CCNA SOC Operations Questions

APT campaigns pursue highly targeted objectives, focusing on specific intellectual property or geopolitical intelligence rather than broad, opportunistic gain. This deliberate targeting satisfies the stem's requirement for characteristics distinguishing APTs from opportunistic malware, which spreads indiscriminately for financial profit. Such focused intent also explains APTs' prolonged persistence and resource investment.

Inter-zone rules enforce policy between the engineering and finance zones regardless of shared internal subnet addressing, so compromised engineering hosts cannot reach finance systems. Zone-based segmentation is the mechanism that blocks east-west lateral movement the stem requires.

Explicit rules permitting only required traffic between internal zones enforce least privilege at the network layer, which is the core mechanism of micro-segmentation. Without them, lateral movement remains unrestricted, so this element satisfies the stem's requirement for essential Zero Trust segmentation design.

Brute Force sits within Credential Access because it targets credential material directly, satisfying the stem's requirement for techniques mapped to that tactic. Adversaries submit many authentication attempts against accounts to guess valid passwords, distinct from Discovery or Initial Access techniques, which address different adversary goals.

LSASS memory dumping maps to OS Credential Dumping (T1003) under the Credential Access tactic, which covers techniques for stealing credentials such as account names and passwords. The stem specifies harvesting credentials, directly satisfying that tactic's definition rather than Execution, Collection or Privilege Escalation.

Modifying user permissions to gain higher-level access maps to Privilege Escalation, the tactic covering adversaries obtaining elevated permissions on a system or network. Prisma Access logs permission changes; the objective of reaching greater access, not initial entry, defines the tactic.

This is correct because DNS tunneling abuses the DNS protocol to encode data in queries and responses, often using port 53. The encoded payload and numerous outbound connections to various IPs are characteristic of DNS tunneling, which can be used for C2 or exfiltration. The use of UDP port 53 further supports this.

East-west rules between internal VLANs must permit only approved applications, not any any, so malware cannot pivot laterally. Enforcing least-privilege application context on every internal segment satisfies the Zero Trust segmentation constraint in the stem.

Continuous context verification enforces identity, device health and application checks on every request, so access to the financial databases no longer depends on network location. This directly satisfies the stem's requirement for explicit verification rather than implicit trust.

Scanning internal subnets for open ports and active hosts is reconnaissance activity, which MITRE ATT&CK classifies under the Discovery tactic. Discovery covers techniques adversaries use to gain knowledge about the target environment before attempting exploitation.

Incident response playbooks in Cortex XDR can be configured to include manual approval steps before certain actions, such as closing an incident. By modifying the playbook to require analyst approval for closure, the team ensures that high-severity alerts are reviewed by a human before being resolved, directly meeting the requirement to prevent automatic resolution without review.

Windows Security Event Log polling lets the User-ID Agent parse domain controller logon events (4624) to build IP-to-user mappings, satisfying PAN-OS's requirement for server-based monitoring without an agent on every endpoint. It is a documented User-ID source alongside the User-ID Agent, so it qualifies as a valid mapping method.

RADIUS server profiles live under Device > Server Profiles > RADIUS, where the administrator defines the server address, shared secret and authentication port. This satisfies the stem's requirement to configure RADIUS authentication for firewall administrators, since Panorama pushes the profile to managed firewalls for administrator login.

The Causality view in Cortex XDR provides a graphical representation of the process execution chain, showing parent-child relationships, network connections, and file operations associated with an alert. This allows the analyst to trace back to the initial infection vector and identify lateral movement or additional compromised endpoints, directly addressing the need to understand the attack's scope and origin.

Execution covers techniques that run adversary-controlled code on a victim host, including command and scripting interpreters such as PowerShell and signed binaries like Certutil used for payload download. These living-off-the-land behaviours fall under Execution, not Persistence, Discovery or Command and Control.

Least-privilege principles grant users only the minimum access required for their job functions, directly satisfying the stem's constraint that permissions match specific roles. Unlike broader models such as role-based access alone, least privilege continuously restricts excess rights, reducing attack surface and limiting lateral movement if credentials are compromised.

Searching for the scheduled task name across all endpoints helps identify other compromised hosts, determining the scope of the attack. This is a proactive step to contain a potentially widespread incident. Cortex XDR's threat hunting capabilities allow such queries, which can reveal lateral movement or additional infections.

This is correct because isolating the endpoint prevents lateral movement and further compromise. The attacker used wmic.exe for remote process creation, indicating an active threat. Isolation is a standard containment step to stop the spread while allowing further investigation.

Authentication is the IAM function that verifies the user's credentials, such as the SAML assertion presented during the Okta-to-Prisma Cloud single sign-on exchange. It confirms identity before authorisation evaluates permissions, so it is the component validating credentials in this integration.

The Causality View in Cortex XDR visually maps the chain of processes, including parent-child relationships and injected code, and automatically tags observed behaviors with relevant MITRE ATT&CK techniques. This directly answers the analyst's need to understand the process lineage and adversary technique mapping in a single view, enabling rapid triage of the behavioral alert.

Process Execution History captures the parent process and full command-line arguments for each process. For a PowerShell script, this reveals whether it was launched by a scheduled task (e.g., parent process svchost.exe or taskeng.exe) or interactively (e.g., parent process explorer.exe). It also shows the script block or command line, providing direct evidence of origin and execution context. This is the most direct feature for the analyst's goal.

The process details view provides critical information such as the hash, digital signature status, and full command line. An invalid signature on a file in System32 is a strong indicator of masquerading. Comparing the hash to known good versions and examining the command line can confirm if the process is legitimate or malicious.

Remote Services covers logon to remote hosts via SMB administrative shares, RDP and similar protocols, enabling an adversary to move between systems using valid accounts. MITRE ATT&CK places it squarely under Lateral Movement, unlike Execution or Credential Access tactics.

Identity analytics in Cortex XDR correlates user behavior and access patterns to detect anomalies such as impossible travel or credential misuse. It can identify compromised credentials by analyzing authentication events across multiple sources, even without endpoint malware, helping to pinpoint the source of the credential theft.

Zero Trust identity requires MFA combined with continuous, risk-based adaptive validation, re-evaluating each session rather than trusting a one-time login. This satisfies the stem's demand for fundamental identity practices, enforcing ongoing verification instead of static, perimeter-based trust.

LDAP is a supported authentication server profile type in PAN-OS, letting the firewall query directory credentials directly. It satisfies the stem's requirement for an external identity provider server type configurable natively, alongside RADIUS, TACACS+, Kerberos, and SAML.

Assuming breach removes implicit trust and forces explicit verification of identity, device and context at every access request. This satisfies Zero Trust's core requirement that no session is trusted by default, regardless of network location.

This is correct because the first step in incident response is to validate the alert by gathering evidence. The suspicious process path and network connection warrant deeper analysis to determine if it is malicious. Collecting the hash, parent process, and connection details helps confirm the threat before taking containment actions.

Malware often names itself after legitimate system processes to avoid suspicion. The location /tmp/kworker and parent bash are strong indicators of compromise. The outbound DNS queries to an unapproved domain suggest command-and-control or data exfiltration. This is a classic masquerading technique.

Registry Run keys (T1547.001) execute automatically at user logon, satisfying the adversary's need to retain access across restarts. MITRE ATT&CK classifies such autostart mechanisms under the Persistence tactic, which covers any technique enabling an attacker to keep foothold after system reboots, credential changes or other interruptions.

Valid accounts map to the Persistence tactic, while modifying group memberships to gain higher rights maps to Privilege Escalation. These are two distinct MITRE ATT&CK tactics, so the pairing of Persistence and Privilege Escalation accurately reflects both observed phases.

The Incident Investigation view in Cortex XDR aggregates all related events and alerts for a given incident, including process, file, registry, and network activity. It provides a unified timeline and context, allowing the analyst to see the full scope of the attack without manually correlating disparate logs.

Human operators pursuing a defined objective, adapting custom tooling and pacing exfiltration slowly, is the axis separating APTs from commodity campaigns, which rely on reusable, indiscriminate payloads. This satisfies the stem's custom C2, low-and-slow exfiltration and living-off-the-land indicators.

Collection covers gathering data and staging it, including compressing and encrypting files locally before exfiltration. The attacker's local compression and encryption of sensitive files is staging behaviour, which ATT&CK places under Collection rather than Exfiltration.

Administrator role mapping binds PAN-OS admin accounts to roles derived from LDAP group attributes, so privileges follow dynamic directory membership rather than static local accounts. This enforces least privilege centrally and satisfies the requirement to tie administrator access to external directory-managed groups.

Excluding known benign processes or users from a BIOC rule reduces false positives while keeping the rule active for malicious activity. This is a standard tuning approach in Cortex XDR, allowing the SOC to maintain detection coverage for true threats without being overwhelmed by noise from legitimate administrative tools or trusted applications.

This combination directly targets the action of reading process memory and specifies lsass.exe as the target. It precisely detects credential dumping tools that use memory reads to extract credentials. The action field captures the low-level operation, while the target process name ensures focus on the critical security process.

Process Execution History in Cortex XDR logs detailed process information, including command-line arguments, parent-child relationships, and user context, enabling analysts to reconstruct the attack chain. It captures process creation events and links them to other activities like network connections and file operations, providing a comprehensive view for investigation. This is essential for determining if a process is malicious based on its behavior.

Cortex XDR BIOC rules allow analysts to define custom behavioral logic based on process, command line, and other telemetry fields. The rule editor supports pattern matching for command-line arguments like -EncodedCommand and allows exclusions for specific users or processes. This directly fulfills the requirement to detect the behavior while excluding the legitimate service account, providing granular control over alerting.

Process execution logs in Cortex XDR capture detailed information about process creation, including command lines, parent-child relationships, and file executions. By querying these logs, the analyst can see if the downloaded file was executed and what processes it spawned, directly answering the investigation question.

Isolating the endpoint via Cortex XDR immediately cuts network communication while keeping the endpoint powered on and the agent active, preserving volatile memory and process state for forensic analysis. This containment step prevents lateral movement and further command-and-control traffic without destroying evidence, aligning with standard incident response containment procedures.

Causality View in Cortex XDR visually maps the sequence of process executions, showing parent-child relationships and command-line arguments across endpoints involved in an incident. This directly answers the analyst's need to trace how WINWORD.EXE led to powershell.exe and what arguments were used, enabling rapid triage of the attack chain.

WMI is a legitimate Windows administration utility abused to run commands and payloads on local and remote hosts, so the adversary behaviour is running malicious code. MITRE ATT&CK categorises this under Execution, which covers techniques that result in code running on a system.

T1218: Signed Binary Proxy Execution describes the abuse of legitimate signed binaries to execute malicious code, bypassing security controls that trust signed executables. Common examples include rundll32.exe, regsvr32.exe, and mshta.exe. In this scenario, the attacker used a signed binary to proxy execution, which aligns directly with this technique. It is a form of defense evasion.

The incident view in Cortex XDR groups related alerts into a single incident, providing a unified timeline and causality chain that spans multiple endpoints. This allows the analyst to see the common root cause, such as a phishing email or a shared vulnerability, and prioritize remediation based on the incident's scope and severity.

APTs deliberately use living-off-the-land binaries, encrypted channels and sandbox evasion to bypass antivirus, EDR and network monitoring. This evasion capability sustains undetected access over months, matching the classic APT lifecycle trait of remaining hidden from standard security tooling.

Causality View in Cortex XDR provides a graphical representation of the process tree, showing parent-child relationships and associated command-line arguments. It allows the analyst to trace the chain of events from winword.exe to powershell.exe, including any intermediate processes and their command lines, which is essential for determining if the execution is malicious.

Command and Control (TA0011) covers how attackers communicate with systems they have compromised, including encrypted channels, application layer protocols such as HTTPS or DNS, proxies and tunnelling, often with regular beaconing. An outbound encrypted session to an unknown external address fits it closely. Analysts would next check threat intelligence for the destination, look for regular timing patterns, and identify the process making the connection.

Prisma Access enforces continuous verification of users and devices irrespective of network location, which is the defining principle of Zero Trust Architecture: no implicit trust from network position, with per-session authentication and authorisation applied to every request.

Pivoting to the process execution timeline for the endpoint filtered by the initiating process hash allows the analyst to see all child processes spawned by the malicious macro, revealing whether other ransomware behaviors like file encryption or lateral movement tools were executed. This is the most direct way to assess the scope of the attack on that host.

Causality View includes registry modification events and links them to the responsible process, showing the process tree and command-line arguments. This allows the analyst to immediately identify the process and its command line, which is crucial for assessing whether the modification is malicious persistence.

Microsoft Entra ID evaluates conditional access during authentication, before issuing the SAML token. Device compliance signals flow into that evaluation, so unmanaged devices are blocked at token issuance and never reach GlobalProtect's gateway, satisfying the requirement to block sensitive segment access.

Custom command and control infrastructure and espionage objectives reflect the APT's deliberate, stealthy persistence rather than the smash-and-grab monetisation of opportunistic ransomware. This satisfies the stem's constraint of long dwell times and continuous espionage, where bespoke tooling sustains covert access instead of triggering rapid, noisy encryption for extortion.

GlobalProtect enforces per-connection policy, while HIP profiles supply live device compliance data and SAML delivers user identity. Together they let the firewall re-evaluate both identity and posture on every connection attempt, satisfying the dynamic Zero Trust requirement rather than relying on static rules.

The Web Interface idle timeout sits under Device > Setup > Management > General Settings, where the administrator sets the inactivity period to 15 minutes. This enforces automatic logout, preventing unauthorised access from unattended consoles as the scenario requires.

Decoding the Base64 string reveals the actual PowerShell commands, allowing the analyst to assess intent. Legitimate macros rarely use encoded commands; obfuscation is a common malware technique. This provides immediate context without disrupting the endpoint, aligning with SOC triage best practices for quick validation.

An Admin Role Profile defines granular permissions per functional area, so configuring it as read-only for configuration and logs grants visibility without write capability. Assigning that profile to the junior analyst's account enforces least privilege, satisfying the requirement to view firewall configurations and logs while preventing any changes.

External syslog receivers are defined as server profiles under Panorama > Server Profiles > Syslog. The profile specifies the SIEM server address, port, transport, and TLS certificate, and is then attached to a log forwarding profile.

The process name 'svchost.exe' running from a user-writable directory with an unusual parent indicates a masquerading attempt, likely malware. Isolating the endpoint prevents further command-and-control communication and lateral movement, while a scan can identify additional malicious artifacts. This aligns with incident response best practices: contain before eradication.

MFA adds a second authentication factor beyond passwords, so stolen or brute-forced administrator credentials alone cannot grant Panorama access. This satisfies the hardening requirement by directly mitigating credential compromise, the primary attack path against management interfaces.

Persistence covers techniques adversaries use to maintain footholds across restarts, including scheduled tasks and WMI event subscriptions. These mechanisms survive reboots, so they map to Persistence rather than Execution, Privilege Escalation or Defence Evasion, satisfying the stem's categorisation requirement.

Isolation is the first containment step to prevent further communication with the C2 server and stop potential data exfiltration or lateral movement. It limits the attacker's ability to operate while allowing the analyst to investigate without interference. This aligns with standard incident response procedures.

Obfuscated Files or Information sits within the Defense Evasion tactic because encoding, packing, or encrypting payloads hides artefacts from static and signature-based detection. This directly matches the stem's sophisticated evasion constraint, concealing the malware's true content from Cortex XDR analysis until runtime unpacking occurs.

Base64 encoding directly satisfies the Defense Evasion tactic (TA0005), specifically the Obfuscated Files or Information technique (T1027). The attacker manipulates script representation to circumvent signature-based detection, which is the defining constraint in the stem. This tactic covers any adversary action that undermines defensive controls rather than executing or persisting.

The PAN-OS XML API lets Cortex XSOAR push an immediate session-termination command to the enforcing firewall, closing the flagged administrator's active session across enforcement points. This satisfies the Zero Trust requirement to revoke access the moment dynamic trust scores drop.

The external MFA server or Identity Provider holds the second-factor secret and validates the push token, returning the authentication result to Prisma Access. Prisma Access itself acts as the service provider or gateway, not the token validator, so the integrated RADIUS or SAML component satisfies the stem.

A single shared administrator account removes individual attribution and accountability, so actions cannot be traced to a person and privileges cannot be scoped per user. This violates least privilege, which requires each SOC member to hold only the access their role needs.

Creating an exception allows the analyst to exclude known legitimate administrative activities from triggering the rule, reducing false positives while still detecting malicious behavior. Exceptions can be based on specific criteria such as process name, command-line arguments, or user accounts. This approach maintains the rule's effectiveness for other scenarios and is a standard practice in SOC operations to tune detections.