CCNA Technology Essentials Questions

Memory-resident process structures retain parent-child relationships and command lines even when the executable is deleted or the process is hidden from the live API. Anomalous chains, such as a browser spawning a command shell, strongly indicate injection or malicious execution. This artifact is volatile and unavailable after reboot, making it a priority in memory forensics for detecting stealthy activity.

AIDE maintains a cryptographic hash database of file attributes, detecting unauthorised changes to system binaries on Red Hat Enterprise Linux. It satisfies the integrity verification requirement by comparing current hashes against the stored baseline, flagging any modification to monitored files.

Netstat enumerates active TCP connections, listening ports, and protocol statistics by querying the local TCP/IP stack, satisfying the stem's requirement to inspect current network activity. Unlike ping, which tests reachability, or ipconfig, which displays adapter configuration, netstat reports established sessions and their associated endpoints and states.

Phishing-resistant multi-factor authentication, such as hardware security keys or passkeys, prevents attackers from replaying stolen credentials even if a password is captured. For the cloud management plane, this directly blocks credential-based attacks that rely on password theft or real-time phishing proxies, making it one of the strongest identity protections available.

TLS encrypts data in transit between client and database, directly satisfying the in-transit encryption requirement. It negotiates a session key via handshake, so credentials and query results cannot be read if intercepted on the network path.

A set RST flag signals an abrupt teardown rather than graceful closure: one endpoint forcibly aborts the TCP session, often because the port is closed or data arrived unexpectedly. This immediately terminates the connection instead of completing the normal FIN exchange.

A brute-force attack involves repeatedly attempting different passwords for a single account until the correct one is found. Event ID 4625 is generated for each failed logon, and a high volume of these events from a single source IP targeting the same account in a short period strongly indicates an automated brute-force attempt. This pattern is a classic indicator of such an attack, and the SOC analyst should investigate further, possibly blocking the source IP and enforcing account lockout policies.

Sending SYN packets to many ports with no completed handshake is the signature of a TCP SYN port scan. The absence of SYN-ACK responses indicates the scanned ports are closed or filtered, and the breadth of destination ports shows the sender is enumerating services rather than communicating with one. This matches reconnaissance activity against the internal host.

SSH encrypts the entire management session, providing confidentiality and integrity for credentials and configuration commands in transit. Unlike Telnet, which sends data in cleartext, SSH satisfies the secure remote management requirement for infrastructure devices such as routers, switches and firewalls.

VLANs logically partition a physical network into isolated broadcast domains, separating traffic by function or trust level. This delivers the segmentation the scenario requires, restricting direct Layer 2 communication between groups unless routed through a controlled device.

Malware command-and-control and reverse shells frequently dial outbound to high-numbered ephemeral ports, which legitimate services rarely initiate. Host-based logs and firewall records capturing these connections reveal beaconing or exfiltration activity, satisfying the stem's requirement for a compromise indicator found during log analysis.

Never trust, always verify is the foundational zero trust principle requiring authentication and authorization for every access request using multiple dynamic signals such as identity, device posture, and location. This matches the requirement to evaluate each session before establishment. It replaces implicit trust based on network location with explicit, context-aware policy enforcement at each request.

Parameterized queries separate SQL code from data, ensuring that user input is treated as data and not executable code. This prevents attackers from altering the query structure. It is the most effective and recommended defense against SQL injection because it addresses the root cause: the mixing of code and data. Even if input contains malicious characters, they are handled safely.

Patching the hypervisor closes the isolation flaws that VM escape exploits target, while updating guest tools removes vulnerable drivers and services inside the guest. This directly addresses the stem's constraint of preventing escape, since escape requires a hypervisor or tools vulnerability to cross the isolation boundary.

DHCP snooping designates trusted ports toward legitimate DHCP servers and blocks server-originated DHCP offers on untrusted access ports, directly preventing rogue servers from leasing addresses. It satisfies the stem's requirement by filtering DHCPOFFER and DHCPACK messages at the switch, stopping the identified rogue server from responding to client broadcasts.

Hypervisor patching closes vulnerabilities in the virtualisation layer itself, preventing guest-to-host escapes that would compromise every VM on the physical host. This directly satisfies the stem's production-environment constraint, where a single unpatched hypervisor flaw exposes all hosted workloads, so it ranks as a primary control alongside guest OS hardening.

A bridged adapter places the virtual machine directly onto the physical network segment, giving it its own IP address and full visibility to other hosts. It bypasses the host's NAT isolation, so the VM becomes an independently reachable node subject to network attacks.

Attackers commonly use Base64 encoding with the -EncodedCommand parameter to obfuscate PowerShell commands. This encodes the entire script into a single string, making it unreadable to casual inspection and evading some security controls. The encoded command is then decoded and executed by PowerShell. This technique is prevalent in malicious scripts to hide their true intent.

The Microsoft-Windows-PowerShell/Operational log records PowerShell engine events, including script block logging (Event ID 4104) and module logging (Event ID 4103). These events capture the actual script content and pipeline execution, which are critical for reconstructing in-memory attacks. This log is specifically designed for PowerShell operational visibility and is the primary source for such forensic details.

Effective Access on the Advanced Security Settings tab computes the resultant permissions a specified account holds on the executable, resolving group membership and deny entries, so you can confirm whether the service account lacks the required access.

Comprehensive audit logging records API calls and resource changes to immutable storage, enabling forensic investigation and anomaly detection. It satisfies the stem's requirement for a standard best practice by providing the accountability trail needed to detect and investigate cloud security incidents.

DNS security monitoring tools analyze query patterns, domain entropy, query volume, and response sizes to detect tunneling and beaconing. Machine learning models can baseline normal DNS behavior and flag anomalies like random subdomains and high query rates to non-standard resolvers. This directly addresses the scenario by identifying the covert channel based on behavioral and payload characteristics.

Customer-managed keys allow the organization to control the lifecycle and access policies of encryption keys. Using an HSM provides hardware-level protection and enables immediate revocation by disabling or deleting the key. This meets the requirements for organizational key control and rapid revocation, unlike provider-managed keys where the cloud provider controls the key lifecycle.

Running the web service under a dedicated non-privileged account enforces least privilege, so a compromise cannot gain root-level access to the host. This directly mitigates the high-privilege risk identified in the audit, containing any exploitation to limited service permissions.

Script block logging records the content of PowerShell and other scripts, while AMSI (Antimalware Scan Interface) allows security products to inspect script content before execution. Together, they provide deep visibility into fileless techniques that rely on scripting engines. This is critical for detecting obfuscated or malicious scripts that may not touch disk.

DNS tunneling often involves encoding data in DNS queries and responses, leading to unusually long or high-entropy domain names. Analyzing the size and entropy of these fields can reveal patterns indicative of tunneling. For example, base64-encoded data appears random and lengthy. This method directly inspects the DNS payload for signs of hidden data, providing strong evidence of tunneling activity.

Verifying user account permissions identifies excessive privileges, orphaned accounts and misconfigured sudoers entries. This satisfies the audit's access-control objective by confirming least privilege, since weak file ownership or world-writable paths let unprivileged users escalate and undermine the system's integrity baseline.

CAP_NET_BIND_SERVICE is the specific Linux capability that allows a process to bind to privileged ports (ports numbered below 1024) without requiring full root privileges. By assigning this capability to the web server binary (e.g., using setcap), the server can listen on port 80 while running as a non-privileged user, reducing the attack surface. This follows the principle of least privilege and is a common practice for network services that need to bind to low-numbered ports.

Consistent timestamps are critical for accurate event correlation. If logs from different devices use varying time zones or formats, reconstructing the sequence of events becomes error-prone. Normalizing timestamps to a standard, such as UTC in ISO 8601, ensures that events can be ordered correctly, which is essential for incident timelines and forensic analysis.

Event ID 4625 indicates a failed logon, and 4624 indicates a successful logon. Logon Type 3 is a network logon, such as a connection to a shared folder or remote desktop. The rapid sequence from the same source suggests an attacker attempted a password guess and then succeeded, especially against a privileged account. This pattern is a classic indicator of a brute-force attack.

In Windows ACL evaluation, an explicit Deny entry overrides any Allow entries, whether inherited or directly assigned. Effective Access therefore resolves to Deny even if the user belongs to groups with Full Control, making an explicit Deny the most likely cause.

Restricting the inbound rule to TCP port 443 with source 10.0.1.0/24 permits only HTTPS from that subnet. Narrowing the source CIDR is the security-relevant axis; 0.0.0.0/0 or omitting the port would expose the instance more broadly.

Get-FileHash computes a cryptographic hash (SHA-256 by default) of a file's contents, directly satisfying the integrity-verification requirement in the stem. Comparing the returned digest against the publisher's published value detects any tampering or corruption of the downloaded binary, which is precisely the analyst's task here.

Threat intelligence platforms aggregate data from multiple sources and can quickly reveal if the domain is associated with known malicious campaigns, malware, or phishing. This provides context and may save time by identifying the threat without direct interaction. It is a safe, passive method to gather intelligence on the domain.

Full-disk encryption converts all data on the volume, including database files, into ciphertext that requires the correct key to decrypt. When the key is sealed to a trusted platform module, removing the disk and mounting it elsewhere yields unreadable data. This directly addresses the theft scenario by protecting data at rest at the storage layer.

A firewall enforcing a default-deny policy between the DMZ and the internal network ensures that even if a web server is compromised, it cannot initiate connections to database servers. This directly implements network segmentation and least privilege at the network layer. The rule set should allow only required flows, such as database queries from a specific application server, and block all other traffic.

Lateral movement often involves an attacker using a compromised host to connect to other internal systems, particularly on administrative ports like SMB (445), RDP (3389), or WinRM (5985). NetFlow records capture source and destination IPs, ports, and byte counts. By analyzing for a single internal source connecting to many internal destinations on these ports, the analyst can identify patterns consistent with automated scanning or exploitation. This technique leverages flow data to detect east-west traffic anomalies without full packet capture.

Pod Security Admission restricted profile is an admission-time control that rejects pods violating runAsNonRoot, allowPrivilegeEscalation false, and capability restrictions. It directly prevents containers from running as root or escalating privileges, matching the hardening objective. Because it operates at admission, noncompliant workloads never start, providing deterministic enforcement rather than runtime detection.

AWS KMS with customer managed keys allows the company to create and control the lifecycle of encryption keys, including rotation, while the underlying hardware security modules are managed by AWS. This meets the requirement for provider-managed infrastructure with customer control over rotation. It is designed for encrypting data at rest in AWS services.

A scheduled backup job running across distributed infrastructure or through a proxy pool can authenticate from several apparent source addresses at once. Because the account has a strong random password and a defined automated role, the simultaneous logons most likely reflect how the backup application egresses traffic rather than malicious use of stolen credentials.

Application and database logs record the actual queries and requests reaching the backend, revealing injected payloads, unexpected SQL syntax and error patterns that confirm exploitation. They satisfy the scenario's need to trace how malicious input was processed and what data or commands it triggered.

AWS CloudTrail records every API call made in the account, capturing the identity, timestamp, source IP and request details. Reviewing its event history for the IAM role reveals the anomalous calls, satisfying the need to trace what that role actually invoked.

Order of volatility dictates collecting the most perishable evidence first: process tables, network connections, and kernel state vanish on reboot or service restart. Capturing these before touching logs preserves volatile artifacts, while subsequent acquisition of auth.log and file metadata retains persistent evidence for timeline reconstruction. This sequence supports both live response and later forensic analysis without destroying either category.

Wireshark provides a graphical interface to analyze packet captures and includes a feature to export objects from HTTP, SMB, and other protocols. By navigating to File > Export Objects > HTTP, the analyst can list and save files transferred over HTTP. This makes Wireshark the appropriate tool for reconstructing files from a pcap in this scenario.

Daily administration under a root or administrator account grants unrestricted, system-wide write access, so a single mistyped command or misdirected script can alter critical configuration or delete data irreversibly. Using a standard account with Microsoft Entra ID role assignments scoped to specific tasks enforces least privilege, containing mistakes before they escalate.

Checking the digital signature of the executable referenced by the Run key reveals whether it is signed by a trusted publisher or tampered with. Unsigned or invalid signatures indicate likely malicious persistence, satisfying the need to distinguish legitimate from malicious entries.

SIEM aggregates and correlates logs from network devices and endpoints, while EDR provides deep process-level visibility on the workstation. Integrating them allows the analyst to link SMB connections, process execution, and file access into a coherent attack narrative. This combination directly addresses the need to confirm lateral movement and exfiltration by joining network and host telemetry.

Port 445 is used by SMB (Server Message Block) for file sharing, printer sharing, and inter-process communication. Outbound SMB traffic to external IPs is highly suspicious because it can be used to exfiltrate files or spread worms like WannaCry. Blocking outbound SMB at the perimeter is a common best practice to prevent such abuse.

klist displays the Kerberos ticket cache for the current logon session, showing which service tickets have been obtained. If a connection uses Kerberos, a corresponding ticket appears; if NTLM is used, no ticket is present for that service. By running klist before and after accessing the file share, the analyst can confirm whether Kerberos authentication succeeded or fell back to NTLM.

The container runtime is the low-level component that unpacks the image and starts, monitors and stops container processes on the host, interfacing with the kernel's isolation primitives. It executes containerised applications, distinct from orchestration or image-building tools.

On Linux, /proc/<PID>/exe is a symbolic link to the actual executable file. Using ls -l on this link reveals the full path to the binary, even if the process name was changed. This is the most direct and reliable method to identify the executable associated with a running process, which is critical for further malware analysis.

Public read access lets any unauthenticated internet user list and download every object in the bucket, so the exposure is direct data theft rather than mere modification. This satisfies the stem's confidentiality risk: unauthorised exfiltration of stored contents, with no credentials or exploit required.

VLANs provide logical segmentation by isolating broadcast domains and separating traffic at layer 2. They are a building block for network segmentation, allowing different departments or security zones to be separated. However, VLANs alone do not enforce security policies; they must be combined with firewalls or ACLs. Still, they are an essential component.

Resource Monitor's Disk tab lists per-process read and write bytes per second, directly exposing which process generates the heaviest write load. Task Manager shows totals, and Performance Monitor needs counters configured manually, so Resource Monitor answers the specific-process question fastest.

The -a switch displays all active TCP connections and listening ports, -n shows addresses and ports numerically to avoid slow name resolution, and -o includes the owning process ID for each connection. This combination directly maps suspicious external connections to PIDs, enabling the analyst to pivot to the process and determine whether it is legitimate or malicious.

tcpdump with the -w flag writes raw packet data, including full payloads, to a pcap file for offline analysis. Specifying the host filter limits capture to the suspicious IP, reducing noise. This provides the complete packet contents needed for deep inspection and forensic review, unlike tools that only show metadata or summaries.

A signature-based rule set detects known injection patterns, and tuning it to the application's normal parameter behavior reduces false positives on legitimate searches. Monitoring alerts in a learning mode before enabling blocking allows the analyst to validate detections against real traffic, which balances protection with usability for the e-commerce site.