CCNA Incident Detection And Response Questions

Selecting manual status update leaves the notable event in 'In Progress' until an analyst changes it, rather than auto-closing or auto-advancing on a timer or rule. This satisfies the requirement that status remains until a specific analyst manually updates it.

Host isolation enforces network containment at the endpoint, blocking all inbound and outbound traffic except the Falcon sensor's channel to the cloud. This severs the adversary's lateral movement paths while preserving the responder's Real Time Response session, which is required to pull memory dumps remotely.

Web proxy logs record outbound HTTP and HTTPS requests with URLs, user identities and response sizes. They expose command-and-control callbacks and data exfiltration to external destinations, satisfying the breach-detection requirement by revealing suspicious egress traffic that other log sources miss.

The `client.geographicalContext.proxyType` field explicitly identifies anonymising proxies, including Tor exit nodes and VPN services, satisfying the requirement to determine whether the session originated from anonymised infrastructure. Unlike raw IP addresses, which require external lookups, this field provides Okta's own classification directly within the log event.

Application authentication logs are generated by the login service itself and explicitly record the outcome (success or failure), the submitted username, and the source IP or session identifier. They capture failures even when the HTTP response is a 200 OK with an error message, which access logs miss. For a credential-stuffing investigation, these logs provide the authoritative, per-attempt evidence needed to confirm the attack and scope affected accounts.

Wireshark decodes hundreds of protocols and reassembles streams, enabling deep packet inspection to spot exfiltration payloads, beaconing, and covert channels within the PCAP. Its protocol dissectors and filtering satisfy the deep-analysis requirement; ping, traceroute, and netstat cannot parse captured packet contents.

ICMP Echo Request packets carrying unusually large payloads indicate data being smuggled inside ICMP, since normal pings use small fixed payloads. This pattern is characteristic of ICMP tunnelling, where attackers encapsulate traffic within permitted ICMP packets to bypass filtering.

A Golden Ticket is a forged Kerberos TGT signed with the compromised KRBTGT hash, so the domain controller never issued it. Detection hinges on anomalous TGT properties: an abnormally long lifetime (default 10 hours, often set to years) and missing corresponding 4768 issuance events, satisfying the stem's log-indicator requirement.

Decoding the encoded command reveals the script's actual instructions. If it contains malicious actions like downloading a file from an external IP or creating a reverse shell, that directly confirms malicious intent. This is the most conclusive step because it analyzes the payload's behavior rather than relying on circumstantial evidence from process creation logs.

After collecting volatile data, the next step is to capture non-volatile evidence, such as the hard drive, using a write-blocker to prevent modification. Documenting the chain of custody ensures that the evidence is admissible in legal proceedings. This preserves the integrity of the evidence and allows for thorough analysis.

The pattern of a completed handshake followed by a long idle period and then a small periodic message is characteristic of beaconing, where malware periodically checks in with a C2 server. The consistent timing and small application-layer payloads suggest automated communication rather than normal user-driven traffic. This behavior is a common indicator of compromise that analysts should investigate further.

Post-incident activity covers the lessons-learned review held after containment, eradication and recovery, where the team performs root cause analysis and documents findings to improve future response. This directly satisfies the stem's requirement for root cause analysis and lessons-learned documentation within the NIST lifecycle.

Normalizing timestamps to a common time zone (typically UTC) and format is essential before correlating events from multiple sources. Without this, events may appear out of order, leading to incorrect conclusions about cause and effect. This step ensures that the timeline is accurate and that sequence of events can be reliably established, which is fundamental to incident analysis.

Honeypot monitoring data feeds threat intelligence by capturing attacker tactics, malware payloads and scanning patterns from decoy systems, supplying observed adversary behaviour rather than vendor-reported indicators. This satisfies the detection requirement because it provides real, environment-relevant threat artefacts that populate feeds used to identify incidents.

A Process Tree view renders parent-child relationships between processes, exposing which executable spawned the suspicious PowerShell instance. This directly satisfies the need to identify the parent process rather than merely listing isolated events or command lines.

PCAP contains full packet data, allowing the analyst to reconstruct TCP sessions and calculate the amount of data transferred. By focusing on outbound sessions with large data volumes, the analyst can identify potential exfiltration. This technique is direct and effective because it uses the actual payload sizes and session durations to flag anomalies, making it the most reliable method among the options.

Sysmon Event ID 1 records process creation, logging the full command line and, critically, the ParentImage and ProcessGuid fields. Filtering this event reconstructs the process tree by linking each spawned process to its parent, directly satisfying the triage requirement to trace the suspicious PowerShell execution's ancestry.

DNS tunneling encodes data into the query name, producing subdomain labels that look like random or base64/hex-encoded strings rather than human-readable hostnames. High entropy in the leftmost labels is a strong indicator that the DNS channel is being used to carry a payload. In this scenario, labels such as 'a1b2c3d4e5' are consistent with encoded exfiltration data rather than legitimate service names.

User-specific crontab files are stored under /var/spool/cron/crontabs/, one file per user, which cron reads at execution. This differs from /etc/crontab and /etc/cron.d, which hold system-wide jobs, making it the primary location for per-user scheduled tasks.

A burst of failed authentications immediately followed by a success is the classic brute-force or credential-stuffing signature, indicating the attacker eventually guessed or reused valid credentials. Correlating both events in the SIEM distinguishes this pattern from routine user typos, directly satisfying the account takeover detection requirement.

A full forensic disk image preserves all sectors, so file system metadata such as MFT entries, inodes, timestamps and directory structures is captured alongside file content. This satisfies the stem's requirement, since metadata is essential for reconstructing activity and proving file provenance during analysis.

The `ss -p` command queries the kernel's socket tables and, with the `-p` flag, appends the owning process ID to each entry, satisfying the requirement to link open network connections to their specific PID. Unlike `netstat`, `ss` reads directly from netlink, making it the modern Linux default.

Clear roles and responsibilities assign ownership for detection, containment, eradication, and recovery, preventing duplicated effort and gaps during an incident. This structure lets responders act decisively under pressure, which is why it is essential to any effective IRP.

The parent process is a known vulnerable service, and the child process is unsigned, located in a temporary directory, and making external connections. This pattern is typical of an attacker exploiting a service to drop and execute a malicious payload, such as a web shell or reverse shell. The temporary directory and lack of signature indicate it is not a legitimate system process.

NetFlow records contain metadata such as source and destination IP, ports, protocol, byte counts, packet counts, and flow start and end times. They reveal the volume and duration of large outbound transfers even when the payload is encrypted, and they can be correlated with firewall, proxy, and endpoint logs without storing full packet contents.

An isolated sandbox or VM contains any drive-by download, exploit kit or redirect payload within a disposable environment, so the analyst can observe the site's behaviour and capture indicators without risking the corporate endpoint or network.

Rekall provides memory acquisition and analysis, parsing live RAM captures to extract processes, network connections and injected code artefacts. It satisfies the stem's requirement for a memory forensic tool, complementing Volatility as the other commonly cited framework for examining volatile memory images during incident response investigations.

LotL abuses legitimate signed binaries such as PowerShell or certutil, so command-line arguments and parent-child process relationships are the observable artefacts. Process creation logs capture these, whereas network or authentication logs lack the command-line context needed to distinguish malicious from benign execution.

Drive audit logs record file creation, sharing and permission changes, including external sharing events and the acting user. They directly answer which files a specific user shared outside the organisation, unlike login or admin audit logs.

Malicious services registered with the Service Control Manager start automatically at boot under SYSTEM context, restoring attacker access after restarts. This is a classic persistence mechanism because the service persists independently of any user session.

Before declaring an incident, the analyst must determine whether the group modification was authorized. Correlating the event with change management records and identifying the account that performed the action provides the context needed to distinguish a legitimate administrative change from malicious escalation. This evidence-based validation step is the correct immediate action before any containment.

EDR isolation cuts network communication while keeping the endpoint powered on, which preserves volatile memory and active process state. Capturing a memory image before remediation retains evidence such as injected code, encryption keys, and network connection tables. This combination stops the threat and preserves forensic artifacts for deeper analysis.

Large outbound transfers to external IPs during off-hours are a classic sign of data exfiltration. Attackers often schedule transfers when monitoring is reduced. The volume and timing deviate from normal business traffic, and the destination may be a known malicious or suspicious host. This indicator directly suggests data is being moved out of the network without authorization.

Registry Run keys, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, store programs that execute automatically when a user logs on. Malware commonly adds entries here for persistence. Examining these keys can quickly reveal suspicious executables. Thus, this is the most direct artifact to identify autostart programs.

Ensures that an action cannot be denied by the user.

Removing unauthorized access points or credentials is a primary eradication task to ensure the attacker cannot re-enter.

A Watchlist holds the noisy service account, and a 'where' clause in the rule query filters it out before alert generation. This preserves the rule's detection coverage for all other entities, satisfying the requirement to suppress false positives without disabling the analytic rule entirely.

After a click, the immediate priority is determining whether credentials were entered or a payload executed, so reviewing user activity logs for signs of account compromise confirms or rules out actual impact before containment or eradication decisions.

Lens's 'Top values' aggregation groups documents by the source IP field and ranks them by count, directly returning the ten highest-volume addresses. Adding a time filter for the last hour and a destination filter satisfies both stem constraints, while Discover's raw document list cannot aggregate or rank unique values.

Capturing memory and disk images preserves volatile and non-volatile evidence without altering the system. This is the first step in digital forensics to ensure that all potential evidence, including running processes and network connections, is available for analysis. It aligns with the order of volatility and is essential for determining the scope of data exposure.

Confirming whether the login was legitimate separates a true compromise from a false positive before containment or escalation. Contacting the user or manager satisfies the triage constraint of validating the alert, preventing wasted effort on benign activity such as travel or VPN use.

RAM is the most volatile evidence and is lost on power-off, so it must be captured before disk. Imaging memory first preserves encryption keys, running processes and network connections that a shutdown would destroy, following the Order of Volatility.

Hashing produces a fixed-length digest that changes if even one bit of evidence alters, so recomputing it later verifies the data remains unmodified. This directly satisfies the integrity requirement in forensic examination, where proving evidence has not been tampered with since acquisition is essential for admissibility.

Defining security policies during Preparation establishes the governance, acceptable-use and escalation rules the incident response plan must align with. This satisfies the stem's Preparation phase requirement because policy definition precedes detection and response, shaping team authority and decision criteria before any incident occurs.

Running processes and open network connections reside in memory and are lost when the system is powered off. They provide critical evidence of active malware, command-and-control channels, and attacker sessions. Collecting this data first preserves volatile evidence. Therefore, this is one of the correct choices.

Watchlists are queried in analytics rules through the _GetWatchlist function, which returns the uploaded indicators as a table for joining against log data. Referencing the watchlist alias this way lets the rule match malicious IPs against network events.

Firewall logs record permitted and denied connection attempts with source, destination and port details, giving the SIEM network-level evidence to correlate against other events. This satisfies the stem's requirement for a common SIEM ingestion source supporting incident detection.

DNS server logs record queries made by hosts, including domain names resolved and the requesting IP. This directly reveals the domains that the malware attempted to contact, which is crucial for identifying C2 channels. Therefore, DNS logs are the best artifact for this purpose.

The ~/.bashrc file is a per-user shell startup script executed by interactive Bash sessions on each login. Attackers append commands there so malicious code runs automatically whenever the compromised account logs in, providing durable user-level persistence without requiring root access or system-wide configuration changes.

Eradication targets the underlying cause rather than its symptoms, removing malware, closing the exploited vulnerability and eliminating persistence so the threat cannot recur. This satisfies the stem's focus on root cause, distinguishing it from containment or recovery activities.

The network connection table and process list are highly volatile and change rapidly as processes start and stop. Exporting them captures active command-and-control connections, listening ports, and suspicious process trees. These artifacts are essential for understanding the attacker's activity and are lost once the system is rebooted or the processes terminate.

Preparation involves establishing policies, plans, and procedures before an incident occurs. A communication protocol for external stakeholders is a preparatory element because it defines who to notify, when, and how. Without it, the organization may respond slowly or inconsistently during an incident, leading to regulatory penalties or reputational damage. The gap is in planning, which is part of preparation.

Sigcheck verifies Authenticode digital signatures and certificate chains for executables, reporting whether a binary is signed and by whom. Running it against the process image in C:\ProgramData confirms whether the file's signature is valid or tampered.

Hashing the file produces a unique digest that can be matched against malware databases or threat intelligence, identifying known malicious content regardless of filename. Renaming only alters metadata, so hashing bypasses the disguise and reliably reveals the file's true identity.

EDR solutions capture process executions, network connections, and other endpoint activities. If a user clicked a link, the browser process would launch and make a network connection, which EDR would record. EDR can also detect subsequent malicious behavior like file downloads or script execution. This telemetry provides direct evidence of user interaction and is highly useful for determining if the link was clicked.

Lessons learned should translate observed attacker behavior into updated detection logic, such as new signatures, correlation rules, or behavioral analytics. This directly improves the organization's ability to detect similar activity earlier. It also closes the gap identified during the incident when existing detections failed to alert.

Fileless malware often loads malicious libraries or abuses handles rather than dropping executables, so enumerating loaded DLLs and open system handles in the memory image reveals injected or suspicious modules. This exposes in-memory persistence that disk forensics would miss.

The ssdt plugin parses the System Service Descriptor Table, listing service handlers and flagging entries that point outside expected kernel modules. Hooked or redirected entries reveal kernel-mode rootkits that intercept system calls, directly addressing the malicious kernel-mode rootkit identification requirement.

Business impact and status directly satisfies the executive summary's purpose: leadership needs to know what is affected, how severely, and whether service is restored. Executives prioritise operational and financial consequences over packet captures or log excerpts, so stating impact and current status enables informed decisions without technical detail.

Network isolation applies a restrictive host-based firewall policy on the endpoint, blocking all network traffic except the EDR agent's own management channel. This severs attacker command-and-control and lateral movement while retaining remote analyst access, rather than powering off or deleting files.

Traffic over non-standard ports signals exfiltration because legitimate enterprise protocols typically use well-known ports, so unusual port usage can indicate tunnelling or covert channels. This satisfies the stem's requirement for a characteristic behaviour, as attackers often shift to non-standard ports to evade egress filtering and blend with permitted traffic.

The Chain of Custody form documents who collected, handled and transferred each item of evidence, with timestamps and signatures. Providing it lets the forensic investigator demonstrate that evidence remained unaltered and admissible, satisfying the requirement for documentation proving integrity throughout the investigation.

The ps aux command lists all running processes with details such as user, PID, CPU, and memory usage. This is essential for identifying malicious processes, their parent-child relationships, and unusual command lines. It is a standard tool for capturing volatile process data on Linux systems.

Event ID 4769 is generated when a Kerberos service ticket is requested. Filtering for encryption type 0x17 (RC4-HMAC) and success code 0x0 reveals Kerberoasting attempts because attackers request RC4-encrypted tickets for offline cracking. The SPNs in these events identify the targeted service accounts, directly confirming the attack and scoping the affected services.

Changes to web server configuration files signal tampering, such as altered document roots, added rewrite rules or malicious modules. Monitoring configuration integrity satisfies the compromise-detection requirement because unauthorised edits often accompany persistence mechanisms established after initial exploitation.

The time window restricts the lookback period to evaluate the threshold logic.

Object Access auditing, enabled via audit policy on the file server, records file system events including Delete and Delete Subfile entries with the responsible account. This directly attributes deletion activity to a user, unlike logon or process-tracking logs, which lack file-level detail.

Isolating the host from the network severs command-and-control and lateral movement paths, halting ransomware propagation while preserving volatile memory and disk evidence for forensics. Powering off or deleting files destroys evidence and may trigger encryption, so network isolation is the immediate containment step.

Detection and Analysis is the phase where precursors and indicators are identified, satisfying the stem's requirement to classify the incident. It gathers evidence, validates whether an event is genuinely an incident, and determines its scope and impact before containment, eradication, and recovery activities begin.

Segment isolation cuts the network path ransomware or an intruder needs for lateral movement, satisfying the containment goal of stopping spread while forensic evidence is preserved. It is reversible and scoped, unlike full shutdown, so business continuity is maintained during investigation.

Chain of custody documentation records who handled the evidence, when, and why, ensuring that the evidence has not been tampered with or altered. In legal proceedings, a broken or incomplete chain of custody can lead to evidence being ruled inadmissible. For PHI breaches, maintaining an unbroken chain is critical to demonstrate integrity and support potential legal action or regulatory penalties.

ARP scanning works by broadcasting ARP requests across every address in a subnet range to map live hosts, producing exactly the pattern described: one source host generating many ARP requests to the whole subnet. It is a reconnaissance technique preceding further attacks.

Confirmed sensitive PII exposure triggers the organisation's data breach response plan, which defines containment, notification timelines and regulatory reporting duties. Activating it immediately ensures legal and privacy obligations are met while forensic evidence is preserved.

Pass-the-Token attacks replay a stolen token, so Microsoft Entra ID sign-in logs show token-based authentication succeeding without an MFA challenge. That combination confirms the attacker bypassed credential and MFA verification by reusing an already-issued token.

Microsoft Sentinel analytics rules have an incident creation toggle independent of the rule's query and schedule. When disabled, matching alerts still generate but no incident is raised, so brute force detections never surface in the incident queue despite the KQL rule being enabled.