CCNA Cc Security Operations Questions

Network isolation on a separate segment with strict access controls limits lateral movement and reachability, compensating for the unpatched vulnerabilities that cannot be remediated. This contains exposure without relying on vendor fixes that are no longer available for the end-of-life system.

Investigating the root cause first establishes what changed, who or what changed it, and whether it was malicious or accidental, before remediation. Restoring the baseline blindly could destroy forensic evidence or mask an ongoing compromise, so investigation precedes corrective action.

Port 3389 is used by Remote Desktop Protocol (RDP). If RDP is not needed, disabling the service closes the port and eliminates a common attack vector. This is the most direct and effective step to reduce the attack surface, as it removes the service entirely rather than just restricting access.

With the alert confirmed genuine, the analyst must scope the compromise: identify which systems communicated with the command-and-control infrastructure and what data was accessed. Containment decisions depend on that evidence, so deeper investigation precedes remediation.

The misspelled sender address signals a spoofed identity, the defining trait of phishing: fraudulent email crafted to impersonate a trusted executive and trigger urgent action. Business email compromise is the specific subtype, but phishing correctly names the broader attack category the stem describes.

To allow only HTTP and HTTPS while blocking all other outbound traffic, the administrator must create explicit allow rules for TCP ports 80 and 443 from the internal network to the internet. These rules should be placed before a final implicit deny rule. This ensures that only the desired traffic is permitted and all other traffic is blocked.

Reusing the same password across multiple systems means that if one system is breached, the attacker can access other systems using the same credentials. This directly violates the requirement for unique passwords and significantly increases risk. It is a common and dangerous practice that undermines the security policy, making it the correct choice.

Tier 1 analysts handle initial alert triage, validating whether the failed logins followed by an anomalous successful login represent a genuine incident before escalation. This monitoring and classification duty sits squarely within Tier 1 responsibilities, with Tier 2 and Tier 3 engaged only after triage confirms escalation is warranted.

PCI DSS mandates retaining audit trail history for at least twelve months, with the most recent three months immediately available for analysis. This satisfies both constraints in the stem: the minimum retention period and the immediate-availability requirement for authentication logs.

Write-once storage or a separate log server prevents tampering because the logging host holds no credentials to modify or delete entries, and write-once media makes overwriting impossible. This directly satisfies the integrity constraint by ensuring captured records remain unaltered even if a compromised system is erased.

Lookalike domains use typosquatting or homoglyph characters to imitate a legitimate domain, so the link appears trustworthy while directing victims to attacker-controlled infrastructure. This domain mismatch is a reliable phishing indicator, unlike generic greetings or marketing footers.

The spoofed sender address, urgency, and grammatical errors are hallmarks of phishing, a social-engineering attack using fraudulent email to induce action. The wire-transfer pretext targets the employee directly, confirming phishing rather than malware, DoS, or insider threat.

Regular, evenly spaced connections to a newly registered external domain on port 443, with small data transfers, match the profile of malware beaconing to command-and-control infrastructure. The use of HTTPS blends with normal web traffic and evades content inspection. A server with no business internet need makes the pattern even more suspicious, so the host should be isolated and investigated.

Network isolation via the endpoint agent stops the command-and-control communication and prevents lateral movement while keeping the host powered on and its memory intact. This preserves volatile evidence such as running processes and network connections for forensic analysis. It is the fastest containment step that balances damage limitation with investigative value.

Modifying the LSA registry key and reading the SAM database are classic actions associated with extracting password hashes and elevating privileges on Windows. The process running from a user temp folder and not being a known admin tool strongly indicates malicious credential access behavior, which is a key indicator of compromise in security operations.

Automated configuration scanning continuously compares workstation settings against the defined hardened baseline and flags deviations. This satisfies the stem's requirement to detect when a workstation drifts from the baseline, rather than merely enforcing or remediating it.

Ransomware encrypts files, often appends unfamiliar extensions, and displays a ransom demand for decryption keys, which matches every symptom described. The cryptocurrency payment demand is a hallmark of this malware class. Even without a recent link click, delivery can occur through exploits, malicious documents, or compromised remote services, making ransomware the most likely culprit.

Directory traversal uses sequences like '../' to escape the intended directory and read files elsewhere on the host. The encoded and literal dot-dot-slash patterns targeting passwd and system32 files are classic traversal attempts against a file-download endpoint. The attacker is trying to make the application return files it should never expose, which matches this attack exactly.

PCI DSS requires audit logs to be retained for at least 12 months, with the most recent three months immediately available for analysis. This satisfies both the retention and availability constraints stated in the scenario.

Network flow records, such as NetFlow or IPFIX, provide metadata about connections without payload inspection. Large or anomalous outbound data transfers to external IPs can indicate exfiltration even when traffic is encrypted. This approach is effective because it focuses on behavior and volume rather than content, making it suitable for detecting encrypted exfiltration.

Phishing recognition teaches staff to spot fraudulent emails, the most common social-engineering vector, satisfying the stem's requirement to address common attacks. It covers spoofed senders, urgent lures, and malicious links, reducing credential theft and payload execution.

PCI DSS requires audit logs retained for at least 12 months, with the most recent 3 months immediately available for analysis. This satisfies the stem's two-part constraint, balancing forensic history against the cost of keeping older logs readily searchable.

Simultaneous successful authentications from geographically distant locations within an impossibly short window strongly suggest the credentials were used by someone other than the legitimate user, especially since the user confirms only one session. Treating impossible travel as a compromise indicator prompts containment steps such as session termination, password reset, and review of accessed resources, which is the appropriate response.

Disabling unnecessary services and ports shrinks the attack surface by removing listening daemons and open sockets that are not required for the server's role. This is a core hardening step, directly satisfying the baseline requirement to minimise exploitable entry points on new servers.

Tier 2 analysts handle deeper investigation, correlating the malicious-IP indicator against threat intelligence, historical logs and endpoint telemetry. Tier 1 performs initial triage only, so escalation to Tier 2 satisfies the requirement for a deeper investigation of confirmed malicious outbound traffic.

When object access auditing is enabled, file creation and access events are written to the Windows Security log with event IDs such as 4663 and 4656, including the account name and object path. This makes the Security log the authoritative source for attribution of file operations. Reviewing it requires the appropriate audit policy and sufficient log retention.

A SIEM collects log and event data from across the estate, then correlates it to detect patterns indicating incidents and raises alerts. This aggregation and correlation capability is its primary purpose, satisfying the stem's requirement.

Firewall logs capture allowed and denied connections with source and destination IP addresses, ports and byte counts, revealing large or anomalous outbound flows to external hosts. This satisfies the exfiltration scenario by exposing volume and destination of egress traffic crossing the network perimeter.

On Red Hat-based Linux distributions, /var/log/secure serves the same purpose as /var/log/auth.log on Debian-based systems. It records authentication and security-related events, including failed logins and sudo usage. Monitoring this file is critical for detecting unauthorized access attempts on those systems. It is a primary source for security auditing.

The scenario describes a spoofed executive identity, an urgent financial request, and a newly registered look-alike domain. These are hallmarks of business email compromise, where attackers impersonate executives to trick employees into transferring funds or revealing sensitive data. The message passing authentication checks suggests the attacker may have compromised a legitimate account or used a carefully crafted domain that bypasses some filters.

Lateral movement typically appears as a compromised account authenticating to systems it does not normally touch, often across unusual host pairs or at odd times. Correlating internal authentication and remote-access logs exposes these deviations, such as one workstation account logging into many servers. This internal visibility is exactly what detects an attacker pivoting through the environment using stolen credentials.

Multiple connections to a command-and-control server are a clear network-based indicator of compromise. This behavior often indicates that compromised hosts are receiving instructions or sending data to an attacker-controlled server. It is typically detected through network traffic analysis and is a strong sign of an active intrusion.

Tailgating exploits politeness and trust: an attacker follows an authorised person through a controlled door without presenting credentials. Awareness training teaches staff to challenge unfamiliar individuals and enforce badge checks, mitigating this physical social-engineering technique that bypasses electronic access controls.

Authentication logs record each login attempt with success or failure and the originating account or source, so repeated failures within a short window are detectable. This directly satisfies the SIEM correlation rule for multiple failed logins.

Memory acquisition tools like LiME and AVML dump RAM contents to a file or network location while the system runs, preserving encryption keys, network connections, and running processes that vanish on shutdown. Order of volatility principles require capturing memory before less volatile sources. Performing this first ensures the most perishable evidence is secured before power-off or disk imaging.

When object access auditing is enabled, the file server's Security log records events such as 4663 for attempts to access an object, including the account name, object path, and access type. This directly answers whether the compromised account touched the sensitive share. It is the most specific and authoritative source for file share access on Windows.

TCP port 3389 is used by Remote Desktop Protocol (RDP). Repeated inbound connection attempts from multiple external IP addresses suggest a brute-force attack attempting to guess credentials for RDP access. This is a common attack vector for gaining unauthorized remote access to Windows systems. Monitoring and blocking such attempts is critical to prevent compromise.

Limiting administrative rights and running services under dedicated low-privilege accounts constrains what an attacker can do after gaining a foothold. It reduces the number of accounts and processes capable of modifying the system or escalating privileges. This directly shrinks the exploitable surface and limits blast radius, making it a core hardening practice.

Hashing the forensic image at acquisition creates a verifiable fingerprint. If the hash is recomputed later and matches, it demonstrates the image has not been altered. This supports admissibility and chain-of-custody requirements because any change would produce a different value. Documenting the hash alongside acquisition details lets independent examiners confirm the copy is a faithful representation of the original media.

Documenting the chain of custody is essential for evidence admissibility. It records who handled the evidence, when, and how, ensuring integrity. This should be done from the moment evidence is identified and collected. It is the first step to ensure that any evidence gathered later can be traced and trusted in legal proceedings.

Blocking confirmed malicious addresses, domains, or ports at perimeter and internal controls is a standard containment measure. It raises the attacker's cost and cuts off command-and-control or exfiltration paths while the team investigates. Because these rules are temporary and reversible, they limit disruption. This directly reduces ongoing impact and is appropriate during containment rather than waiting for full eradication.

SSH provides encrypted administrative sessions, and setting PermitRootLogin to no prevents direct root logins over the network. Restricting access to the management subnet further reduces the attack surface. This combination directly addresses the requirements of encrypted management and no direct root access, making it the correct choice for securing the Linux web server.

HTTP uses TCP port 80, and HTTPS uses TCP port 443. Allowing these ports enables standard web browsing and secure web traffic. This is a common firewall configuration to permit outbound web access while blocking other potentially risky ports. The administrator should also consider application-layer filtering for additional security, but the correct port numbers are 80 and 443.

Deploying an emergency patch without testing is the appropriate response due to the immediate and severe threat posed by a critical zero-day vulnerability actively being exploited in the wild. The paramount concern is to halt active exploitation and prevent further compromise as quickly as possible. While rigorous testing is normally crucial, the urgency of stopping an ongoing attack outweighs the risks associated with an untested deployment, directly addressing the constraint of mitigating an active, critical threat.

802.1X is an IEEE standard for port-based network access control that requires devices to authenticate via a RADIUS server before gaining network access. It supports per-device credentials, certificates, or other methods, ensuring only authorized devices connect. This is the appropriate solution for corporate Wi-Fi networks requiring strong authentication.

Disabling the account in the identity provider immediately revokes the attacker's ability to authenticate while leaving the mailbox and logs intact for forensic review. Exporting audit and sign-in logs to a secure repository preserves volatile evidence before it ages out or is altered. This combination contains the threat without destroying data needed to determine scope.

Tailgating exploits social courtesy, so training employees to challenge or refuse entry to unfamiliar individuals removes the human behaviour attackers rely on. This directly addresses the unauthorised-follow-in vector, which locks and turnstiles alone cannot prevent.

The message impersonates the IT department and pressures the recipient to disclose credentials urgently, which is phishing: fraudulent email harvesting sensitive data. It satisfies the stem's description, distinguishing it from vishing or pretexting conducted by other channels.

If the account was not disabled in the directory service, it remains active and can be used to authenticate and access resources. This directly explains how the former employee's account could access the file share after termination. The most likely explanation is a failure in the account deprovisioning process.

CIS Benchmarks encode consensus hardening settings, so applying them yields a documented, secure starting configuration rather than a bespoke one. This satisfies the stem's aim of a repeatable baseline against which drift and deviations can be measured and remediated.

The multiple failed SSH logins for root from various IPs indicate a brute force attempt. The subsequent successful login from a foreign IP and creation of a new sudo-enabled account show that the attacker gained access and escalated privileges. This pattern is classic for a brute force attack followed by persistence establishment.

Technical controls are implemented through systems and devices, such as firewalls, intrusion prevention systems, and access control lists. Placing firewalls between segments and permitting only necessary ports and protocols is a technical enforcement mechanism. It limits lateral movement automatically based on configured rules, which is characteristic of a technical rather than administrative or physical safeguard, and it directly reduces the blast radius of an infected workstation.

The caller claims to be help desk staff and invents a critical server issue to create time pressure. This is a classic pretext that leverages authority and urgency so the victim bypasses normal verification. Because the administrator did not initiate the MFA challenge, sharing the code would hand over a second factor and allow account takeover. Recognizing unsolicited authority claims is a core security operations skill.

Beaconing is periodic, regular communication with a C2 server, exactly matching the 60-second intervals observed here. Malware uses this heartbeat to receive commands and exfiltrate data while blending into normal traffic. Because no malicious file was flagged, the network pattern is the strongest indicator, making beaconing the correct characterization of this activity.

The deviation was a deliberate, justified performance fix, so reverting it blindly risks reintroducing the issue. Documenting the change and routing it through change control preserves the audit trail while allowing the baseline exception to be formally reviewed and approved.

Tier 1 analysts perform initial alert triage, validating whether an alert is a true positive and deciding escalation to Tier 2. This matches the stem's requirement for the tier that triages and determines escalation, distinguishing it from Tier 2 investigation and Tier 3 threat hunting.

Domain fronting is a technique where the SNI and HTTP Host header differ, allowing traffic to appear as if it is destined for a legitimate domain while actually communicating with a different server. This is commonly used by malware to evade detection. Its presence is a strong indicator of malicious C2 activity, making this a correct characteristic.

SIEM platforms aggregate and normalise logs from disparate sources, then apply correlation rules to link related events across systems. This cross-source correlation is what surfaces incidents that isolated log review would miss, satisfying the question's requirement for a key SIEM function.

Refusing to plug in found drives removes the attack vector entirely, since the malicious payload executes only on connection. This satisfies the stem's training-message requirement by targeting the physical action the USB drop attack depends upon, before any autorun or HID emulation can trigger.

Staging validation installs the patch in a non-production environment to confirm it remediates the vulnerability without breaking applications. This is a recognised patch lifecycle step, satisfying the stem's requirement for a standard lifecycle activity performed before production deployment.

A password is something the user knows, and a one-time code produced by an app on their enrolled phone is something the user possesses. Because the app runs on a device rather than dedicated hardware, this meets the two-factor requirement without smart cards or physical tokens. The two factors come from different categories, which is precisely what the scenario demands.

This is a classic phishing attempt: a fraudulent email impersonating IT, using a look-alike domain to trick the recipient into revealing credentials. The generic nature and the urgency of a mailbox upgrade are common phishing tactics. Phishing is the broad category that accurately describes this untargeted credential-harvesting attack.

EDR collects process creation, command-line arguments, parent-child relationships, file and registry changes, and network connections from the endpoint. This telemetry directly shows what executed and how, making it the strongest source for spotting suspicious process behavior such as an office document spawning a scripting interpreter. It also supports historical hunting, so analysts can trace the full execution chain rather than only a single alert.

A sender address that does not match the purported organisation, or arrives unexpectedly, indicates spoofing or domain impersonation. This satisfies the stem's indicator criterion because legitimate correspondence normally originates from a recognisable, expected address, making the mismatch a reliable phishing signal.

Authentication logs capture the granular Kerberos and NTLM events on the domain controller, recording each failed attempt (Event ID 4625) and the subsequent successful logon (Event ID 4624) with source IP, account name and logon type. This directly satisfies the stem's requirement for detailed evidence of the brute-force pattern.

Centralizing logs with integrity protection and restricted access preserves evidence and enables cross-system correlation. If a source host is compromised, its forwarded records remain intact elsewhere. Access controls prevent tampering or unauthorized viewing. This combination directly supports detection and investigation, making it a core practice for effective centralized log collection and analysis across a diverse environment.

The scenario describes an attacker impersonating an executive and using a deceptively similar domain to pressure the recipient into an unauthorized financial action. This matches business email compromise, which often relies on spoofed or look-alike domains and urgency to bypass scrutiny. The gift card request is a classic BEC cash-out method rather than a technical exploitation technique.

Querying threat intelligence feeds establishes whether the external IP is a known command-and-control server, malware host or scanner. This reputation data satisfies the stem's need to determine malicious intent before escalating, letting the analyst prioritise the blocked outbound connections correctly.

Write-once storage enforces immutability at the media or object layer, so once a log entry is committed it cannot be altered or deleted, even by privileged accounts. This directly satisfies the requirement to prevent post-generation tampering rather than merely detecting it.

Write-once storage enforces immutability at the media or object layer, so once log data is written it cannot be modified or overwritten, even by compromised accounts. This directly satisfies the stem's requirement that log data cannot be altered after being written.

Account lifecycle management covers provisioning, periodic review, and timely deprovisioning of accounts. When an employee is terminated, their account must be disabled or removed promptly. Leaving it enabled for weeks creates an unauthorized access path. The violation is specifically that the deprovisioning step of the lifecycle failed, leaving a live credential set for someone who no longer works there.

Authentication logs record sign-in events, credential use and directory queries, capturing the account and timestamp of each hop between systems. Microsoft Entra ID sign-in and audit logs therefore satisfy the timeline constraint directly, revealing when compromised credentials were reused against other hosts during lateral movement.

Vishing is voice phishing conducted over the telephone. The attacker impersonated IT support and tried to extract a password through a phone call. Because the attempt occurred by voice rather than email or text, vishing is the precise term. The employee correctly recognized that help desk staff never need a password and reported the call instead of complying.

After isolating the infected system, the next step is to determine how many other systems are affected and to preserve volatile evidence such as memory and logs. This aligns with the containment, eradication, and recovery phases of incident response. Identifying scope prevents further spread and informs subsequent eradication and recovery actions.

A whitelist (allowlist) explicitly permits only approved applications to run, blocking all others by default. This directly enforces the requirement that only authorized software executes. It is the most effective method for application control because it takes a deny-by-default stance, reducing the attack surface from unauthorized or malicious software.