CCNA Threat And Attack Types Questions

The Endpoint data model normalises process, file and registry telemetry, letting you detect misuse of legitimate binaries like PowerShell or certutil. It satisfies the stem's living-off-the-land constraint because process-level visibility is essential to spotting abused system tools.

This search filters for Event Code 4769 (Kerberos service ticket request) with encryption type 0x17 (RC4-HMAC), which is commonly used in Kerberoasting because it is weaker and easier to crack. It then aggregates by Account_Name (the user requesting the ticket) and Service_Name (the SPN), directly identifying which accounts are requesting service tickets for which services, highlighting potential Kerberoasting activity.

This search aggregates DNS queries by source IP and queried domain, then sorts descending by count. A high count for a single external domain from an internal host is a strong indicator of DNS tunneling, where data is exfiltrated via repeated queries. It directly surfaces the volume and target domain needed to confirm the behavior.

The Authentication data model in Splunk ES captures login events, including successful and failed attempts, from various sources like Windows Security logs, VPNs, and SSO providers. It includes fields such as user, src, dest, and action, which allow analysts to review the pattern of failed logins and determine if they indicate a brute force attack. This data model is the correct choice for investigating account lockouts.

The `file_hash` field carries the cryptographic digest of the attachment, which is the primary pivot key the 'File' domain dashboard queries against. It satisfies the stem's requirement for pivoting to file-centric investigation, since Splunk ES correlates hashes across endpoints and sandboxes to reveal execution, prevalence and verdict data.

This is correct because the observed behavior is PowerShell executing an encoded, download-and-execute payload, which is the canonical definition of T1059.001. Splunk ES maps this through the Endpoint data model's process and script-block fields, and the encoded command is a hallmark of PowerShell abuse for execution and defense evasion within that technique.

This search calculates the length of each DNS query, filters for queries longer than 50 characters (common in tunneling), then counts by source IP and filters for high volume. DNS tunneling often uses long, encoded subdomains to exfiltrate data, so this combination of length and frequency effectively surfaces suspicious hosts.

Risk Analysis aggregates risk events per entity over time, letting you chart the historical risk score progression for the specific user rather than only current totals. This directly satisfies the requirement to view that user's score history across the triggered high-risk alerts.

Endpoint file activity records local file creation, modification and access on hosts, exposing the collection or staging behaviour typical of insider data theft. This satisfies the requirement for a data source that reveals internal misuse rather than perimeter intrusion.

Fileless attacks leave traces in process behavior, not files. The Endpoint data model captures process creation, parent-child relationships, and command lines, so spotting a script interpreter like PowerShell or wscript spawning from a document reader and then making network connections is a strong indicator. This matches the in-memory execution pattern.

User Activity dashboards in Splunk Enterprise Security aggregate authentication and access events per identity, drawing on data models such as Authentication. This surfaces recent logins, source IPs and failed attempts for the compromised account, directly satisfying the requirement to review that user's login history.

UBA is designed to learn normal behavior for users and peer groups, then flag deviations. Logins from two distant locations within minutes violate a learned travel-time baseline, so UBA surfaces this as an anomaly. This directly matches the scenario's need to compare current activity against a learned baseline.

The Threat Intelligence Framework ingests external threat feeds and matches indicators such as IP addresses against indexed events, letting you confirm whether the address appears in a TOR exit-node intelligence source. This directly satisfies the requirement to verify an external IP against known malicious TOR exit-node data.

Incident Review provides the triage workspace where analysts assign, comment on, and change the status of notable events, driving them through investigation to closure. That management of notable events is its primary function, distinct from rule authoring or risk scoring.

The Network_Resolution data model normalizes DNS query and response data, including the query string and record type. By analyzing the query field for unusually long or high-entropy subdomains and counting unique queries per host, analysts can detect DNS tunneling patterns where data is encoded in subdomain labels.

Network Traffic is the CIM data model that normalises network connection events, including source and destination IP addresses, ports, and domain names. It captures the outbound connection from the system process to the suspicious external domain, satisfying the stem's requirement for network connection information.

The Correlation Search Editor creates and schedules correlation searches, letting you supply a custom blacklist lookup of domains and define the triggering logic. This directly satisfies the requirement to build a new correlation rule from your own domain list rather than a built-in content source.

The Endpoint data model normalises process telemetry into fields such as process_name and process_path, letting you compare running process names against known good executable paths to expose masquerading. This directly satisfies the stem's requirement to detect a renamed system process hiding in plain sight.

The 'user' field identifies the account being targeted. If it is a service account, misconfiguration is likely; if it is a regular user or many different users, brute-force is more probable. Examining the user helps distinguish between an attack and an operational issue, making it the most relevant field for this differentiation.

The Correlation Search Editor exposes the risk score threshold directly, letting you raise or lower the sensitivity assigned to a specific correlation search. Editing the search's risk configuration there satisfies the stem's requirement to adjust that individual search, rather than changing global risk settings or the underlying saved search definition.

Risk Analysis aggregates risk attributed to entities such as users and systems, letting you correlate many disparate events across extended timeframes into a cumulative risk score. That long-duration, entity-centric correlation is exactly what the insider-threat exfiltration scenario requires.

The Endpoint data model contains process execution, file system changes, and registry modifications. It can reveal the ransomware process, its parent process, and any dropped files, which helps trace back to the initial infection vector, such as a malicious document or exploit. This is essential for understanding how the ransomware executed.

Malware commonly beacons to command-and-control infrastructure, so an unusual outbound network connection from a host to unfamiliar external addresses is a recognised infection indicator. It reflects unauthorised communication consistent with the stem's malware compromise scenario.

The Web data model in Splunk ES is designed to capture web activity, including HTTP requests and URLs accessed. By searching the Web data model for the malicious URL, the analyst can identify all users who accessed it, along with timestamps and source IPs. This directly answers the question of who clicked the link and provides the associated URLs, enabling rapid scoping of the incident.

The Geographic Information dashboard plots source IP addresses onto a world map using geolocation lookups, directly satisfying the requirement to visualise the geographic origin of incoming connection attempts. Other dashboards present traffic volumes or protocol breakdowns without geographic context.

The Endpoint data model includes a dll_path field for events related to DLL loading (e.g., from Sysmon Event ID 7). This field specifies the full path of the loaded DLL. In DLL sideloading, attackers place a malicious DLL in a directory where a legitimate application loads it, often from an unusual path. Monitoring dll_path for anomalies helps detect such attacks.

Pretexting fabricates a scenario or identity to manipulate a target into divulging information or performing actions, exploiting trust rather than technical flaws. It is a recognised social engineering category, satisfying the stem's requirement for common human-focused manipulation techniques.

The Endpoint data model normalises process-execution telemetry, including PowerShell command lines and script-block logging, into fields such as process and process_name. This directly satisfies the stem's constraint of searching obfuscated, encoded PowerShell activity, since the encoded command string is captured in the process command-line field rather than in network or authentication data.

Combosquatting creates malicious domains by adding words to a legitimate brand name, such as 'microsoft.com.security-check.net' or 'office365.com.auth-verify.org'. The extra words make the domain appear trustworthy to users and sometimes to simple filters. The repeated resolution of such lookalike domains immediately before outbound HTTPS connections is a strong indicator of this technique used for phishing, malware delivery, or command-and-control.

Sandbox and reputation services detonate or query the hash against external intelligence, providing independent confirmation of maliciousness. This satisfies the stem's verification requirement, since Splunk ES internal data alone cannot confirm a hash is truly malicious.

Incident Review lists all notable events with their urgency, status, owner and disposition, giving analysts a consolidated queue of active investigations. This satisfies the stem's requirement for a summary of notable events currently requiring investigation.

Domain footprinting gathers DNS, WHOIS and registration data to map an organisation's external attack surface before exploitation. It satisfies the stem's reconnaissance criterion because it is passive information gathering, occurring prior to any intrusion attempt.

Risk-Based Alerting assigns and accumulates risk scores against users and entities, so activity from high-risk insiders rises above the notable threshold and triggers investigation, satisfying the requirement to mitigate insider threat. It correlates weak signals that individually would not alert.

In the Splunk Network_Traffic data model, the dns_query field holds the queried domain name from DNS request events. For DNS exfiltration, this field is essential to identify anomalous domains. Analysts pivot on dns_query to find high-entropy or long subdomains typical of data tunneling.

The Web data model normalises HTTP traffic, exposing fields such as http_user_agent and http_method that capture user-agents and request methods. It satisfies the stem's requirement to investigate web-based attacks by correlating proxy, IDS and web-server sourcetypes into a common schema.

The Web data model in Splunk ES is designed to capture web server activity, including HTTP request methods, URIs, user agents, and status codes. Examining this data model allows the analyst to pivot from the notable event to the specific HTTP request details, such as the URI and method used in the web shell exploit, providing crucial context for incident response.

The Network_Resolution data model captures DNS resolution events, including query names, query types, and response codes. It is specifically designed for analyzing DNS activity, making it the ideal choice for detecting DNS tunneling, which often involves abnormally long or encoded domain names. Searching this model allows the analyst to identify suspicious patterns.

The Endpoint data model's Processes node captures process access events, including the source process name and the target process, along with granted access masks. By correlating the source binary and the target lsass.exe, Splunk ES can surface suspicious access consistent with credential dumping, which is exactly the behavior described.

Access Anomalies correlates authentication failures with subsequent successful logins, directly surfacing the failed-then-successful pattern from a new source IP that the stem describes. It aggregates this behaviour per user and src, letting the analyst confirm brute-force activity without manual search construction.

Port 445 indicates SMB, a common lateral-movement channel; the Lateral Movement correlation search aggregates authentication and file-share activity across hosts to surface exactly that behaviour, satisfying the requirement to prioritise a search for suspected spread from the infected host.

Microsoft Office applications spawning PowerShell with encoded commands is a common indicator of a malicious macro. Attackers use macros to execute PowerShell, often with base64-encoded payloads to evade detection. This technique is frequently used in phishing campaigns. Splunk ES can detect this by monitoring process creation events where the parent is an Office app and the child is PowerShell with suspicious arguments.

In Kerberoasting, an attacker often uses a single compromised account to request service tickets for many SPNs to gather multiple tickets for offline cracking. This behavior results in a high volume of Event ID 4769 requests from one user to various services. Splunk ES can detect this anomaly by analyzing ticket requests per user over time, making it a primary indicator.

Ransomware often spreads laterally via SMB and encrypts shared files, causing a spike in write operations to file servers. This behavior is visible in network traffic or endpoint logs and is a strong indicator of active encryption. Correlating multiple hosts writing to the same server can confirm the attack.

The Endpoint.Filesystem data model tracks file creation, modification, and deletion events from endpoint data sources. It includes fields like file_name, file_path, and action, which are essential for identifying the sudden appearance of files with a specific extension like .locky, a known ransomware indicator. This model is designed for endpoint file activity monitoring.

Ransomware is a type of malware that encrypts files on a victim's system and demands payment for the decryption key. The scenario of encrypted files and a ransom note is the classic hallmark of a ransomware attack. Splunk ES can detect ransomware through indicators such as file encryption events, ransom note creation, and unusual process executions.

The Authentication data model in Splunk ES contains login and authentication events, including NTLM authentications. It provides fields like user, src, dest, and authentication type, which are essential for correlating pass-the-hash activity. Querying this data model allows the analyst to trace the compromised accounts and the scope of lateral movement.

The Network Resolution data model in Splunk ES is designed to capture DNS and DHCP activity, including DNS queries and responses. It contains fields such as query, answer, and src, which allow analysts to search for anomalous DNS patterns like high-frequency queries or long subdomains. This data model is the most efficient way to identify DNS tunneling indicators because it normalizes DNS logs from various sources.

The Network_Traffic data model captures network flow data, including source and destination IP addresses, ports, and protocols. It is ideal for identifying internal hosts communicating with external malicious IPs. By searching this model, the analyst can quickly list all affected hosts and the nature of the traffic, enabling rapid containment.

RDP hijacking involves taking over an existing RDP session on a remote host, often by using tools that manipulate session IDs. It allows an attacker to move laterally by connecting to a system where a user already has an active session. Splunk ES can detect this through monitoring of RDP logon events, especially those with unusual source or session takeovers.

Event Code 4624 with Logon Type 3 (network logon) and NTLM authentication indicates a logon using NTLM, which is common in pass-the-hash attacks. Attackers use stolen NTLM hashes to authenticate laterally. Reviewing these events for anomalous source IPs or accounts can reveal pass-the-hash activity. It is a key indicator to investigate.

The Threat Intelligence data model in Splunk ES stores indicators of compromise (IOCs) from various threat feeds. Searching for the file hash in this data model will reveal if it is known malicious. This is the standard method to leverage integrated threat intelligence for file reputation within Splunk ES.

RBA assigns risk scores to entities from detections rather than alerting on each individually, so analysts triage behaviour across users, hosts and IPs. This surfaces correlated behavioural indicators that single-event correlation searches miss, satisfying the stem's benefit of focusing on behaviour rather than isolated events.

The Authentication data model captures authentication events, including the authentication method and source/destination hosts. Pass-the-hash attacks often involve NTLM authentication from a source workstation to a different destination workstation. Filtering on authentication_method=NTLM and src!=dest helps identify such lateral movement, which is a key indicator of pass-the-hash.

Clearing the Windows Security Event log generates event ID 1102, which records audit log deletion. The Change Analysis data model tracks changes to system and audit configurations, making it the model that surfaces this action.

Asset Investigator aggregates every discovered asset and groups them by business criticality, directly satisfying the stem's requirement for an organisation-wide summary categorised by criticality. Unlike posture or vulnerability dashboards, it centres on asset inventory classification rather than risk scoring, making it the appropriate view for this specific reporting need.

The `streamstats` command can compute the time difference between successive events, such as connections from an internal host to an external IP. By analyzing the delta times, you can identify regular intervals indicative of beaconing. This is a core technique in Splunk for detecting periodic behavior without relying solely on pre-built correlation searches, and it works well with raw network traffic logs.

Tools like ProcDump or Task Manager can create a memory dump of lsass.exe, often saved as lsass.dmp. The Endpoint.Filesystem data model can detect the creation of such files. This is a direct artifact of credential dumping, as the dump file contains credential material. Its presence in a temp directory is highly suspicious.

Threat Source management is a core component, letting analysts configure, enable and prioritise the external intelligence feeds that populate the framework. It satisfies the stem's requirement for key components by governing which sources supply indicators, alongside intelligence downloads and lookups, ensuring only vetted feeds drive correlation searches and notable event enrichment.

Timechart aggregates events into time-based buckets, directly exposing the periodic interval of connections to the specified domain. This satisfies the stem's requirement to identify beaconing frequency, since regular spikes at consistent intervals reveal the C2 rhythm that a raw event listing would obscure.

This works because DNS tunneling relies on unusually long, high-entropy query names and many unique subdomains to a single parent. Aggregating query name length and unique subdomain counts in the Network_Traffic data model surfaces that pattern, and a correlation search can alert on thresholds, which is exactly how Splunk ES commonly detects this behavior.

Email logs capture embedded links, so extracting and inspecting URLs reveals mismatched or spoofed destinations that legitimate senders would not use. A suspicious URL in the email body is therefore a primary phishing indicator detectable directly from the URL field within mail telemetry.

The Threat Sources page lists every configured intelligence feed with its status, letting you verify which sources are enabled and actively contributing indicators. It is the definitive location for confirming ingestion health, satisfying the requirement to check that threat sources are active.

Change Analysis tracks modifications to system configuration and policy objects, including audit policy changes made via auditpol.exe. Its Change data model captures the object affected, the action taken and the user responsible, satisfying the stem's requirement to locate audit-policy modification events within Splunk's Common Information Model.