CCNA Incident Response Questions

Monitoring for reinfection verifies that eradicated threats have not returned after systems are restored to production. It satisfies Recovery's requirement to confirm normal service while detecting residual compromise, closing the loop before the incident is formally declared resolved.

Volatility parses raw memory images, reconstructing process lists, injected code regions and network artefacts that disk-only tools miss. It identifies code injected into legitimate processes, which is precisely what the suspicious PowerShell script's in-memory behaviour requires.

The Incident Review dashboard surfaces correlated notables and displays their associated MITRE ATT&CK annotations, letting you confirm the technique mapped to the failed-login-then-success pattern. It satisfies the stem's requirement to verify ATT&CK mapping directly within Splunk Enterprise Security, rather than pivoting to separate analytic or intelligence views.

Volatility is an open-source framework that extracts digital artefacts such as processes, network connections, and injected code from memory captures. It satisfies the requirement for forensic memory analysis by parsing raw RAM images across multiple operating system profiles.

Blocking outbound traffic to the identified C2 address severs the callback channel at the network layer, immediately halting beaconing without disrupting other legitimate egress traffic, which satisfies the containment requirement for this specific external destination.

JA3 and JA3S are fingerprints derived from the TLS ClientHello and ServerHello packets. They can identify the client and server applications based on their TLS configuration, such as cipher suites and extensions. Malware often uses unique or default TLS libraries, resulting in distinct JA3 hashes. By comparing the fingerprint to known malicious or legitimate applications, the analyst can determine if the traffic is likely C2 without decrypting the payload. This method is passive and does not disrupt the session.

TXT records carry arbitrary attacker-controlled text, so malware encodes command-and-control instructions inside them and exfiltrates data via DNS queries that blend with legitimate traffic. Their high payload capacity and tolerance of unusual strings make TXT the record type most commonly abused for DNS tunnelling.

Removing the threat from the environment is precisely what eradication achieves, eliminating malware, compromised accounts and persistence mechanisms so the adversary loses their foothold. This satisfies the stem's requirement for the phase's primary goal, distinguishing it from containment, which merely limits spread, and recovery, which restores normal operations afterwards.

Setting status to 'Closed' with resolution code 'False Positive' satisfies the triage requirement to document the alert's disposition accurately. The resolution code preserves the reason for closure, enabling trend analysis and tuning of detection rules, while the closed status removes the alert from the active queue so analysts focus on genuine incidents.

Physical memory is the most volatile evidence and must be captured before any other action that could alter system state. Tools like WinPmem or Magnet RAM Capture are designed for live memory acquisition and preserve forensic integrity. Isolating the network first or running other commands would change memory contents, violating the order of volatility and potentially destroying critical artifacts such as encryption keys or injected code.

Training personnel belongs to Preparation because readiness depends on pre-incident capability building, not live containment or eradication. It satisfies the stem's phase constraint by ensuring analysts, responders and stakeholders hold the skills, roles and escalation knowledge needed before an incident occurs, alongside plan development, tooling and communication channels.

Isolate device severs the workstation's network connections except to Defender for Endpoint, containing lateral movement and exfiltration while preserving analyst remote access for investigation. This satisfies the requirement to isolate an infected endpoint during a suspected malware incident.

A war room centralises real-time communication and coordination, satisfying the stem's requirement for managing a major incident. By co-locating responders and decision-makers, it removes communication delays and ambiguity, enabling rapid, synchronised action under a unified command structure — the defining purpose distinguishing it from routine ticketing or post-incident review.

Post-Incident Activity reviews what occurred, documents root cause and response effectiveness, and produces recommendations that strengthen future detection and containment. This directly fulfils the phase's purpose of capturing lessons learned to improve the organisation's incident response capability.

DNS tunneling for C2 involves encoding data in DNS queries and responses to bypass network security controls. Attackers use long, random subdomains to carry encoded commands or exfiltrated data, and TXT records are often used to return data because they can hold more information. This pattern is a classic indicator of DNS tunneling, where the DNS protocol is abused as a covert channel.

The incident response log chronologically records every action, decision and timestamp during handling, providing the evidentiary trail auditors and legal teams require. Other documents, such as the final report or playbook, summarise or guide rather than capture contemporaneous actions.

Deleting the web shell removes the attacker's persistence mechanism, while rotating credentials invalidates any harvested passwords or tokens. Together these actions close the access vector the intruder used, satisfying the stem's requirement to prevent further access after identification.

Cloud storage uploads traverse TCP 443, so HTTP/HTTPS proxy logs record the destination host, URL, bytes transferred and session duration, exposing the large outbound volumes characteristic of exfiltration to services such as Dropbox or Google Drive.

Verifying the alert and scoping the incident confirms whether the detection is a true positive and establishes affected assets, accounts and blast radius. This satisfies the high-priority ticket's demand for immediate triage before containment or eradication, ensuring subsequent response actions target the actual compromise rather than an unconfirmed alert.

Physical memory is highly volatile and contains running processes, network connections, and encryption keys that vanish on reboot. Capturing RAM first aligns with the order of volatility and preserves ephemeral evidence like the beaconing process and its C2 configuration. Waiting even minutes risks losing critical artifacts if the malware has a kill-switch or the system crashes.

VPN providers publish known exit-node IP ranges, so matching the observed source IP against threat intelligence feeds of those ranges reveals whether traffic originated from a commercial VPN, undermining the attacker's IP-hiding attempt and supporting attribution.

After containment, the NIST lifecycle moves to eradication, where the analyst removes malware, eliminates the root cause, and cleans affected systems. This phase ensures the threat is fully removed before recovery begins, making it the correct next step in the sequence for this malware outbreak.

Mentioning the security manager in the Work notes triggers ServiceNow's native notification engine, which routes an email or in-platform alert directly to that user's account. This satisfies the escalation requirement without altering assignment, state, or priority fields, keeping the ticket's audit trail intact while ensuring the manager is notified.

Online URL analysis services like URLScan.io and VirusTotal allow analysts to submit URLs and receive detailed reports without exposing the corporate network. These services use sandboxed environments to visit the URL, capture screenshots, and analyze redirects, scripts, and associated files. They also provide community reputation data. This method is safe, efficient, and provides valuable threat intelligence, making it the best choice for analyzing a suspicious URL.

Registry Run keys, under HKCU or HKLM Software\Microsoft\Windows\CurrentVersion\Run, cause Windows to launch a specified program automatically at each user logon or system start. This satisfies the persistence requirement by surviving reboots without further attacker interaction, and requires only registry write access rather than a scheduled task or service installation.

AWS CloudTrail records S3 data and management API activity, including the identity, timestamp and source of each bucket request. Consulting its event history satisfies the stem's requirement to review API calls made to the bucket during triage.

A suspicious sender address is a primary phishing indicator: mismatched domains, spoofed display names or lookalike characters reveal deception attempts. Monitoring it lets analysts correlate the sender against known-bad lists and block the campaign's origin.

Recording each affected host's current status gives responders the live containment picture: which systems are isolated, powered off, or still compromised. This satisfies the report's requirement to document containment progress, enabling stakeholders to verify that no threat remains active before recovery begins.

A forensic image creates a bit-for-bit copy of the disk, preserving all data including deleted files, slack space, and metadata. This is essential for legal proceedings and detailed analysis. Performing this before remediation ensures that no evidence is altered or destroyed. The image can later be analyzed without touching the original, maintaining chain of custody and allowing for verification via hashing.

Business impact determines how much revenue, productivity or reputation is affected, directly driving whether an incident is rated low, medium or critical. It is one of the three factors, alongside data sensitivity and affected scope, used to assign severity.

A sandboxed or isolated browser environment contains any malicious payload the link delivers, preventing compromise of the investigator's host system. This satisfies the phishing investigation constraint by allowing safe observation of redirects, drive-by downloads and credential-harvesting pages without exposing production credentials or data.

Windows Security logon events (4624, 4625, 4648) record logon type, source workstation and account, exposing pass-the-hash or remote interactive logons that reveal lateral movement across hosts. This directly satisfies the stem's requirement to detect movement between systems, which firewall or application logs cannot show.

Ransomware families usually leave a ransom note in each encrypted directory or on the desktop. These notes often contain the variant name, instructions for payment, and sometimes a unique identifier or onion address. This information is critical for identifying the specific ransomware strain and checking for known decryption tools. The note is a high-value, easily accessible artifact that can quickly guide the investigation and response.

WinPmem is a reliable tool for capturing physical memory on Windows systems without requiring a reboot or shutdown. Capturing memory first preserves the most volatile evidence, including running processes, network connections, and potentially malicious code. The server remains operational, minimizing disruption to critical services. This aligns with the order of volatility, where memory is more volatile than disk.

Command and Control exists so compromised systems can receive instructions and exfiltrate results; the channel must remain persistently available across the intrusion. Maintaining persistent communication satisfies that requirement, distinguishing C2 from one-off actions such as Initial Access or Execution.

Volatile memory holds encryption keys, running processes and unflushed data that a reboot would destroy, hampering forensic analysis and recovery. Disconnecting the network first isolates the host, blocking lateral spread and command-and-control traffic, while preserving that volatile evidence for investigation.

This registry key contains configuration for Windows services. Malware can create malicious services to run with high privileges and start automatically at boot. Services are a powerful persistence mechanism because they can run in the background without user interaction. Analysts should examine this key for suspicious service names, unusual binary paths, or recently modified entries. It is a common location for advanced malware and rootkits.

Inadequate logging visibility extends dwell time because undetected malicious activity continues unobserved; without sufficient telemetry, analysts cannot identify the initial compromise, so the gap between intrusion and discovery widens, directly satisfying the stem's dwell-time factor.

NetFlow records provide summarized information about IP traffic flows, including source and destination IPs, ports, protocol, and byte counts. By analyzing outbound flows from the database server, the analyst can identify unusually large data transfers, which may indicate exfiltration. This method is efficient and does not require full packet capture, making it suitable for high-volume environments. It directly addresses the need to detect large outbound transfers.

IOCs are forensic artefacts such as hashes, IPs or registry keys that confirm malicious activity occurred. They let analysts validate that an incident is genuine and enumerate every affected host or account, directly satisfying the requirement to validate and scope the threat.

Recording affected systems and users establishes incident scope, letting responders prioritise containment and identify lateral movement. Without this, the ticket cannot drive triage or notification, making it critical alongside the initial detection time and symptoms.

Detection and Analysis covers identifying an incident's type and scope, satisfying the stem's requirement. This phase uses indicators, log correlation and triage to determine what occurred and how far it spread, before containment. It maps directly to NIST SP 800-61's detection and analysis stage, where incident validation and scoping occur.

Identifying what went well captures successful actions and effective responses during an incident, forming part of the Lessons Learned review. It satisfies the process requirement by documenting strengths so they can be repeated in future incident handling.

Event ID 4698 is logged by Windows when a scheduled task is registered, recording the task name, creator and creation time. Filtering these events to the last 24 hours directly satisfies the stem's requirement to identify tasks created recently, unlike task XML files or registry keys that show current state only.

Falcon's Process Tree view reconstructs the full ancestry of a detection, showing each parent-child relationship from the initiating executable down to the suspicious file. This exposes the parent process needed to judge whether the detection is malicious.

Get-SmbSession queries the SMB server's active session table, listing connected clients, user names and originating IP addresses. This directly satisfies the stem's need to view active SMB sessions between the two workstations during lateral movement analysis.

The Incident Response Plan defines severity classifications, escalation routes and contact trees, so it specifies who notifies whom and through which channel during a high-severity event. Communication paths are procedural, not technical, so no log or monitoring tool replaces it as the first reference.

Authentication logs reveal when and from where the stolen credentials were used, establishing the attacker's access timeline and affected systems. They help determine the scope of compromise and whether additional accounts or resources were accessed, making them critical for the incident report.

The bytes_sent field records the byte count transmitted from the internal host to the destination address, directly quantifying outbound transfer volume per connection. Filtering on it isolates the largest flows to the external IP, satisfying the requirement to identify exfiltration volume rather than connection counts or packet totals.

Capturing memory first preserves volatile data such as running processes, network connections and encryption keys that vanish on shutdown or reboot. Imaging the disk afterwards still captures persistent evidence, and the order avoids altering RAM contents through disk-write activity.

WHOIS records expose the domain's creation date, which directly answers the registration-timing requirement in the stem. Unlike DNS, which returns current resolution data, or passive DNS, which logs historical resolutions, WHOIS holds registrar-level registration metadata including creation and expiry dates, letting you establish when the malicious domain first existed.

netstat -tulnp lists TCP and UDP listening sockets with numeric ports and, via the -p flag, the owning process ID and program name. This maps the rogue process to its associated network socket, identifying its listening or established connections.

Patching the underlying vulnerability removes the initial infection vector, satisfying the eradication requirement to eliminate the root cause rather than merely containing symptoms. Without remediation, re-infection recurs from the same exploited flaw. This action belongs to eradication, not recovery, because it prevents the malware's reintroduction before systems return to production.

VirusTotal submits the hash to dozens of antivirus engines and reputation feeds simultaneously, returning aggregated detections without executing the file. This multi-engine correlation gives far stronger verdict confidence than any single-vendor scanner or sandbox lookup.

Event ID 4769 is logged on domain controllers when a Kerberos service ticket is requested. In a Kerberoasting attack, an adversary requests TGS tickets for service accounts and extracts the encrypted portion for offline cracking. Analyzing 4769 events for RC4 encryption type (0x17) and unusual service names helps confirm the attack. This event directly corresponds to the TGS request behavior observed in the alert.

Senior management needs to gauge severity and prioritise resourcing, so the notification must quantify operational, financial and reputational damage. Without a business impact assessment, executives cannot judge whether the incident warrants escalation, crisis-team activation or regulatory disclosure, making this element essential for informed decision-making.