CCNA Data Analysis Questions

DLL side-loading is a specific ATT&CK technique, so analysis must first determine the tactic it serves, then map to the precise Technique ID. This satisfies the stem's requirement for the analytical technique that correctly places the observation within the ATT&CK matrix.

Threat modelling translates identified threats and their likelihood into concrete controls, producing security requirements proportionate to the application's risk profile. This satisfies the stem by ensuring requirements are derived from modelled threats rather than applied generically.

Regular, low-volume, unidirectional UDP traffic to one external host at a fixed interval is a classic beaconing signature, since implants frequently poll their controller on a timer and receive little or no response payload. The small packet size and long duration further reduce the chance this is normal user activity. Treating it as a lead for endpoint and DNS analysis is the proportionate next step rather than assuming benign or confirmed compromise.

Pivoting on hosting infrastructure lets you group indicators that share an ASN or netblock, revealing which clusters are adversary-specific versus commodity CDN noise. By filtering clusters that also contain non-targeted victim domains, you remove indicators that lack discriminative value for this targeting question. This preserves the analytic integrity of the remaining data set before you assess consistency of targeting.

Damage quantifies the potential harm an exploited vulnerability could inflict, covering data loss, service disruption and financial impact. Within DREAD's five scoring axes — Damage, Reproducibility, Exploitability, Affected users and Discoverability — it is the impact dimension, directly satisfying the stem's request for what the 'D' denotes.

Enrichment adds contextual metadata like geolocation, WHOIS, and reputation scores to IOCs, enabling analysts to judge relevance, severity, and urgency. This helps prioritize which indicators to block or investigate first. For a financial firm, understanding the source and reputation of an IOC is critical before automated blocking, reducing business impact and false positives.

The Z-score expresses how many standard deviations each timestamp lies from the distribution mean, giving a normalised threshold for judging whether an observation is statistically unusual. Applying it to the timestamp distribution identifies which outliers are significant enough to justify revising threat modelling.

Directory service authentication records tie an account to the client address that requested the ticket or bind, providing an independent view of the same movement. When host logs are incomplete or cleared, these records often preserve the account-to-source mapping. Together with endpoint logon events they corroborate the direction and sequence of lateral authentication.

Tunnelling exfiltration data inside DNS queries or HTTP/S requests blends with permitted traffic, so volume and payload inspection reveal misuse. This satisfies the stem's anomaly criterion because the protocol itself is expected, but its unexpected purpose and payload pattern are not.

Pivot tables enable analysts to quickly summarize and cross-tabulate large datasets, making it easier to spot trends, outliers, and relationships between variables like source IP and event type. This is essential for threat hunting and incident analysis, as it helps prioritize investigations and identify anomalies efficiently.

A cryptographic hash like SHA-256 serves as a unique fingerprint for a file. It allows security tools to identify the exact file by comparing hashes, enabling detection, blocking, and sharing of threat intelligence. Unlike filenames or other attributes, hashes are highly specific and resistant to tampering, making them valuable IoCs.

Normalising disparate SIEM log data converts differing field names, formats and timestamps into a common schema, enabling events from multiple sources to be correlated and analysed together. This satisfies the requirement for cross-source compatibility in CTI analysis.

Flow diagrams map each TTP to its position in the attack chain, showing execution order from initial access through impact. This sequencing makes the actor's operational logic visible, which static lists of techniques cannot convey.

The coverage change is a confounding variable, so the first step is to normalize the denominator by comparing like populations. Restricting both periods to Windows servers removes the workstation coverage difference and tests whether the drop persists within the covered population. If the rate is stable after normalization, the apparent decline is an artifact of scope change rather than improved security.

Indicators decay quickly and mean little without temporal and contextual metadata, so pairing the address with confidence, observation windows, and campaign context lets detection engineers judge whether a rule is still worth deploying. This practice aligns with structured indicator handling and reduces false positives when addresses are reassigned or shared. It also supports later retrospective searches across historical data.

Regular, short-lived outbound connections to a malicious IP on port 443 are a classic indicator of command-and-control (C2) beaconing. Malware often beacons at fixed intervals to check for instructions, maintain persistence, and receive updates. The use of port 443 helps blend with normal HTTPS traffic, and the short duration minimizes detection. This pattern is distinct from data exfiltration, which would involve larger transfers.

The Diamond Model plots adversary, capability, infrastructure and victim as four vertices, with edges representing their relationships, so analysts can visualise how the components of a single intrusion interrelate. This satisfies the stem's intrusion-analysis reporting scenario.

ACH is a structured technique that explicitly lists competing hypotheses and scores evidence for consistency and inconsistency. It helps analysts avoid confirmation bias by forcing consideration of alternatives and by highlighting which evidence is diagnostic. For a large artifact set, ACH provides a repeatable, auditable method to weigh explanations and document why one is favored over others, directly supporting defensible conclusions.

Documenting identified threats grouped by category, such as spoofing, tampering or elevation of privilege, gives the threat model its core inventory. Without this categorised list, the model cannot prioritise mitigations or demonstrate coverage, making it an essential component.

Insider threats typically involve authorised users accessing data beyond their normal remit. Tracking sensitive file access and data movement exposes unusual downloads, bulk copies or transfers to removable media, revealing exfiltration behaviour that authentication logs alone cannot show.

In an ACH matrix, each hypothesis is scored against diagnostic evidence; the lowest total indicates that the evidence weighs most heavily against it. A low score therefore means the hypothesis is least consistent with the observed indicators, making it the least likely explanation given the current evidence set.

TTPs reveal how an actor operates, including their preferred tools and methods. This directly informs capability assessment and helps predict likely attack vectors against the telemedicine platform. Understanding TTPs allows the team to prioritize defenses against techniques the actor is known to use, making it a critical factor in threat modeling.

A high CVSS score reflects the intrinsic severity of a vulnerability, derived from metrics such as exploitability, impact and scope. It rates the flaw's characteristics, not the likelihood of exploitation or the value of the affected asset.

Attackers often name malicious processes after legitimate system processes like 'kworker' to blend in. A user-space process with a PPID of 1 indicates it was likely started by init or reparented, which is uncommon for genuine kernel threads. High CPU usage and the mismatched PPID are red flags for a masquerading process, possibly a cryptominer or backdoor.

Diagnosticity measures how well an evidence item distinguishes among hypotheses; ambiguous items that are consistent with many hypotheses add little value even if they raise a total score. The analyst should down-weight non-diagnostic evidence, note inconsistencies, and record residual uncertainty. This preserves analytical rigor and ensures the conclusion reflects the strength of evidence, not just the arithmetic sum of a matrix.

Logging tokens in plain text exposes credentials to anyone with log access, directly breaching confidentiality. STRIDE's Information Disclosure category covers exactly this unauthorised exposure of data, so it is the specific threat satisfied by the plain-text token logging in the API gateway.

Sensitivity analysis varies each input parameter across a range to measure how much the model's output shifts, isolating which variables most influence results. This identifies the assumptions and threats whose uncertainty most affects the model, guiding prioritisation of further analysis.

Dynamic analysis in a sandbox with network simulation allows the analyst to execute the malware in a controlled environment and capture the C2 traffic. By inspecting the network packets, the analyst can identify the protocol structure, encryption methods, and any embedded indicators such as URLs, IP addresses, or commands. This approach is best for understanding custom protocols because it provides real-time behavioral data and the ability to manipulate the environment.

Correlating a low-confidence indicator with additional internal or external sources can validate its maliciousness and increase confidence. This due diligence reduces false positives and ensures that actions like blocking are justified. It is a fundamental step in threat intelligence analysis before operationalizing indicators.

Process hollowing involves creating a new process in a suspended state, unmapping its original memory, and writing malicious code into its address space. The process is then resumed, and the malicious code executes under the guise of the legitimate process. This technique is commonly used to evade detection because the malicious code runs within a trusted process, and the original process image is replaced.

Passive DNS analysis reveals historical mappings between the domain and IP addresses, helping identify infrastructure changes and potentially linking to other domains used by the same actor. This is crucial when the domain resolves to multiple IPs, as it can uncover patterns like fast flux or domain generation algorithms. It also aids attribution by correlating with known malicious infrastructure.

Threat intelligence platforms (TIPs) correlate hashes with known campaigns, threat actors, and other IOCs. This can provide strategic context, such as the actor's motivation, targeting, and TTPs. It helps analysts understand the broader threat landscape and prioritize response efforts. This action is essential for enriching IOCs with actionable intelligence beyond basic detection.

VirtualAllocEx allocates memory inside a remote process, WriteProcessMemory copies the payload into that space, and CreateRemoteThread starts execution there. Together these three APIs describe a canonical remote process-injection chain, so inferring injection is well supported by the imports. This is a behavioural inference from static evidence, not proof of execution, which is why the conclusion is stated as likely rather than certain.

Validation confirms whether the indicators appear in the organization's environment, whether they are still active, and whether they are likely to be malicious. Internal telemetry can reveal prior sightings or false positives, while external sources provide context such as age, popularity, and associated campaigns. This step prevents wasted effort and reduces the risk of blocking legitimate resources, making it the correct first action before operationalizing indicators.

Fast-flux resolution, very recent domain registration, and shared certificate serial numbers across unrelated domains are classic indicators of malicious infrastructure. Threat actors use these techniques to evade blocklists, rotate hosting, and reuse certificates across campaigns. While no single indicator is conclusive, their combination strongly supports an assessment of adversary-controlled infrastructure used for command-and-control, phishing, or payload delivery, warranting further investigation and defensive action.

Passive DNS history links domains and IPs over time, revealing which domains resolved to the same C2 infrastructure during the campaign window. This temporal constraint makes the link meaningful because it aligns with adversary activity rather than coincidental shared hosting. It is a core technique for clustering infrastructure and distinguishing adversary-owned from commodity infrastructure.

Beaconing generates periodic traffic buried within noisy logs. A rolling average smooths short-term fluctuations, suppressing random spikes so consistent temporal patterns, such as regular fixed intervals, become visible. This reveals the rhythmic check-in behaviour characteristic of command-and-control channels.

Dynamic API resolution (also called runtime linking) uses LoadLibraryA and GetProcAddress to resolve function addresses at runtime, hiding the true API calls from static analysis. The import table shows only these two functions because all other APIs are loaded dynamically. This allows the malware to evade detection tools that rely on static import tables, and it is a common technique in malware such as shellcode loaders and advanced persistent threats.

Testing each piece of evidence against every competing hypothesis prevents premature anchoring on a favoured explanation, because inconsistent evidence is surfaced rather than ignored. This directly counters confirmation-driven reasoning, satisfying the stem's requirement to mitigate cognitive bias in ACH conclusions.

Analysis of competing hypotheses works by testing each candidate explanation against evidence and focusing on disconfirming indicators, which reduces the pull of a favoured theory. Evidence that only fits one hypothesis is diagnostically valuable, while evidence consistent with all of them does not discriminate. This method makes the reasoning transparent and auditable, which is why it is central to structured analytic technique.

Rotating IPs every 24 hours produces a changing resolution record per hostname, so plotting resolved addresses against timestamps reveals the recurring rotation pattern and links infrastructure to the adversary. Time-series analysis of resolution logs exposes that persistence where a single snapshot cannot.

Timeliness determines whether intelligence still describes an active threat. It satisfies the reliability constraint because stale indicators, however accurate when published, no longer reflect current adversary infrastructure, so acting on them wastes resources or misses live attacks.

The source's reputation and past reliability are fundamental to assessing credibility. Intelligence from a source with a proven track record of accurate reporting is more trustworthy. Historical accuracy helps analysts gauge the likelihood that current data is correct, and it is a key component of the Admiralty Code for source reliability.

The hardcoded list is a fixed set that defenders can block, seize, or sinkhole, creating a single point of failure for the primary channel. The DGA fallback adds resilience by generating many candidate domains, making complete blocking harder. However, DGAs can be predicted and preemptively blocked or sinkholed. Overall, the design is moderately resilient: better than a single static domain, but not as robust as a fully peer-to-peer or domain-fronting C2.

Extrapolating past threat patterns as permanent ignores changes in attacker tooling, infrastructure and defender controls, producing forecasts that misrepresent current risk. This satisfies the stem's pitfall by naming the specific error of treating historical trends as static.