify DNS tunneling in this scenario.

Exam trap

The trap here is assuming that any DNS anomaly, such as TCP usage or repeated queries, indicates tunneling, when the key signature is long, high-entropy subdomains.

Practice this question →

7

MCQmedium

During an incident, a network defender needs to collect volatile evidence from a compromised Linux server before shutting it down. Which of the following commands should be used to capture the current network connections and listening ports?

A.route -n

B.ifconfig -a

C.netstat -tulnp

D.arp -a

AnswerC

The netstat -tulnp command displays TCP and UDP listening ports along with the associated process IDs and program names, providing a snapshot of active network connections and services. This is essential volatile data that can reveal malicious listeners or established connections. It should be collected before shutdown to preserve evidence.

Why this answer

The netstat -tulnp command is the correct choice because it lists active TCP/UDP connections and listening ports with process details. The other commands provide interface, routing, or ARP information, which are not the required volatile network connection data. Collecting this data before shutdown is critical for incident response.

Exam trap

The trap here is confusing general network configuration commands with those that reveal active connections, leading to incomplete volatile evidence collection.

Practice this question →

8

MCQmedium

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

A.Event ID 1102

B.Event ID 4698

C.Event ID 4624

D.Event ID 4720

AnswerC

Event ID 4624 logs successful logon events, and its authentication package and logon type fields reveal NTLM-based authentication, exposing Pass-the-Hash activity. This satisfies the requirement to detect authentication via NTLM hash rather than plaintext password.

Why this answer

Event ID 4624 is logged on successful logon and includes a Logon Type field (Type 3 for network, Type 9 for NewCredentials) plus an Authentication Package field that shows NTLM when a hash is used instead of a plaintext password. Analysts filter 4624 events for NTLM authentication to detect Pass-the-Hash activity.

Exam trap

CND often tests the difference between authentication events (4624/4625) and account-management or anti-forensics events (4720, 4698, 1102) — candidates who pick 1102 because it sounds 'security-related' miss that it only records log clearing.

How to eliminate wrong answers

Option A is wrong because Event ID 1102 records that the audit log was cleared, which is a anti-forensics indicator but not an authentication event. Option B is wrong because Event ID 4698 records a scheduled task being created, which is a persistence technique, not authentication. Option D is wrong because Event ID 4720 records a user account being created, which is an account-management event unrelated to NTLM logon.

Practice this question →

9

MCQeasy

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

A.Analyze the log files to verify if an unauthorized breach has occurred

B.Contain the compromised host to prevent lateral movement

C.Perform post-incident lessons learned activities

D.Eradicate the malware from the impacted SSH server

AnswerA

NIST SP 800-61 begins with preparation, but once an event is detected the first active phase is analysis and validation. Examining the SSH logs confirms whether the failed attempts and root login constitute a genuine breach before containment.

Why this answer

NIST SP 800-61 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The first phase after preparation is Detection and Analysis, which in this scenario means analyzing log files to verify whether an unauthorized breach has actually occurred. Only after confirming the incident should containment, eradication, or lessons-learned activities begin.

Exam trap

The trap is jumping to containment or eradication because the scenario sounds like a confirmed breach — but NIST's first phase after preparation is detection and analysis, and the question asks for the first action.

How to eliminate wrong answers

Option B is wrong because containment is the third phase (after detection and analysis) — you must first verify the incident before isolating the host, otherwise you may disrupt operations for a false positive. Option C is wrong because post-incident lessons learned is the final phase, performed after recovery is complete. Option D is wrong because eradication is part of the third phase and comes after containment — you cannot eradicate malware before confirming and containing the incident.

Practice this question →

10

MCQhard

A network defender is reviewing logs from a Cisco IOS router and notices numerous ICMP echo requests with varying source IP addresses and large payloads. The defender suspects an ICMP tunneling attack. Which of the following is the BEST method to confirm and analyze this activity?

A.Enable ICMP rate limiting on the router to mitigate the attack

B.Monitor for increased ICMP traffic volume during off-hours

C.Check router ACLs to see if ICMP is permitted from external sources

D.Capture full packet data and inspect ICMP payloads for embedded protocols or data

AnswerD

ICMP tunneling embeds data within the payload of ICMP packets. Capturing full packets and analyzing payloads for non-standard content, such as TCP headers or encoded data, can confirm tunneling. This method provides definitive evidence by examining the actual payload, which is necessary to distinguish tunneling from normal ping traffic.

Why this answer

To confirm ICMP tunneling, the defender must inspect packet payloads for embedded data or protocols. Volume-based or policy-based checks are insufficient because they do not examine the content. Full packet capture allows direct observation of tunneling artifacts, making it the best method for confirmation and analysis.

Exam trap

The trap here is focusing on traffic volume or ACLs as indicators, when the definitive evidence of tunneling lies in the packet payload.

Practice this question →

11

MCQmedium

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

A.Strategic threat intelligence

B.Operational threat intelligence

C.Tactical threat intelligence

D.Technical threat intelligence

AnswerA

Strategic threat intelligence addresses adversary motivations, campaign histories and long-term intent at a high level for executive decision-making. This matches the stem's provision of detailed campaign histories and adversary motivations, distinguishing it from tactical or operational intelligence.

Why this answer

Strategic threat intelligence is high-level, long-term intelligence focused on the adversary's intent, motivations, campaign histories, and overall risk posture. It is consumed by executives and decision-makers to shape security strategy and investment. The scenario describes detailed campaign histories and adversary motivations, which are hallmarks of strategic intelligence rather than operational, tactical, or technical feeds.

Exam trap

CND often tests the four threat intelligence levels by describing a scenario and asking you to classify it — candidates confuse strategic (motivations, campaign history) with operational (specific impending attacks) because both sound 'high-level.'

How to eliminate wrong answers

Option B is wrong because operational threat intelligence focuses on specific impending attacks — details about when, where, and how an adversary is likely to strike in the near term, not broad campaign histories and motivations. Option C is wrong because tactical threat intelligence covers the specific TTPs an adversary uses (e.g., MITRE ATT&CK techniques) to help defenders tune detections, not the strategic 'why' behind campaigns. Option D is wrong because technical threat intelligence is the most granular level — indicators of compromise such as IP addresses, hashes, and domains used in automated detection systems, not narrative campaign analysis.

Practice this question →

12

MCQeasy

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

A.Heuristic detection

B.Behavioral analytics detection

C.Signature-based detection

D.Anomaly-based detection

AnswerC

Snort compares packet payloads against a database of known attack patterns. The alert fired because the traffic matched a stored signature for the 'SELECT * FROM users WHERE' SQL injection string, so detection relies on predefined signatures rather than anomaly or behaviour baselines.

Why this answer

Snort is matching a specific string pattern ('SELECT * FROM users WHERE') against network traffic, which is the hallmark of signature-based detection — it compares packets against a database of known attack patterns. The rule in question is a content-match signature, not a statistical or behavioral model, so signature-based detection is the correct classification.

Exam trap

CND often tests whether candidates confuse signature-based detection (exact pattern match) with anomaly-based or heuristic detection (statistical/behavioral deviation), causing them to overthink a straightforward content match.

How to eliminate wrong answers

Option A is wrong because heuristic detection uses rules of thumb or scoring to identify suspicious behavior that may not match a known signature, whereas Snort here is matching an exact literal string. Option B is wrong because behavioral analytics detection (often UEBA) baselines normal activity and flags deviations over time, which is not what a static content match does. Option D is wrong because anomaly-based detection builds statistical profiles and alerts on deviations from the baseline; Snort's literal string match is deterministic, not statistical.

Practice this question →

13

Multi-Selectmedium

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

Select 3 answers

A.Designing corporate marketing websites

B.Replacing physical data center firewalls with robotic hardware arms

C.Executing automated containment playbooks (e.g., isolating a host upon high-fidelity alert)

D.Automated enrichment of IOCs via external threat intelligence APIs

E.Streamlining incident case management and ticket generation in platforms like Jira or ServiceNow

AnswersC, D, E

SOAR executes machine-speed containment playbooks, calling EDR or firewall APIs to isolate a compromised host the moment a high-fidelity alert fires. This removes analyst latency from the response loop, satisfying the stem's containment use case rather than detection or enrichment.

Why this answer

Option C is correct because SOAR platforms are built to run orchestrated playbooks that trigger automated containment actions, such as isolating an endpoint via EDR API or disabling an account when a high-fidelity alert fires, reducing mean time to respond. Option D is correct because SOAR natively performs automated IOC enrichment by querying external threat intelligence APIs (e.g., VirusTotal, MISP, Recorded Future) to add context like reputation, geolocation, and related campaigns to alerts. Option E is correct because SOAR integrates with ITSM and case management tools such as Jira and ServiceNow to auto-create, update, and track incident tickets, streamlining workflow and documentation.

Option A is incorrect because designing marketing websites is a web development function unrelated to security orchestration or incident response. Option B is incorrect because SOAR is software orchestration, not physical robotics, and it does not replace data center firewalls with robotic hardware arms.

Exam trap

The trap is selecting options that sound technical but are unrelated to SOAR's actual scope — candidates may pick anything mentioning 'automation' or 'firewalls' without verifying it aligns with SOAR's orchestration, enrichment, and case management functions.

Practice this question →

14

MCQmedium

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

A.Detection and Analysis

B.Preparation

C.Post-Incident Activity

D.Recovery

AnswerD

After eradication removes the malware and closes the entry point, NIST SP 800-61 moves to recovery: restoring systems, validating they are clean, and returning them to production. Containment and lessons learned occur at other stages.

Why this answer

After eradication, the next immediate phase in the NIST SP 800-61 lifecycle is Recovery. Recovery involves restoring systems to normal operation, validating that they are clean, and monitoring for any residual issues. This follows containment and eradication.

Exam trap

CND often tests the order of NIST SP 800-61 phases, and candidates may jump to Post-Incident Activity prematurely, skipping Recovery, which is the immediate next step after eradication.

How to eliminate wrong answers

Option A (Detection and Analysis) is wrong because it is an earlier phase that occurs before containment and eradication. Option B (Preparation) is incorrect because it is the first phase, conducted before an incident occurs. Option C (Post-Incident Activity) is wrong because it comes after recovery, focusing on lessons learned and evidence retention.

Practice this question →

15

Multi-Selecteasy

A network security administrator is configuring intrusion detection systems. Which TWO operational benefits does anomaly-based detection offer compared to signature-based detection? (Choose TWO)

Select 2 answers

A.Instantaneous identification of exact malware families by name without analysis

B.Ability to detect previously unknown (zero-day) attacks based on baseline deviations

C.Zero computational resource overhead

D.Complete absence of false positive alerts in any network environment

E.Tailored baseline profiling specific to the organization's unique network traffic patterns

AnswersB, E

Anomaly-based detection models normal traffic and flags statistically significant deviations, so malicious behaviour matching no existing signature still triggers alerts. This satisfies the stem's zero-day benefit: signature-based systems only match known patterns, whereas baseline deviation catches novel attack activity.

Why this answer

Option B is correct because anomaly-based detection compares live traffic against a learned baseline of normal behavior, so deviations can reveal zero-day or previously unknown attacks for which no signature exists yet. Option E is correct because anomaly-based systems build profiles from the organization's own traffic, allowing detection thresholds and models to reflect that environment's unique protocols, hosts, and usage patterns. Options A, C, and D are not correct: anomaly-based detection does not name exact malware families instantaneously (that is signature matching), it typically consumes significant CPU/memory for baselining and statistical analysis, and it is well known for generating false positives when legitimate behavior deviates from the baseline.

Exam trap

CND often tests the misconception that anomaly-based detection eliminates false positives or has no overhead, when in reality it trades signature accuracy for baseline-driven detection that can be noisy and resource-intensive.

Practice this question →

16

Multi-Selecthard

An organization is establishing forensic readiness to ensure that digital evidence can be legally and technically sound during an investigation. Which THREE practices directly contribute to organizational forensic readiness? (Choose three)

Select 3 answers

A.Disabling audit logging on workstations to preserve local system storage space

B.Relying exclusively on volatile RAM analysis without retaining disk images or backups

C.Enforcing strict chain of custody documentation procedures for all acquired evidence

D.Implementing synchronized Network Time Protocol (NTP) across all network devices and hosts

E.Ensuring centralized, tamper-evident log archiving policies are actively maintained

AnswersC, D, E

Chain of custody documentation records every transfer and handling of evidence, preserving its integrity and admissibility. This directly satisfies the stem's requirement that evidence remain legally sound, since unbroken custody proves the artefacts were not altered before or during investigation.

Why this answer

Option C is correct because strict chain of custody documentation is a foundational forensic readiness practice: it records who handled each piece of evidence, when, where, and how, preserving its integrity and admissibility so the evidence can withstand legal scrutiny. Option D is correct because synchronized NTP across all network devices and hosts ensures consistent, correlatable timestamps, which is essential for reconstructing event timelines and for log evidence to be technically and legally credible. Option E is correct because centralized, tamper-evident log archiving preserves log integrity, prevents alteration or deletion, and supports the availability and authenticity of evidence needed during an investigation.

Option A is not correct because disabling audit logging destroys the very records needed for an investigation and undermines forensic readiness. Option B is not correct because relying exclusively on volatile RAM analysis discards persistent disk images and backups, losing evidence that survives reboots and weakening the overall forensic capability.

Exam trap

CND often tests the misconception that forensic readiness is only about tools — candidates overlook governance practices like chain of custody and NTP synchronization, or they pick options that sound efficient (RAM-only analysis) but actually destroy evidence.

Practice this question →

17

Multi-Selecteasy

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

Select 2 answers

A.AlienVault Open Threat Exchange (OTX)

B.Internal employee performance reviews

C.Proprietary zero-day broker feeds requiring signed NDA and high subscription fees

D.Classified military signals intelligence intercepts

E.National Vulnerability Database (NVD)

AnswersA, E

AlienVault OTX is a free, publicly accessible platform where researchers share indicators of compromise, making it a canonical OSINT source. Its open contribution model and lack of subscription or clearance requirements distinguish it from closed or proprietary feeds.

Why this answer

AlienVault Open Threat Exchange (OTX) is correct because it is a free, publicly accessible community platform where researchers share indicators of compromise (IOCs) such as IP addresses, domains, and file hashes, making it a classic OSINT source for network defenders. The National Vulnerability Database (NVD), maintained by NIST, is also correct because it publicly publishes CVE records, CVSS severity scores, and CPE applicability data that defenders use for vulnerability management without any restricted access. Internal employee performance reviews are not OSINT since they are private organizational records, not publicly available intelligence.

Proprietary zero-day broker feeds requiring an NDA and subscription fees are closed-source (commercial) intelligence, not open-source. Classified military signals intelligence intercepts are classified government intelligence, which by definition falls outside OSINT.

Exam trap

CND often tests the boundary between 'free/public' and 'commercial/classified' intelligence, tricking candidates into selecting paid broker feeds or internal data because they sound like legitimate threat sources — the key discriminator is whether the source is openly accessible without NDA, payment, or clearance.

Practice this question →

18

MCQmedium

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

A.Host-level containment

B.Network-level containment

C.Full enterprise quarantine

D.Application-level containment

AnswerB

Isolating an infected subnet severs network connectivity between that segment and the rest of the corporate network, which is precisely network-level containment. It blocks worm propagation across subnets without halting endpoint processes, distinguishing it from host-level or application-level containment.

Why this answer

Isolating an infected subnet from the rest of the corporate network is a network-level containment strategy because it restricts the blast radius at the network layer rather than on individual hosts or applications. This approach segments the network so the worm cannot spread laterally to other subnets while the team remediates the infected systems. It is a common early step in worm outbreak response.

Exam trap

CND often tests the distinction between containment scopes (host, network, enterprise, application), so the trap is choosing host-level containment when the action described affects an entire subnet rather than individual machines.

How to eliminate wrong answers

Option A is wrong because host-level containment involves isolating or shutting down individual infected machines, not an entire subnet. Option C is wrong because full enterprise quarantine would disconnect the entire organization from all networks, which is broader than isolating one subnet. Option D is wrong because application-level containment targets a specific application or service, not the network segment.

Practice this question →

19

MCQmedium

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

A.stats sum(bytes) by dest_ip

B.rex field=bytes max_match=1

C.table dest_ip, bytes

D.eval bytes_sum = sum(bytes)

AnswerA

The stats command aggregates events and, with sum(bytes) by dest_ip, totals outbound byte counts per destination address, producing the per-IP volumes the alert needs. This satisfies the stem's requirement to group abnormal outbound traffic by destination IP.

Why this answer

The stats command in Splunk is used for aggregating and summarizing data. Using 'stats sum(bytes) by dest_ip' calculates the total outbound bytes for each destination IP address, directly fulfilling the requirement. This is the standard SPL syntax for grouped aggregation.

Exam trap

The trap is confusing eval with stats—candidates may think eval can sum across events, but eval operates per-event, while stats is required for cross-event aggregation.

How to eliminate wrong answers

Option B is wrong because rex is a regex extraction command used to parse fields from raw events, not to aggregate data. Option C is wrong because table only displays selected fields in a tabular format; it does not perform any summation or grouping. Option D is wrong because eval is used to create or modify fields with expressions, but it cannot perform aggregation across multiple events—sum() is not a valid eval function for this purpose.

Practice this question →

20

MCQeasy

A threat hunter is searching for persistence mechanisms on a Windows system and needs to check Autoruns data. Which registry hive contains user-specific startup application entries?

A.HKEY_LOCAL_MACHINE

B.HKEY_CLASSES_ROOT

C.HKEY_PERFORMANCE_DATA

D.HKEY_CURRENT_USER

AnswerD

HKEY_CURRENT_USER stores per-user startup entries, including Run and RunOnce keys under the user's own profile. This satisfies the stem's requirement for user-specific persistence, since each logged-on account holds its own autorun configuration separate from machine-wide hives such as HKEY_LOCAL_MACHINE.

Why this answer

HKEY_CURRENT_USER (HKCU) stores the profile-specific configuration for the currently logged-on user, including per-user startup entries under paths like HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce. Because these keys are tied to the user's profile (NTUSER.DAT), they are the correct hive to inspect when hunting for user-scoped persistence. HKLM holds machine-wide autoruns that apply to all users, not user-specific ones.

Exam trap

CND often tests the distinction between machine-wide (HKLM) and per-user (HKCU) registry persistence, catching candidates who default to HKLM as the 'main' hive and overlook that user-specific autoruns live in HKEY_CURRENT_USER.

How to eliminate wrong answers

Option A is wrong because HKEY_LOCAL_MACHINE stores system-wide, machine-level configuration (e.g., HKLM\...\Run applies to all users), not user-specific startup entries. Option B is wrong because HKEY_CLASSES_ROOT is a merged view of file association and COM registration data (from HKLM\Software\Classes and HKCU\Software\Classes), not a persistence location for per-user startup programs. Option C is wrong because HKEY_PERFORMANCE_DATA is a volatile hive exposing performance counters via the registry API, not a storage location for autorun entries.

Practice this question →

21

MCQhard

An incident response team is performing disk forensics on an NTFS-formatted hard drive. The analyst needs to recover deleted files that were too large to fit in the Recycle Bin. Which internal NTFS metadata structure contains file record attributes including timestamps, permissions, and resident/non-resident data locations?

A.File Allocation Table (FAT)

B.Master File Table (MFT)

C.Superblock

D.Inode table

AnswerB

The MFT stores one file record per file, holding attributes such as $STANDARD_INFORMATION timestamps, $FILE_NAME, permissions, and resident or non-resident data run locations. Deleted files too large for the Recycle Bin retain their MFT entries, enabling recovery via that metadata.

Why this answer

The Master File Table (MFT) is the core NTFS metadata structure; it contains one file record per file and directory, storing attributes such as $STANDARD_INFORMATION (timestamps, permissions), $FILE_NAME, and $DATA (resident or non-resident data locations). When files are deleted, their MFT records are marked as unallocated but often remain intact, enabling forensic recovery of files too large for the Recycle Bin.

Exam trap

CND often tests filesystem-specific metadata confusion, so candidates pick inode or FAT structures that belong to other filesystems instead of recognizing the MFT as the NTFS per-file metadata store.

How to eliminate wrong answers

Option A is wrong because the File Allocation Table is the metadata structure for FAT12/16/32 file systems, not NTFS, and it lacks the rich attribute records (timestamps, permissions, resident data) that NTFS provides. Option C is wrong because the superblock is a Unix/Linux filesystem structure (ext2/3/4, XFS) that describes the filesystem as a whole, not per-file metadata on NTFS. Option D is wrong because the inode table is used by Unix-style filesystems (ext family) to store file metadata; NTFS uses MFT records instead, so inodes are not applicable to an NTFS volume.

Practice this question →

22

MCQeasy

An incident responder identifies a compromised workstation and determines that isolating the machine from the network is necessary. Which tool native to Windows allows an administrator to block all inbound and outbound network traffic except for pre-configured exceptions?

A.Disk Management

B.Device Manager

C.Windows Defender Firewall

D.Task Manager

AnswerC

Windows Defender Firewall enforces stateful packet filtering at the host level, letting you set default inbound and outbound block rules while permitting specific pre-configured exceptions. This satisfies the stem's requirement to isolate the compromised workstation from all network traffic except approved flows, without physically disconnecting it.

Why this answer

Windows Defender Firewall is the native Windows tool that can block all inbound and outbound traffic except for explicitly configured exceptions. An administrator can create rules to allow specific ports, IP addresses, or applications while blocking everything else, effectively isolating the workstation at the network layer. This is a common containment technique during incident response when full network isolation is required but some management or monitoring traffic must be permitted.

Exam trap

The trap here is that candidates may think of third-party EDR tools or network isolation features, but the question specifies a native Windows tool — Windows Defender Firewall is the only option that provides rule-based traffic blocking with exceptions.

How to eliminate wrong answers

Option A is wrong because Disk Management is a utility for managing disk partitions, volumes, and drives — it has no network filtering capability. Option B is wrong because Device Manager manages hardware devices and drivers, not network traffic. Option D is wrong because Task Manager shows running processes and resource usage but cannot block network traffic.

Only Windows Defender Firewall provides the rule-based inbound/outbound traffic filtering needed to isolate a host while allowing exceptions.

Practice this question →

23

Multi-Selecthard

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

Select 3 answers

A.Memory regions containing executable code that do not back to any file on disk (unbacked memory)

B.Standard file creation timestamps in the $MFT

C.Default Windows system wallpaper configuration settings

D.Thread start addresses pointing outside of the expected module image bounds

E.Memory regions with PAGE_EXECUTE_READWRITE (RWX) permissions allocated in non-system processes

AnswersA, D, E

Process hollowing unmaps the legitimate module's image and writes malicious code into the vacated region, so scanning for executable memory pages with no corresponding file on disk exposes the injected payload that no legitimate loader would create.

Why this answer

Option A is correct because process hollowing and similar injection techniques often leave executable memory regions that have no corresponding backing file on disk (unbacked memory), which is a strong indicator of injected code since legitimate executable pages normally map to a PE image on disk. Option D is correct because a thread's start address that falls outside the bounds of any loaded module image indicates the thread was created to execute injected code rather than legitimate module code, a hallmark of injection. Option E is correct because memory regions allocated with PAGE_EXECUTE_READWRITE (RWX) permissions in non-system processes are suspicious, as legitimate code pages are typically RX or read-only, and RWX allocations often host injected shellcode.

Option B is not relevant because $MFT file creation timestamps only reflect file system activity and do not reveal in-memory code injection. Option C is not relevant because wallpaper configuration settings have no bearing on detecting process injection.

Exam trap

CND often tests the specific memory and thread artifacts associated with process injection, and candidates may confuse them with general file system or configuration artifacts that are not relevant.

Practice this question →

24

Multi-Selecthard

An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)

Select 3 answers

A.Plaintext passwords extracted from HTTPS payload bodies

B.Raw ICMP echo payload strings

C.Server Name Indication (SNI) fields in the TLS Client Hello message

D.JA3 and JA3S TLS cryptographic handshaking fingerprints

E.X.509 digital certificate metadata (issuer, validity dates, self-signed status)

AnswersC, D, E

The SNI field in the TLS Client Hello is transmitted in cleartext before encryption begins, so inspecting it reveals destination hostnames even when payloads are opaque. This satisfies the requirement to identify anomalous encrypted channels without decryption, exposing domain-fronting or beaconing to suspicious destinations.

Why this answer

Option C is correct because the SNI field in the TLS Client Hello is sent in cleartext even when the rest of the session is encrypted, so the analyst can see which hostnames a client is contacting and flag anomalous or DGA-like domains. Option D is correct because JA3 (client) and JA3S (server) fingerprints are derived from the TLS Client Hello and Server Hello parameters (version, cipher suites, extensions, elliptic curves), letting the analyst detect malware families or non-browser TLS stacks even without decrypting traffic. Option E is correct because X.509 certificate metadata such as issuer, validity dates, and self-signed status is observable during the handshake and can reveal suspicious or internally generated certificates used by C2 or exfiltration channels.

Option A does not belong because HTTPS payload bodies are encrypted by TLS, so plaintext passwords are not directly extractable from captured traffic without decryption keys or a TLS-terminating proxy. Option B does not belong because raw ICMP echo payload strings are unrelated to TLS handshake anomalies and would not identify encrypted-channel exfiltration.

Exam trap

The trap is assuming that encrypted traffic yields no useful telemetry — candidates pick the plaintext password option because they think 'we need to decrypt,' but the exam expects knowledge that SNI, JA3/JA3S, and certificate metadata are visible without decryption.

Practice this question →

25

MCQhard

An incident response investigator is analyzing a Linux server compromised via a web shell. To determine when the web shell file was last accessed or modified, the investigator examines file timestamps. Which Linux command displays the complete file status including access, modification, and change (mtime, atime, ctime) times?

A.find / -name '*.php'

B.ls -la

C.stat

D.cat

AnswerC

stat reports full inode metadata, including access (atime), modification (mtime) and change (ctime) timestamps alongside permissions and ownership. This gives the investigator the complete timeline needed to establish when the web shell was accessed or altered.

Why this answer

The stat command displays detailed file metadata including all three timestamps: atime (last access), mtime (last content modification), and ctime (last inode/status change). This is exactly what an investigator needs to build a timeline of when a web shell was dropped, accessed, or altered. Unlike ls, stat shows full-precision timestamps and the inode change time, which is critical for forensic timeline reconstruction.

Exam trap

CND often tests whether candidates confuse ls -la with stat — ls shows only mtime by default, while stat is the only common command that surfaces atime, mtime, and ctime together.

How to eliminate wrong answers

Option A is wrong because find / -name '*.php' only locates files by name pattern and does not display any timestamp metadata. Option B is wrong because ls -la shows mtime by default and only one timestamp column, hiding atime and ctime unless specific flags like -u or -c are used, and even then only one at a time. Option D is wrong because cat simply outputs file contents to stdout and provides no metadata whatsoever.

Practice this question →

26

MCQeasy

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

A.Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

B.Defragment the partition to speed up future forensic analysis

C.Document the make, model, serial number, and sign an evidence custody form

D.Boot the drive in a live environment to check for rootkits

AnswerC

Recording make, model and serial number on a signed custody form establishes an unbroken, auditable chain of custody from the moment of seizure. This documents who handled the drive and when, preserving evidentiary integrity and admissibility; imaging or hashing alone cannot prove continuous control.

Why this answer

Documenting the make, model, serial number, and signing an evidence custody form is the immediate step required to establish and maintain chain of custody upon physical removal of the drive. This documentation creates the legal record of who had control of the evidence, when, and under what conditions, which is essential for evidentiary integrity in court.

Exam trap

CND often tests the order of forensic steps, and candidates may choose hashing first because it sounds technical, missing that chain of custody documentation must precede or accompany physical seizure to be legally valid.

How to eliminate wrong answers

Option A is wrong because while hashing is critical for integrity verification, it is typically performed after documentation and often in a forensic lab using a write blocker, not immediately upon physical removal. Option B is wrong because defragmenting a drive modifies data and destroys forensic artifacts, violating evidence preservation principles. Option D is wrong because booting the drive in a live environment alters timestamps, writes to disk, and can trigger malware, compromising the evidence.

Practice this question →

27

MCQeasy

A security analyst is reviewing alerts generated by an Endpoint Detection and Response (EDR) agent. The agent flags a process spawning cmd.exe with encoded arguments. Which phase of incident response involves triaging this alert to determine if it is a true positive?

A.Eradication

B.Recovery

C.Preparation

D.Detection and Analysis

AnswerD

Detection and Analysis covers alert triage, validating whether the encoded cmd.exe execution is a genuine compromise or benign. The EDR agent only generates the alert; analysts must investigate, correlate telemetry, and scope impact here. This phase directly satisfies the stem's requirement to determine true positive status before containment or eradication begins.

Why this answer

The Detection and Analysis phase of incident response involves monitoring alerts, validating whether they are true or false positives, and determining scope and impact. Triaging an EDR alert about cmd.exe with encoded arguments—a common living-off-the-land technique—falls squarely in this phase. Eradication and Recovery occur after a confirmed incident, and Preparation is the pre-incident readiness stage.

Exam trap

CND often tests the mapping of activities to incident response phases, catching candidates who confuse triage/validation (Detection and Analysis) with remediation steps (Eradication/Recovery) or pre-incident readiness (Preparation).

How to eliminate wrong answers

Option A is wrong because Eradication involves removing the threat (e.g., deleting malware, closing vulnerabilities) after an incident is confirmed, not triaging the initial alert. Option B is wrong because Recovery focuses on restoring systems and services to normal operation post-eradication. Option C is wrong because Preparation covers building incident response capabilities, playbooks, and training before any incident occurs.

Practice this question →

28

MCQhard

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

A.pass tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"Traversal"; content:"../"; http_client_body; sid:100001; rev:1;)

B.alert tcp any any -> $HOME_NET 80 (msg:"Directory Traversal Attempt"; content:"../"; http_uri; sid:100001; rev:1;)

C.alert ip any any -> any any (msg:"Directory Traversal"; uricontent:"../"; sid:100001; rev:1;)

D.log udp any any -> $HOME_NET 80 (msg:"Directory Traversal"; content:"../"; depth:2; sid:100001; rev:1;)

AnswerB

The `http_uri` modifier confines pattern matching to the normalised URI buffer, so `../` is detected only within the request path rather than anywhere in the packet payload. This satisfies the stem's requirement to inspect the URI component specifically, while the TCP header and port 80 correctly scope the rule to inbound HTTP traffic.

Why this answer

Option B is correct because it uses the proper Snort rule structure for detecting a payload pattern in HTTP traffic: an 'alert' action, TCP protocol, port 80 (HTTP), and the 'http_uri' buffer modifier to inspect only the URI component of the request. The 'content:"../"' matches the directory traversal string, and 'http_uri' ensures the match occurs specifically in the URI, which is where traversal attempts typically appear. This configuration accurately detects the attack without false positives from other parts of the HTTP request.

Exam trap

CND often tests the distinction between deprecated keywords like 'uricontent' and modern buffer modifiers like 'http_uri', as well as proper protocol and action selection for HTTP traffic.

How to eliminate wrong answers

Option A is wrong because it uses the 'pass' action, which allows traffic rather than alerting on it, and it inspects 'http_client_body' instead of the URI, missing traversal attempts in the URI. Option C is wrong because it uses the deprecated 'uricontent' keyword (replaced by 'http_uri' in Snort 2.9+), and it specifies 'ip' protocol instead of TCP, which is incorrect for HTTP traffic. Option D is wrong because it uses 'log' instead of 'alert', 'udp' instead of TCP (HTTP uses TCP), and 'depth:2' restricts the search to the first two bytes, which would not match '../' if it appears later in the payload.

Practice this question →

29

MCQhard

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

A.Exploitation

B.Command and Control

C.Actions on Objectives

D.Delivery

AnswerB

DNS tunnelling establishes an outbound channel for remote instruction, which maps directly to the Command and Control phase of Lockheed Martin's Cyber Kill Chain. The stem's constraint — attacker attempts to establish C2 — names that phase explicitly, so the alert should be classified there rather than at Delivery or Actions on Objectives.

Why this answer

In the Cyber Kill Chain, the Command and Control (C2) phase involves the attacker establishing a communication channel with the compromised system to control it remotely. DNS tunneling is a common method for C2, so this alert represents the Command and Control phase.

Exam trap

CND often tests the phases of the Cyber Kill Chain, and candidates may confuse Command and Control with Exploitation or Actions on Objectives, especially when the attack technique involves network traffic.

How to eliminate wrong answers

Option A is wrong because Exploitation is the phase where the attacker leverages a vulnerability to execute code, not establish C2. Option C is wrong because Actions on Objectives is the final phase where the attacker achieves their goals, such as data exfiltration, which occurs after C2 is established. Option D is wrong because Delivery is the phase where the attacker transmits the weaponized payload to the target, which precedes exploitation and C2.

Practice this question →

30

Multi-Selectmedium

A security analyst is hardening an enterprise network to support robust forensic readiness. Which THREE administrative or technical controls should be implemented to ensure successful post-incident investigations? (Choose THREE)

Select 3 answers

A.Disabling all system auditing to maximize storage capacity for business applications

B.Implementing centralized and write-once-read-many (WORM) log storage repositories

C.Allowing users local administrative privileges to troubleshoot their own workstations

D.Deploying Network Time Protocol (NTP) servers with synchronized timestamps across all devices

E.Establishing predefined procedures and tooling for volatile memory and disk acquisition

AnswersB, D, E

Centralised WORM repositories preserve log integrity by preventing alteration or deletion, even by administrators, satisfying the forensic readiness requirement for admissible, tamper-evident evidence. Unlike standard mutable storage, WORM enforces immutability at the storage layer, ensuring post-incident timelines remain trustworthy during investigation.

Why this answer

Option B is correct because centralized WORM log repositories preserve audit records in an immutable, tamper-evident form, ensuring log integrity and availability for post-incident analysis even if an attacker compromises individual hosts. Option D is correct because synchronized NTP timestamps across all devices provide a consistent, correlatable timeline, which is essential for reconstructing the sequence of events during an investigation. Option E is correct because predefined procedures and tooling for volatile memory and disk acquisition enable rapid, forensically sound evidence capture before volatile data (RAM, network connections, running processes) is lost.

Option A is wrong because disabling auditing destroys the very evidence needed for investigations and violates forensic readiness principles. Option C is wrong because granting users local administrative privileges increases the attack surface and lets insiders alter or delete evidence, undermining forensic integrity.

Exam trap

The trap here is confusing forensic readiness with general security hardening; candidates may select options that improve performance or convenience (like disabling auditing or granting admin rights) but actually destroy evidence or introduce risk.

Practice this question →

31

Multi-Selecthard

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Select 3 answers

A.HKEY_CLASSES_ROOT\.txt\DefaultIcon

B.HKEY_PERFORMANCE_DATA\CurrentPerformance

C.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

D.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

E.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

AnswersC, D, E

The HKLM Run key executes listed programs at system startup for all users, giving adversaries machine-wide persistence without requiring an active logon session. It satisfies the stem's auto-run persistence requirement, and its well-documented abuse makes it a standard forensic artefact to examine during compromise investigations.

Why this answer

Option C, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, is correct because this machine-wide Run key causes listed programs to execute automatically at system startup for all users, a classic autostart location abused for persistence. Option D, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, is correct because the per-user Run key launches listed programs at logon of that user, and it is frequently used since it often requires no administrative privileges. Option E, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, is correct because values such as Shell, Userinit, and Notify in this key are hijacked to execute malicious code during the logon process.

Option A, HKEY_CLASSES_ROOT\.txt\DefaultIcon, is not a standard autostart persistence location; it only defines the default icon for .txt files and does not trigger execution at boot or logon. Option B, HKEY_PERFORMANCE_DATA\CurrentPerformance, is a volatile performance-counter hive used for system metrics, not a persistence mechanism, so it does not belong.

Exam trap

CND often tests whether candidates can distinguish true auto-start extensibility points from unrelated registry hives, so the trap is picking a plausible-looking but non-executable key such as a file-association or performance-data location instead of the Run and Winlogon keys.

Practice this question →

32

MCQhard

An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?

A.windows.netstat

B.windows.dlllist

C.windows.pslist

D.windows.registry.printkey

AnswerA

windows.netstat scans the memory image for Windows kernel network structures, enumerating active TCP and UDP endpoints with their owning process IDs. It satisfies the stem's requirement to list sockets and connections from a captured image, unlike live-response tools such as netstat, which query the running host rather than offline memory.

Why this answer

In Volatility 3, the windows.netstat plugin enumerates network artifacts from a Windows memory image by walking the kernel's TCP/UDP endpoint and listener structures (e.g., tcpip.sys pools). It lists active connections, listening ports, and associated PIDs, which is exactly what an incident responder needs to identify command-and-control channels or exfiltration sockets. Volatility 3 uses a plugin naming convention of <OS>.<artifact>, so windows.netstat is the correct choice for Windows network sockets.

Exam trap

The trap is confusing process-listing plugins (windows.pslist) with network-listing plugins (windows.netstat) — candidates who memorize plugin names without understanding their artifact scope pick the wrong one.

How to eliminate wrong answers

Option B is wrong because windows.dlllist enumerates loaded DLLs per process, which is useful for detecting injected modules but does not show network sockets. Option C is wrong because windows.pslist lists active processes by walking the EPROCESS linked list — it shows PIDs and process names but no network connection data. Option D is wrong because windows.registry.printkey reads registry hive data from memory, which is useful for persistence analysis but unrelated to listing network sockets.

Practice this question →

33

Multi-Selecteasy

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

Select 2 answers

A.Potential operational downtime and business impact

B.The color of the Ethernet cables connected to the rack

C.The office desk location of the IT director

D.Need for evidence preservation (e.g., maintaining RAM state)

E.The brand name of the server manufacturer

AnswersA, D

Containment choices hinge on balancing threat neutralisation against service continuity. Assessing potential operational downtime and business impact lets defenders select proportionate isolation—such as segmenting the host versus full shutdown—so the compromised web server is contained without causing disproportionate harm to critical operations.

Why this answer

Option A is correct because selecting a containment strategy requires weighing the operational downtime and business impact of taking the compromised web server offline, since containment actions such as isolating the host, blocking ports, or shutting it down can disrupt critical services and must be balanced against the severity of the threat. Option D is correct because evidence preservation is a key containment consideration; volatile data such as RAM contents, running processes, and network connections can be lost if the server is powered off or rebooted, so defenders may choose network isolation over shutdown to preserve forensic artifacts. The remaining options are not relevant: Ethernet cable color (B), the IT director's desk location (C), and the server manufacturer's brand name (E) have no bearing on containment strategy selection.

Exam trap

CND often tests whether candidates can distinguish operational/forensic factors from irrelevant physical or organizational trivia — the trap is overthinking distractors that sound technical but have no bearing on containment.

Practice this question →

34

Multi-Selectmedium

An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)

Select 2 answers

A.It is hypothesis-driven, focusing on assumptions that adversaries are already inside the network

B.It is performed only after a major ransomware encryption event completes

C.It involves human-led, iterative searches through endpoint and network telemetry

D.It replaces network firewalls and endpoint protection agents completely

E.It relies exclusively on automated SIEM alerts to trigger response actions

AnswersA, C

Hypothesis-driven hunting assumes adversaries already reside inside the network, then tests that assumption through targeted searches. This contrasts with reactive SOC monitoring, which waits for alerts; the stem asks what differentiates proactive hunting, and this assumption-led approach is the defining characteristic.

Why this answer

Option A is correct because proactive threat hunting is fundamentally hypothesis-driven: hunters assume adversaries may already be present and form testable hypotheses (e.g., 'attackers are using living-off-the-land binaries for lateral movement') to guide their searches, rather than waiting for an alert. Option C is correct because threat hunting is a human-led, iterative process in which analysts manually and repeatedly query endpoint telemetry (EDR process trees, command lines) and network telemetry (NetFlow, DNS, proxy logs) to validate or refute hypotheses, refining the hunt as findings emerge. These two traits distinguish hunting from reactive SOC monitoring, which is alert-driven and typically triggered by SIEM correlation rules or IDS signatures after suspicious activity is detected.

Option B is wrong because hunting is proactive and occurs before or independent of a completed ransomware event, not only afterward. Option D is wrong because hunting complements, but does not replace, preventive controls such as firewalls and endpoint protection agents. Option E is wrong because exclusive reliance on automated SIEM alerts describes reactive monitoring, the very approach hunting is meant to augment.

Exam trap

CND often tests the distinction between proactive threat hunting and reactive SOC monitoring, and candidates may incorrectly associate threat hunting with post-incident activities or automated alerting.

Practice this question →

35

MCQeasy

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

A.extend

B.project

C.summarize

D.where

AnswerD

The where operator filters a table by a boolean predicate, returning only rows matching the condition. Applied to DeviceProcessEvents with FileName == "cmd.exe", it satisfies the stem's requirement to include only process creation events whose file name matches cmd.exe.

Why this answer

The `where` operator in KQL is the filtering operator — it returns only rows from a table that satisfy a given predicate, such as `DeviceProcessEvents | where FileName == 'cmd.exe'`. This is exactly the behavior required to include only rows where the file name matches 'cmd.exe'. It is the KQL equivalent of a SQL WHERE clause and is the standard operator used in Microsoft Defender for Endpoint advanced hunting queries.

Exam trap

The trap here is confusing row-filtering operators (`where`) with column-shaping operators (`project`, `extend`) or aggregation operators (`summarize`); candidates who skim often pick `project` because it sounds like 'selecting' data.

How to eliminate wrong answers

Option A is wrong because `extend` creates new calculated columns from existing data rather than filtering rows, so it cannot restrict output to matching file names. Option B is wrong because `project` selects, renames, or drops columns (a column-level operation) and does not filter rows by predicate. Option C is wrong because `summarize` performs aggregation (count, sum, avg, etc.) grouped by keys, producing summary rows rather than filtering raw events.

Practice this question →

36

MCQeasy

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

A.Nmap

B.MISP

C.Autopsy

D.Wireshark

AnswerB

MISP is an open-source threat intelligence platform purpose-built to structure, store and share IoCs such as file hashes and IP addresses in machine-readable formats, including STIX and its own MISP core format, enabling automated exchange between organisations.

Why this answer

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed to structure, store, and share IoCs in machine-readable formats like STIX and MISP JSON. It supports taxonomies, galaxies, and feeds that let ISACs and SOCs exchange indicators at scale. This makes it the correct answer for structuring and sharing threat intelligence.

Exam trap

CND often tests whether candidates can distinguish threat intelligence sharing platforms (MISP) from scanning, forensics, or packet analysis tools — the trap is picking a familiar security tool that does not handle IoC structuring or sharing.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning and host discovery tool, not a threat intelligence platform. Option C is wrong because Autopsy is a digital forensics platform for disk image analysis, not for sharing IoCs. Option D is wrong because Wireshark is a packet capture and protocol analysis tool, not a threat intelligence framework.

Practice this question →

37

MCQeasy

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

A.dd if=/dev/sdb of=/evidence.raw --hash=md5

B.ftk_imager --verify --md5 evidence.raw

C.volatility -f evidence.raw --hash

D.sha256sum evidence.raw

AnswerD

sha256sum produces a 256-bit SHA-2 digest of the evidence file; any later modification alters the hash, giving cryptographic proof of integrity. Recording this value at acquisition and recomputing it during investigation verifies the disk image remains unaltered, satisfying the forensic chain-of-custody requirement.

Why this answer

The sha256sum command computes a SHA-256 cryptographic hash of the specified file, producing a unique fixed-length digest that serves as a digital fingerprint. Any modification to the evidence file—even a single bit flip—will produce a completely different hash value, allowing an analyst to later re-hash the file and compare digests to prove integrity. SHA-256 is collision-resistant and widely accepted in forensic and legal contexts as a standard for evidence authentication.

Unlike MD5 or SHA-1, it has no known practical collision attacks, making it suitable for cryptographic proof.

Exam trap

CND often tests the misconception that any hashing algorithm (like MD5) or any tool with a 'hash' flag is sufficient for cryptographic proof, when in fact only a secure algorithm like SHA-256 and the correct command syntax provide legally defensible integrity verification.

How to eliminate wrong answers

Option A is wrong because dd does not have a --hash parameter; while dd can compute hashes via separate commands (e.g., md5sum), the syntax shown is invalid and MD5 is cryptographically broken due to collision vulnerabilities. Option B is wrong because ftk_imager is a forensic imaging tool, not a general-purpose hashing utility, and the --verify --md5 flags are not standard for generating a hash of an existing file; moreover, MD5 is unsuitable for cryptographic proof. Option C is wrong because volatility is a memory forensics framework, not a disk hashing tool, and the --hash parameter does not exist in its command-line interface for this purpose.

Practice this question →

38

MCQmedium

A CND analyst is deploying a centralized Security Information and Event Management (SIEM) solution. To enable proactive threat hunting and rapid incident detection across distributed network segments, what is the primary function of deploying forwarders or agents on endpoints?

A.To locally compress, encrypt, and forward normalized log telemetry to the central SIEM collector

B.To act as a stateful firewall blocking unauthorized inbound and outbound network packets on the host

C.To perform full disk encryption key escrow and manage endpoint certificate lifecycles

D.To automatically execute remediation scripts and isolate compromised endpoints without human intervention

AnswerA

Forwarders perform local normalisation, compression and encryption before shipping telemetry, so the central SIEM receives consistent, bandwidth-efficient data from every segment. This satisfies the distributed-collection constraint, enabling correlation and proactive hunting across the whole estate rather than per-segment silos.

Why this answer

Forwarders or agents on endpoints are designed to collect, normalize, compress, and encrypt log telemetry locally, then forward it to the central SIEM collector. This enables the SIEM to ingest data from distributed segments without requiring direct network access to each endpoint, supporting proactive threat hunting and rapid detection. The agent handles buffering during network outages and ensures data integrity in transit.

Exam trap

The trap is assuming the SIEM agent performs active security functions like blocking or remediation, when its primary role is telemetry collection and forwarding.

How to eliminate wrong answers

Option B is wrong because a stateful firewall blocking packets is a network security control, not the function of a SIEM forwarder; forwarders do not enforce traffic policy. Option C is wrong because full disk encryption key escrow and certificate lifecycle management are endpoint security management functions, typically handled by MDM or PKI systems, not SIEM agents. Option D is wrong because automated remediation and endpoint isolation are functions of SOAR or EDR platforms, not the log-forwarding role of a SIEM agent.

Practice this question →

39

MCQmedium

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

A.diskpart clean

B.dc3dd

C.chkdsk /f /r

D.sfc /scannow

AnswerB

dc3dd is a patched GNU dd variant that writes a bit-for-bit image while computing a hash in the same pass, satisfying the forensic requirement for verifiable integrity. Its native hashing options avoid the separate hashing step that plain dd would demand.

Why this answer

dc3dd is a forensically enhanced fork of GNU dd that creates bit-for-bit disk images while simultaneously computing cryptographic hashes (MD5, SHA-1, SHA-256) in a single pass, which is exactly what the question requires. It is purpose-built for incident response and forensic imaging, supporting progress reporting, split output, and hash verification without a second read of the source disk.

Exam trap

CND often tests whether candidates confuse destructive disk utilities (diskpart, chkdsk, sfc) with forensic imaging tools, causing them to pick a Windows repair command that would actually alter evidence.

How to eliminate wrong answers

Option A is wrong because diskpart clean wipes partition tables and destroys data — it is a destructive disk preparation command, not an imaging tool. Option C is wrong because chkdsk /f /r repairs file system errors and recovers bad sectors; it does not create images and can modify the disk, violating forensic soundness. Option D is wrong because sfc /scannow verifies and repairs Windows system files, which alters the disk and has nothing to do with imaging or hashing.

Practice this question →

40

MCQmedium

A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?

A.sdrop

B.reject

C.drop

D.alert

AnswerD

The alert action tells Snort to log and generate an alert when a packet matches the rule, while allowing the packet to continue. This satisfies the requirement to notify without blocking inbound traffic, unlike drop or reject.

Why this answer

The 'alert' rule action keyword in Snort generates an alert and logs the packet when a rule matches, without dropping or blocking the traffic. This is the default and most common action for intrusion detection mode. When Snort runs in IDS mode, 'alert' is the appropriate keyword to detect and notify without interfering with the packet flow.

Exam trap

CND often tests Snort rule actions by asking for detection without blocking — candidates pick 'drop' or 'reject' thinking they are more secure, forgetting that 'alert' is the non-blocking detection action and that drop/reject require inline IPS mode.

How to eliminate wrong answers

Option A is wrong because 'sdrop' silently drops the packet and generates no alert — it blocks traffic without notification, which is the opposite of what the analyst wants. Option B is wrong because 'reject' actively blocks the packet and sends a TCP reset or ICMP unreachable message back to the sender, which both blocks and notifies the source, not just alerts. Option C is wrong because 'drop' blocks the packet and logs it, but it still prevents the traffic from reaching its destination — the scenario requires no blocking.

Practice this question →

41

MCQmedium

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

A.Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged

B.Configuring automatic disk encryption using BitLocker with a TPM chip

C.Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

D.Enabling centralized syslog forwarding over encrypted TLS channels

AnswerA

Pre-staging LiME and enabling kernel crash dumps guarantees volatile RAM can be captured before reboot destroys it, satisfying the live kernel attack constraint. LiME loads as a kernel module, dumping memory directly to disk or network, while crash dumps preserve state on panic — both essential for forensic readiness.

Why this answer

Ensuring kernel crash dumps are enabled and pre-staging a trusted memory acquisition utility like LiME directly supports forensic readiness by allowing volatile RAM contents to be captured during a live kernel attack. This preserves critical evidence that would otherwise be lost on reboot or shutdown. The other options do not address volatile memory acquisition.

Exam trap

The trap is selecting controls that protect data at rest (encryption) or detect file changes (HIDS) instead of focusing on volatile memory acquisition, which is the specific requirement for forensic readiness during a live kernel attack.

How to eliminate wrong answers

Option B is wrong because BitLocker with TPM provides disk encryption at rest, which protects data on disk but does not capture volatile RAM contents. Option C is wrong because HIDS with file integrity monitoring detects changes to files but does not preserve memory contents. Option D is wrong because centralized syslog forwarding captures log data, not the full volatile memory state, and logs may not contain kernel-level attack artifacts.

Practice this question →

42

MCQhard

A security analyst is examining a memory dump from a compromised Windows 10 host. The analyst suspects that a malicious process injected code into a legitimate process. Which of the following memory analysis techniques is MOST effective for identifying injected code?

A.Listing all running processes and their parent-child relationships

B.Scanning for executable pages that are not backed by a file on disk

C.Analyzing the Windows event log for process creation events

D.Checking the digital signatures of loaded modules

AnswerB

Injected code often resides in memory regions that are executable but not mapped to a file on disk. By scanning for such pages, the analyst can identify anomalous code injections. This technique is highly effective because legitimate executables are typically backed by files, while injected code is often not.

Why this answer

Scanning for executable memory pages not backed by files on disk is the most effective technique because injected code typically resides in such regions. Other methods, such as process listing, signature checks, and event log analysis, may provide context but do not directly reveal in-memory code injection.

Exam trap

The trap here is relying on disk-based or event-based artifacts to detect memory-only threats, which can miss injected code entirely.

Practice this question →

43

MCQmedium

A security analyst is investigating a suspected malware outbreak on a domain controller. To ensure forensic integrity and maintain a proper chain of custody before powering down the machine, what is the correct sequence of volatility when acquiring volatile evidence using live response tools such as FTK Imager or LiME?

A.Running processes, hard disk storage, system memory (RAM), CPU registers

B.CPU registers and cache, routing tables and network connections, system memory (RAM), hard disk storage

C.Hard disk image, system memory (RAM), network connections, running processes

D.System memory (RAM), hard disk storage, running processes, CPU registers

AnswerB

Volatility order runs from most to least transient: CPU registers and cache first, then routing tables and network connections, then system memory, and finally hard disk storage. Capturing RAM before disk preserves evidence that vanishes on power-down, maintaining forensic integrity and chain of custody.

Why this answer

The order of volatility, from most volatile to least volatile, is: CPU registers and cache, routing tables and network connections, system memory (RAM), and then hard disk storage. This sequence ensures that the most perishable evidence is captured first before it is lost due to power-down or ongoing system activity. Option B correctly lists this order.

Exam trap

CND often tests the order of volatility by presenting plausible but reversed sequences, so candidates who memorize only 'RAM first' without knowing the full order (registers > network > RAM > disk) pick the wrong option.

How to eliminate wrong answers

Option A is wrong because it places running processes before CPU registers and omits cache, and it lists hard disk storage before system memory, which violates the order of volatility (disk is less volatile than RAM). Option C is wrong because it starts with hard disk image, which is the least volatile, and places network connections after RAM, reversing the correct order. Option D is wrong because it starts with RAM but then lists hard disk storage before running processes and CPU registers, which is incorrect since processes and registers are more volatile than disk.

Practice this question →

44

MCQhard

A CND analyst is conducting post-incident threat prediction after a recent breach. The analyst needs to identify which internal host initiated the most outbound connections to known malicious IP addresses over the past 72 hours to prioritize containment and predict future attack paths. Which data source and analysis technique should the analyst use?

A.Windows Security event logs aggregated in a SIEM, analyzed using a failed logon correlation rule.

B.Full packet capture (PCAP) from the DMZ interface, analyzed with Wireshark's Conversations view.

C.NetFlow records exported from core routers, analyzed with a top-talkers report filtered by destination IP reputation.

D.Endpoint Detection and Response (EDR) process telemetry, analyzed for suspicious parent-child process relationships.

AnswerC

NetFlow provides flow-level metadata including source IP, destination IP, ports, and byte counts, which is ideal for identifying internal hosts communicating with malicious external IPs. By correlating NetFlow with a threat intelligence feed of known malicious IPs, the analyst can rank internal hosts by outbound connection volume and frequency, directly supporting containment prioritization and threat prediction.

Why this answer

NetFlow provides scalable, flow-level visibility across the network without full packet capture overhead, making it the most efficient source for identifying internal hosts with high volumes of outbound connections to known malicious IPs. Correlating flow records with threat intelligence enables the analyst to prioritize containment and predict which hosts are most likely compromised or serving as pivot points.

Exam trap

The trap here is assuming that full packet capture or endpoint telemetry alone can provide the broad, retrospective network-wide view needed to rank internal hosts by malicious outbound connections.

Practice this question →

45

MCQeasy

An organization's Security Operations Center (SOC) receives an alert regarding an unusual outbound connection to a known command-and-control (C2) IP address. According to the NIST SP 800-61 Rev. 2 incident response lifecycle, which phase immediately follows the Containment, Eradication, and Recovery phase?

A.Preparation

B.Detection and Analysis

C.Post-Incident Activity

D.Threat Hunting

AnswerC

NIST SP 800-61 Rev. 2 defines four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity. The final phase follows recovery directly, covering lessons learned, evidence retention and report finalisation for the investigated C2 incident.

Why this answer

The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The question asks which phase immediately follows Containment, Eradication, and Recovery. According to the standard, Post-Incident Activity is the final phase, where lessons learned are captured and improvements are made to prevent future incidents.

Exam trap

CND often tests the exact sequence of the NIST SP 800-61 Rev. 2 incident response lifecycle, and candidates frequently confuse Post-Incident Activity with Threat Hunting or mistakenly think Detection and Analysis follows Containment.

How to eliminate wrong answers

Option A is wrong because Preparation is the first phase, occurring before an incident happens. Option B is wrong because Detection and Analysis is the second phase, which precedes Containment, Eradication, and Recovery. Option D is wrong because Threat Hunting is not one of the four phases in the NIST SP 800-61 Rev. 2 lifecycle; it is a proactive security activity that may occur during Preparation or Detection, but it is not the phase that follows Containment, Eradication, and Recovery.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Incident Detection Response And Threat Prediction questions.

Start 20-question session