Incident Detection Response And Threat Prediction practice questions

PUT /taxii2/objects/

Why it fails: PUT is not standard for retrieving TAXII collections.

POST /taxii2/collections/

Why it fails: POST is used for creating objects or submitting reports, not for querying collection metadata.

DELETE /taxii2/status/

Why it fails: DELETE is used for removing objects, which is not applicable here.

Eradication

Why it fails: Eradication removes malicious artifacts from systems.

Preparation

Why it fails: Preparation establishes policies and tools before an incident occurs.

Containment

Why it fails: Containment focuses on stopping the spread of the attack.

icmp.type == 8

Why it fails: icmp.type == 8 selects all echo requests regardless of payload length.

udp.length > 32

Why it fails: This filters UDP packets, not ICMP.

ip.proto == 6 && tcp.len > 32

Why it fails: ip.proto 6 represents TCP, not ICMP.

Autopsy

Why it fails: Autopsy is a graphical interface for Sleuth Kit disk forensics.

Cisco Firepower

Why it fails: Cisco Firepower is a network security gateway/firewall.

Volatility

Why it fails: Volatility is primarily a memory forensics framework rather than a native Linux live-system rootkit scanner.

Containment

Why it fails: Containment is a separate operational phase preceding eradication and recovery.

Vulnerability Assessment

Why it fails: Vulnerability assessment is part of preparation or remediation, not a formal post-incident sub-phase.

System Eradication

Why it fails: Eradication is performed prior to recovery, well before post-incident review.

T1078 - Valid Accounts

Why it fails: T1078 refers to the use of existing valid credentials rather than the brute force mechanism used to obtain or leverage them.

T1021 - Remote Services

Why it fails: T1021 covers techniques used to log into internal remote services (like SSH, RDP, SMB) once inside the network boundary.

T1595 - Active Scanning

Why it fails: T1595 is a Reconnaissance tactic used to gather information prior to targeting, rather than active exploitation.

Attack Pattern Object

Why it fails: Attack Pattern objects describe adversary behaviors and techniques based on frameworks like MITRE ATT&CK.

Campaign Object

Why it fails: A Campaign object groups multiple malicious incidents and threat activities over a specific timeframe.

Threat Actor Object

Why it fails: A Threat Actor object represents individuals or groups posing a threat, not technical observable data.

High volume of failed connection attempts to random internal IP addresses

Why it fails: P2P botnets may scan for peers, but a high volume of failed connections to random internal IPs could also indicate worm behavior or network scanning. This is not a specific indicator of P2P botnet communication, which typically uses a peer list and maintains connections rather than random scanning.

Connections to known botnet C2 domains from threat intelligence feeds

Why it fails: Known C2 domains are useful for centralized botnets, but a custom P2P botnet may not use domain names and instead use IP addresses or a decentralized peer list. Threat intelligence may not have the specific peers. Thus, this indicator is less reliable for detecting a custom P2P botnet.

Large outbound data transfers to multiple geographically diverse IP addresses

Why it fails: While data exfiltration can occur, P2P botnets typically communicate in a distributed manner with many peers, not necessarily large transfers to diverse IPs. Large transfers might indicate other threats like data theft, but for P2P botnet detection, the pattern is more about peer discovery and command propagation, not bulk data movement.

rex field=bytes max_match=1

Why it fails: rex extracts fields from raw text using regular expressions and performs no aggregation or grouping. It tempts because parsing an unstructured bytes value into a field is a genuine prerequisite step when the byte count is not already a searchable field.

table dest_ip, bytes

Why it fails: table only formats and selects existing fields; it neither sums bytes nor groups rows by dest_ip. It tempts because table is the natural command for producing a readable per-destination listing, which suits ad-hoc reporting rather than threshold aggregation for alerting.

eval bytes_sum = sum(bytes)

Why it fails: eval computes per-event expressions and cannot sum across events; sum() there operates on a single event's fields. It tempts because eval is the command for creating calculated fields, which is correct when deriving a value within each event rather than totalling many.

Configuring automatic disk encryption using BitLocker with a TPM chip

Why it fails: BitLocker with a TPM encrypts data at rest on disk and does nothing to capture volatile RAM before it is lost. It is tempting because full-disk encryption is a core forensic-readiness control, and it would be correct for protecting data confidentiality if a server were physically stolen.

Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

Why it fails: A HIDS monitors file integrity and alerts on changes; it does not dump or preserve volatile memory during a live kernel attack. It is tempting because host monitoring supports detection and evidence gathering, and it would be correct for detecting unauthorised file modifications on the database servers.

Enabling centralized syslog forwarding over encrypted TLS channels

Why it fails: Centralised syslog forwarding ships log events off-host over TLS but never acquires a memory image, so volatile RAM evidence is not preserved. It is tempting because remote logging is central to forensic readiness, and it would be correct for retaining tamper-resistant audit trails after a compromise.

Heuristic detection

Why it fails: Snort matched a literal signature string, which is signature or pattern-based detection, not heuristic analysis of behavioural anomalies. Heuristic detection is tempting because it also identifies attacks, but it flags deviations from normal behaviour rather than known payload patterns.

Behavioral analytics detection

Why it fails: The alert came from a static rule matching a known SQL injection string, which is signature-based detection; behavioural analytics instead models user or entity activity over time to flag deviations. Behavioural analytics would be the right choice for spotting compromised credentials or unusual data access patterns, not literal payload matching.

Anomaly-based detection

Why it fails: Snort matched a literal byte pattern from its rule set, which is signature-based detection; anomaly-based detection instead baselines normal traffic and flags statistical deviations. Anomaly-based engines would suit detecting novel SQL injection variants with no known signature, but they cannot explain a specific 'SELECT * FROM users WHERE' string match.

Security log, Event ID 4688

Why it fails: Event ID 4688 records process creation, capturing the command line that launched powershell.exe but not the script block content executed within it. It is the correct source when tracing process lineage and parent-child relationships during an investigation.

System log, Event ID 7045

Why it fails: System log Event ID 7045 records service installation, capturing the service name, image path and account — not PowerShell script block text. It is tempting because malicious LotL activity often installs a service for persistence, so 7045 can reveal attacker tooling. PowerShell script block content instead appears in Microsoft-Windows-PowerShell/Operational, Event ID 4104.

Microsoft-Windows-PowerShell/Operational, Event ID 4103

Why it fails: Event ID 4103 logs PowerShell pipeline execution details, not the full script block text; that content appears in Event ID 4104 on the same channel. 4103 is useful for module and parameter-level auditing when reconstructing command activity.

Host-level containment

Why it fails: Isolating a subnet segments at the network layer, so host-level containment — endpoint isolation, process termination or host firewall rules on individual machines — cannot satisfy it. Host-level containment is tempting because it directly stops an infected endpoint spreading laterally, and would be correct when only specific hosts, not an entire subnet, require quarantine.

Full enterprise quarantine

Why it fails: Full enterprise quarantine isolates the entire corporate network, not one subnet, so it exceeds the scope the team chose. It is the right strategy when a worm has spread enterprise-wide and no trusted segment remains.

Application-level containment

Why it fails: Application-level containment targets a specific service or process, leaving the subnet's other traffic flowing, so it does not isolate the infected subnet. It suits containing a single vulnerable application while the host network stays usable.

extend

Why it fails: The extend operator adds or replaces calculated columns; it cannot restrict rows by filename. Filtering rows on a condition such as FileName == 'cmd.exe' requires the where operator. Extend is tempting because it appears in most KQL queries, but its purpose is projecting new columns, not row selection.

project

Why it fails: project selects and reorders columns, returning every row and so never restricting output to cmd.exe events. It is tempting because it narrows visible fields, and would be correct when trimming a result set to specific columns after filtering has already occurred.

summarize

Why it fails: summarize aggregates rows into grouped calculations, removing individual process-creation records rather than filtering them. It is tempting because it appears in most hunting queries, and would be correct when counting cmd.exe executions per device instead of listing matching rows.

Contain the compromised host to prevent lateral movement

Why it fails: Containment limits spread and preserves evidence, but it follows detection and analysis in NIST SP 800-61. The first phase is preparation, then detection and analysis; the failed logins and root login must be analysed first. Containment suits confirmed, scoped incidents, not initial triage.

Perform post-incident lessons learned activities

Why it fails: Post-incident lessons learned closes the lifecycle, capturing improvements after recovery. NIST SP 800-61 sequences it last, after detection and analysis, containment, eradication and recovery. It fits mature incidents already resolved, not the first action on a suspected SSH compromise.

Eradicate the malware from the impacted SSH server

Why it fails: Eradication removes malware and closes the attack vector, which occurs after detection and containment. NIST SP 800-61 orders preparation, detection and analysis, containment, eradication, recovery, then post-incident activity. Eradication fits once the intrusion is scoped and isolated, not as the opening phase.

Event ID 1102

Why it fails: Event ID 1102 records the audit log being cleared, which indicates anti-forensic activity rather than the authentication itself. It is tempting because attackers clear logs after moving laterally, but the event that evidences NTLM hash authentication is 4624 with logon type 3 and NTLM specified.

Event ID 4698

Why it fails: Event ID 4698 records a scheduled task being created, which is persistence, not authentication. It is tempting because scheduled tasks are common in lateral movement chains, but the correct ID for NTLM hash authentication is 4624 with logon type 3 and NTLM in the authentication package field.

Event ID 4720

Why it fails: Event ID 4720 logs a user account being created, which is account manipulation rather than authentication. It is tempting because attackers do create accounts during lateral movement, but detecting Pass-the-Hash requires examining 4624 logon events showing NTLM authentication with logon type 3.

HKEY_LOCAL_MACHINE

Why it fails: HKEY_LOCAL_MACHINE holds machine-wide Run keys applying to all users, not user-specific startup entries. It is tempting because it is the primary hive for system-wide persistence, and would be correct when hunting autoruns that execute for every account on the host.

HKEY_CLASSES_ROOT

Why it fails: HKEY_CLASSES_ROOT stores file-extension and COM class registration mappings, not per-user startup entries. It is tempting because it is a frequently accessed hive containing application configuration, but Autoruns user-specific persistence lives under HKEY_CURRENT_USER, specifically the Run keys.

HKEY_PERFORMANCE_DATA

Why it fails: HKEY_PERFORMANCE_DATA exposes performance counters via the registry API, not startup entries; user-specific Autoruns data lives in HKEY_CURRENT_USER Run keys. It is tempting because it is a genuine registry hive and appears in registry listings, but it would be the correct choice only when collecting performance metrics.

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Why it fails: Hashing documents the drive's state but does not itself establish custody; the immediate step is write-blocking and documenting transfer. Hashing is tempting because it verifies integrity, and would be correct when validating an image after acquisition rather than as the first chain-of-custody action.

Defragment the partition to speed up future forensic analysis

Why it fails: Defragmentation rewrites file clusters and timestamps, destroying the original bit-level layout that forensic examination depends on. It is tempting because defragmentation is a routine maintenance task that improves disk read performance, and would be correct when optimising a healthy workstation rather than preserving seized evidence.

Boot the drive in a live environment to check for rootkits

Why it fails: Booting the drive modifies timestamps, logs and memory-resident artefacts, destroying evidentiary integrity. It is tempting to quickly check for rootkits, but the immediate step is write-blocking and imaging the drive so the original remains unaltered for chain of custody.

Exploitation

Why it fails: Exploitation is the phase where the attacker leverages a vulnerability to execute code on the target. Establishing DNS-tunnelled C2 occurs afterwards, in the Command and Control phase, so this option names the preceding stage rather than the one the SIEM alert represents.

Actions on Objectives

Why it fails: Actions on Objectives covers the attacker achieving their goal, such as exfiltration or data destruction, after C2 is established. DNS-tunnelled C2 itself sits in the Command and Control phase, so this option describes the subsequent stage rather than the activity the alert detected.

Delivery

Why it fails: Delivery is the transmission of the weaponised payload to the victim, such as a phishing email or malicious USB. DNS-tunnelled C2 happens after compromise, in the Command and Control phase, so this option describes the earlier stage rather than the activity alerted on.

As a confidence value assigned to the intelligence report

Why it fails: Infrastructure is one of the Diamond Model's four core vertices, describing physical or logical assets such as servers and domains, not a confidence rating. It is tempting because confidence metadata accompanies intelligence reporting, but that is a separate analytic property, not a Diamond vertex.

As an external social-political requirement

Why it fails: Social-political requirements sit in the Meta-features axis, capturing external pressures shaping an adversary's operations. Infrastructure is a core Diamond vertex covering the physical and logical assets (servers, domains, IPs) used to deliver and control activity. Meta-features would be correct when classifying contextual drivers rather than hosting assets.

As a meta-feature used exclusively for tracking timestamps

Why it fails: Timestamps belong to the Meta-features axis, which records temporal, kill-chain and phase data about an event, not adversary assets. Infrastructure is itself a core Diamond vertex describing physical or logical C2, staging and exfiltration resources. Meta-features would be the right classification when logging when an intrusion phase occurred.