I85PREP
⌘ K
CTDC study materials
CTDC study resources

CTDC practice questions

One question at a time. Build your CTDC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Threat Detection and Traffic Analysis

During traffic analysis, an analyst observes a TCP connection where the client sends a SYN, receives a SYN-ACK, and then sends a RST instead of an ACK. What does this pattern most likely indicate?

  1. A port scan or service probe where the client aborts before establishing the session Correct answer.
  2. A legitimate connection reset caused by packet loss during the handshake
  3. A completed three-way handshake followed by data transfer
  4. A SYN flood attack targeting the server's backlog queue

Explanation

A SYN followed by SYN-ACK and then RST means the client chose not to complete the handshake, which is typical of port scanning or service probing tools that abort connections quickly. A completed handshake requires the final ACK, and packet loss would cause retransmissions rather than an immediate RST.

Question 2Network Threat Detection and Traffic Analysis

An IDS rule triggers on HTTP requests containing the string '../' repeated many times in the URI. Which class of attack is this rule most directly designed to detect?

  1. Directory traversal Correct answer.
  2. Cross-site scripting
  3. Command injection
  4. SQL injection

Explanation

Repeated '../' sequences in a URI are the classic signature of directory traversal, where an attacker tries to escape the web root and read arbitrary files. SQL injection uses quotes and SQL keywords, XSS uses script tags, and command injection uses shell metacharacters, so none match this pattern.

Question 3Network Threat Detection and Traffic Analysis

Which field in a NetFlow record is most useful for identifying the application protocol carried in a flow when deep packet inspection is unavailable?

  1. IP header checksum
  2. Ethernet frame length
  3. Destination port number Correct answer.
  4. Source MAC address

Explanation

Flow records commonly use the destination port (and protocol number) to infer the application, since well-known ports map to services. MAC addresses, checksums, and frame lengths carry no application-layer meaning, so they cannot identify the protocol.

Question 4Network Threat Detection and Traffic Analysis

A security analyst sees DNS queries for randomly generated subdomains such as 'a8f3k2.example.com', 'q9z1m4.example.com', and 'x7c2v5.example.com' occurring at a high rate. Which threat technique does this most strongly suggest?

  1. DNS cache poisoning
  2. Domain generation algorithm (DGA) beaconing Correct answer.
  3. Typosquatting of a legitimate brand
  4. DNS tunneling for data exfiltration

Explanation

High-volume queries to many random-looking subdomains of the same parent domain are characteristic of domain generation algorithms used by malware to locate command-and-control servers. DNS tunneling usually shows long encoded labels in query and response payloads, cache poisoning targets resolver records, and typosquatting uses lookalike registered domains.

Question 5Network Threat Detection and Traffic Analysis

An analyst reviewing a packet capture notices that a single internal host is sending SYN packets to hundreds of distinct destination IP addresses on port 445 within one minute, and each receives no response. What is the most likely activity?

  1. A load balancer distributing connections
  2. A backup server replicating files to many hosts
  3. A DNS server resolving many hostnames
  4. A worm performing horizontal SMB scanning across the network Correct answer.

Explanation

Many SYNs to distinct hosts on the same service port, with no completed handshakes, indicate horizontal scanning, a common worm behavior targeting SMB. Backup replication and load balancing would complete handshakes with known peers, and DNS uses port 53.

Question 6Network Threat Detection and Traffic Analysis

Which characteristic of a TLS connection best helps an analyst detect beaconing malware when the traffic is encrypted?

  1. The TLS version used by the client
  2. Regular, low-jitter connection intervals to the same destination Correct answer.
  3. The cipher suite negotiated in the handshake
  4. The size of the server certificate chain

Explanation

Beaconing malware typically contacts its controller at regular intervals, so consistent timing with low jitter to the same endpoint is a strong indicator even without payload visibility. Cipher suite, certificate size, and TLS version reflect configuration and do not by themselves reveal beaconing behavior.

Question 7Network Threat Detection and Traffic Analysis

What is the primary purpose of a Snort or Suricata rule's 'content' keyword when detecting malicious traffic?

  1. To define the network interface to monitor
  2. To assign a severity level to the alert
  3. To match a specific byte string within the packet payload Correct answer.
  4. To schedule rule updates

Explanation

The content keyword performs pattern matching against payload bytes, which is the core mechanism for signature-based detection. Severity is set by classification and priority metadata, interface selection is a runtime configuration, and updates are handled outside the rule body.

Question 8Network Threat Detection and Traffic Analysis

An analyst notices a workstation sending large outbound HTTPS uploads to a newly registered domain every night at 02:00, while inbound responses are small. Which hypothesis is most consistent with this pattern?

  1. Scheduled data exfiltration over an encrypted channel Correct answer.
  2. A denial-of-service attack against the workstation
  3. Interactive remote administration by a helpdesk technician
  4. Normal software update downloads

Explanation

Large outbound transfers with minimal return traffic to a newly registered domain, recurring on a schedule, fit data exfiltration over an encrypted channel. Updates would be predominantly inbound, DoS would flood the victim, and interactive admin sessions show bidirectional small exchanges.

Question 9Network Threat Detection and Traffic Analysis

In a PCAP, an analyst sees an HTTP POST with a Content-Type of 'multipart/form-data' and a very large body to an unfamiliar external IP. Which detection concern does this raise?

  1. A DNS amplification attack
  2. A reflected cross-site scripting attempt
  3. An ARP spoofing attempt
  4. Possible file upload or data staging to an external host Correct answer.

Explanation

Multipart form data with a large body sent to an unfamiliar external host suggests file upload or data staging, a common exfiltration or tool-transfer step. XSS, DNS amplification, and ARP spoofing occur at different layers and do not match this HTTP pattern.

Question 10Network Threat Detection and Traffic Analysis

Which indicator most reliably distinguishes a legitimate NTP client from a host participating in an NTP amplification attack?

  1. The use of UDP port 123
  2. Periodic synchronization at long intervals
  3. A high volume of mode 6 or mode 7 requests with spoofed source addresses Correct answer.
  4. The presence of NTP mode 3 client requests

Explanation

Amplification abuses monitoring queries (mode 6/7) with spoofed sources to elicit large responses toward a victim, so a flood of such requests with spoofed addresses is the key indicator. Ordinary clients use mode 3 requests on port 123 at long intervals, which is benign behavior.

Question 11Network Threat Detection and Traffic Analysis

An analyst observes that a host's ARP replies claim the gateway's IP address for the attacker's MAC address, and many hosts update their ARP caches. Which attack is occurring?

  1. ARP spoofing for man-in-the-middle Correct answer.
  2. VLAN hopping
  3. MAC flooding
  4. DHCP starvation

Explanation

Gratuitous ARP replies binding the gateway IP to an attacker MAC cause hosts to send traffic to the attacker, enabling man-in-the-middle interception. VLAN hopping manipulates trunking, DHCP starvation exhausts address pools, and MAC flooding overflows switch CAM tables.

Question 12Network Threat Detection and Traffic Analysis

When analyzing flow data, an analyst wants to detect hosts that receive connections from many distinct external sources on a single port over a short period. Which detection approach is most appropriate?

  1. Counting distinct source IPs per destination IP and port within a time window Correct answer.
  2. Tracking the total number of bytes transferred per host
  3. Monitoring DNS query lengths
  4. Computing the average packet size per flow

Explanation

Many distinct external sources contacting one destination port indicates scanning or a distributed attack against a service, so counting distinct sources per destination and port over a window is the right metric. Packet size, byte totals, and DNS query length measure different properties.

Question 13Network Threat Detection and Traffic Analysis

A signature detects the string 'cmd.exe /c' in HTTP traffic. Which evasion technique would most likely defeat this exact-match signature?

  1. Encoding the string as 'cmd%2Eexe%20%2Fc' or splitting it across packets Correct answer.
  2. Sending the request over IPv6
  3. Encrypting the payload with TLS
  4. Using a different user-agent header

Explanation

Exact string matching fails when the payload is URL-encoded or fragmented across TCP segments, since the literal bytes never appear contiguously in the inspected buffer. TLS would prevent inspection entirely rather than evade a specific string, and IPv6 or user-agent changes do not alter the payload bytes.

Question 14Network Threat Detection and Traffic Analysis

What does a high rate of TCP RST packets from a single server to many clients most likely indicate in traffic analysis?

  1. The network is experiencing asymmetric routing
  2. The server is broadcasting service advertisements
  3. The clients are performing a SYN flood
  4. The server is rejecting connections or resetting sessions, possibly due to overload or a firewall policy Correct answer.

Explanation

A server emitting many RSTs is actively refusing or tearing down sessions, which can reflect overload, access control, or service unavailability. SYN floods originate from clients, asymmetric routing causes dropped or misdirected packets, and service advertisements are not sent via RST.

Question 15Network Threat Detection and Traffic Analysis

An analyst reviewing proxy logs sees requests to 'http://192.168.1.10/admin' where the Host header is 'www.example.com'. What does this discrepancy suggest?

  1. A normal reverse proxy configuration
  2. A DNS resolution failure
  3. An attempt to access an internal host through the proxy, bypassing perimeter controls Correct answer.
  4. A browser caching issue

Explanation

A request line targeting a private IP while the Host header names an external site suggests an attempt to abuse the proxy to reach internal resources. Normal reverse proxy traffic keeps the request target consistent with the Host header, and DNS or caching issues do not produce this mismatch.

Question 16Network Threat Detection and Traffic Analysis

Which protocol is most commonly abused to build covert channels because it frequently permits outbound traffic through firewalls?

  1. ICMP
  2. Telnet
  3. DNS Correct answer.
  4. SNMP

Explanation

DNS is commonly allowed outbound through firewalls, making it attractive for tunneling and covert channels that encode data in queries and responses. SNMP and Telnet are often restricted, and ICMP is frequently blocked or rate-limited at the perimeter.

Question 17Network Threat Detection and Traffic Analysis

An analyst wants to identify a brute-force SSH attack in flow data where payload inspection is not possible. Which pattern is the strongest indicator?

  1. A single flow to port 22 with a large outbound transfer
  2. Many short-duration flows to port 22 from one source to one destination Correct answer.
  3. One long-duration flow to port 22 with high byte counts
  4. Occasional flows to port 22 during business hours

Explanation

Brute-force attempts produce many brief connections as each authentication attempt opens and closes a session, so numerous short flows to port 22 from one source stand out. A single long session or a large transfer suggests legitimate interactive use, and occasional business-hours connections are normal.

Question 18Network Threat Detection and Traffic Analysis

In an IDS alert, the rule references 'flow:established,to_server' and matches a specific payload. What does this flow directive accomplish?

  1. It restricts matching to packets belonging to established sessions traveling toward the server Correct answer.
  2. It disables stream reassembly for the rule
  3. It logs only the first packet of each session
  4. It limits the rule to UDP traffic

Explanation

The flow directive constrains the rule to packets in established sessions and in the specified direction, reducing false positives from stray or handshake packets. It does not alter logging of the first packet, disable reassembly, or restrict transport protocol.

Question 19Network Threat Detection and Traffic Analysis

Which log source is most useful for detecting a host that resolves many algorithmically generated domains but never connects to them?

  1. Firewall deny logs
  2. Switch port statistics
  3. DNS resolver query logs Correct answer.
  4. NetFlow records

Explanation

DNS resolver logs capture the queried names even when no connection follows, making them ideal for spotting DGA activity. Firewall denies, NetFlow, and port statistics only reflect connection attempts or traffic volumes, so they miss queries that never result in sessions.

Question 20Network Threat Detection and Traffic Analysis

An analyst sees a series of SMB connections from a workstation to multiple servers using the same user account within minutes, each accessing administrative shares. Which activity does this best describe?

  1. A network-based denial-of-service attack
  2. Lateral movement using compromised credentials Correct answer.
  3. Legitimate file sharing by a single user
  4. A ransomware encryption routine on one host

Explanation

Rapid SMB connections to many servers with one account, especially to administrative shares, indicate lateral movement with stolen credentials. Normal file sharing targets a few known servers, ransomware encrypts locally and may spread differently, and DoS does not involve authenticated SMB sessions.

Question 21Network Threat Detection and Traffic Analysis

What is the main detection advantage of full packet capture over flow records?

  1. It automatically decrypts TLS sessions
  2. It eliminates the need for IDS rules
  3. It preserves payload content for content-based signatures and forensic reconstruction Correct answer.
  4. It requires less storage for long retention periods

Explanation

Full packet capture retains payloads, enabling content matching and detailed forensic reconstruction that flow records cannot support. It consumes more storage rather than less, does not decrypt TLS, and complements rather than replaces IDS rules.

Question 22Network Threat Detection and Traffic Analysis

An analyst observes that outbound traffic from a host uses TCP port 443 but the payload begins with bytes that do not match a TLS ClientHello structure. What is the most appropriate interpretation?

  1. The host may be using port 443 to evade egress filtering with a non-TLS protocol Correct answer.
  2. The server is misconfigured for TLS 1.3
  3. The capture is corrupted
  4. The traffic is definitely benign HTTPS

Explanation

Using the HTTPS port with a payload that lacks a valid TLS handshake is a common evasion tactic to slip past port-based egress rules. A misconfigured server would still produce a recognizable handshake structure, and corruption is unlikely to consistently produce this pattern.

Question 23Network Threat Detection and Traffic Analysis

Which metric best captures the periodicity of command-and-control beaconing in flow data?

  1. The average packet length
  2. The number of unique destination ports contacted
  3. Total bytes per flow
  4. The standard deviation of inter-arrival times between connections to the same destination Correct answer.

Explanation

Beaconing appears as regular connection intervals, so low variance in inter-arrival times to the same destination is a strong signal. Byte counts, port diversity, and packet length describe volume and structure but not timing regularity.

Question 24Network Threat Detection and Traffic Analysis

A firewall log shows repeated inbound connection attempts to port 3389 from many different external IP addresses. What does this most likely represent?

  1. A DNS amplification attack
  2. Normal remote desktop usage by employees
  3. A distributed brute-force or scanning campaign against RDP Correct answer.
  4. An internal backup job

Explanation

Many external sources targeting RDP indicates scanning or distributed brute-force attempts against remote desktop exposure. Normal employee use would come from known ranges, DNS amplification targets port 53, and internal backups do not originate externally.

Question 25Network Threat Detection and Traffic Analysis

An analyst notices ICMP echo requests with unusually large payloads carrying encoded data to an external host at regular intervals. Which technique is most likely in use?

  1. Path MTU discovery
  2. ICMP tunneling for covert data transfer Correct answer.
  3. A smurf amplification attack
  4. A ping sweep for host discovery

Explanation

Large ICMP payloads containing encoded data sent repeatedly indicate ICMP tunneling, which hides data in echo requests and replies. Ping sweeps use small standard payloads across many hosts, smurf attacks use spoofed broadcast pings, and MTU discovery uses small packets with the DF flag.

Question 26Network Threat Detection and Traffic Analysis

An analyst wants to detect DNS tunneling by examining DNS query names in packet capture. Which characteristic of the queried names most strongly supports the presence of a covert data channel?

  1. Repeated queries for the same short hostname at a steady low rate over many hours
  2. Subdomains with long, high-entropy labels and unusually high query volume to a single domain Correct answer.
  3. Queries sent to the local resolver over UDP port 53 instead of TCP port 53
  4. Queries that use the search domain suffix configured in DHCP options

Explanation

DNS tunneling encodes data in the query name, so labels become long and high-entropy and the volume of queries to one authoritative domain rises sharply. This combination of label entropy plus query frequency is the practical detection signal in DNS logs and captures.

Question 27Network Threat Detection and Traffic Analysis

Which element of a NetFlow or IPFIX record set is most useful for identifying a host that is scanning many destinations on a single port while payload inspection is unavailable?

  1. The TCP window size advertised by the source
  2. The autonomous system number of the source address
  3. The count of distinct destination IP addresses contacted by the source on that port within a time window Correct answer.
  4. The average packet size reported for the flow

Explanation

Flow records summarize who talked to whom, so counting distinct destinations per source and port reveals horizontal scanning patterns even without payloads. Packet size, window size, and source ASN do not express the fan-out that defines a scan.

Question 28Network Threat Detection and Traffic Analysis

A SOC analyst sees a workstation resolve a domain, then connect to an IP address that was never returned in any DNS response for that domain. Which explanation best fits this observation in traffic analysis?

  1. The host is using IPv6 instead of IPv4 for the connection
  2. The host is using hardcoded IP addresses or a DNS channel outside the monitored resolver Correct answer.
  3. The resolver is performing DNSSEC validation on the response
  4. The workstation is experiencing normal DNS caching behavior

Explanation

When a connection target never appears in observed DNS answers, the destination was learned some other way, such as a hardcoded address, a DoH resolver, or an external DNS channel. This mismatch between resolution and connection is a recognized indicator of covert or evasive infrastructure use.

Question 29Network Threat Detection and Traffic Analysis

Which HTTP header field is most useful for spotting domain fronting, where a client reaches a forbidden service through an allowed CDN front?

  1. A mismatch between the TLS SNI value and the Host header in the decrypted request Correct answer.
  2. The Connection header keep-alive token
  3. The Accept-Encoding value
  4. The User-Agent string length

Explanation

Domain fronting works by presenting an allowed name in SNI while sending a different Host header to reach the hidden backend. Comparing SNI with the Host header in decrypted or proxied traffic exposes that inconsistency.

Question 30Network Threat Detection and Traffic Analysis

An analyst needs to distinguish a legitimate scheduled backup from beaconing when both produce regular outbound connections. Which additional property of the traffic best supports a beaconing conclusion?

  1. Small, consistent request sizes with jittered intervals and destinations that rotate across newly registered domains Correct answer.
  2. Traffic that uses the same TLS certificate as other corporate applications
  3. Connections that occur only during business hours and match the change calendar
  4. Large, growing transfer sizes at a fixed daily time to the same internal backup server

Explanation

Beaconing typically shows small uniform check-ins with deliberate timing jitter and rotating or newly registered destinations to evade blocklists. Backups instead show large growing transfers to stable, known infrastructure tied to a schedule.

Question 31Network Threat Detection and Traffic Analysis

Which technique most directly defeats a signature that matches a literal URI path string such as '/gate.php' in HTTP requests?

  1. Using TLS session resumption
  2. Increasing the TCP segment size
  3. Encoding the path with percent-escapes or using alternate case and path normalization Correct answer.
  4. Compressing the response body with gzip

Explanation

Literal string signatures are fragile against encoding, case changes, and path normalization because the bytes on the wire no longer match the pattern. Normalizing and decoding before matching is the corresponding defensive countermeasure.

Question 32Network Threat Detection and Traffic Analysis

An analyst reviews proxy logs and finds requests where the absolute URI in the request line points to an internal address while the Host header names an external site. What is the most likely interpretation?

  1. The proxy is correctly caching the external site content
  2. The client is attempting to bypass the proxy and reach an internal resource through an external-looking request Correct answer.
  3. The client is using HTTP/2 multiplexing
  4. The server is redirecting the client to an internal page

Explanation

A request line targeting an internal address while the Host header names an external site is a classic proxy-bypass or SSRF-style pattern. The proxy may forward the request based on the URI, letting the client reach internal services it should not access.

Question 33Network Threat Detection and Traffic Analysis

Which transport-layer behavior most reliably distinguishes a SYN flood from a legitimate spike in connection attempts to a web server?

  1. A rise in completed TLS handshakes from returning client IPs
  2. A growth in average response body size
  3. Many half-open connections from spoofed or diverse sources with few completed handshakes Correct answer.
  4. An increase in HTTP 200 responses during a marketing campaign

Explanation

A SYN flood leaves many connections stuck in half-open state because the final ACK never arrives, often from spoofed or widely varied sources. Legitimate traffic spikes instead complete handshakes and produce normal application responses.

Question 34Network Threat Detection and Traffic Analysis

An analyst wants to find data exfiltration over DNS in a capture where responses are large. Which observation is most indicative?

  1. PTR lookups performed during log analysis
  2. Queries that always use the resolver's EDNS0 buffer size
  3. Frequent A record lookups for the same popular CDN hostname
  4. TXT or NULL record responses carrying long encoded strings at a high request rate Correct answer.

Explanation

Exfiltration over DNS often uses TXT or NULL records because they can carry more data per response, and the request rate to one domain rises. Large encoded strings in those records are the strongest indicator among the choices.

Question 35Network Threat Detection and Traffic Analysis

Which log source best supports correlating an internal host's outbound connection with the process that initiated it on the endpoint?

  1. NetFlow records exported by the router
  2. Perimeter firewall session logs
  3. Endpoint telemetry that records process, user, and network connection events Correct answer.
  4. Passive DNS records

Explanation

Only endpoint telemetry ties a network connection to the process and user that created it, which is essential for attribution during triage. Network devices see addresses and ports but not the originating process.

Question 36Network Threat Detection and Traffic Analysis

An analyst observes periodic outbound connections to a single IP on port 443 where the payload begins with bytes that do not match a TLS ClientHello. What is the most appropriate next step in traffic analysis?

  1. Extract and inspect the payload to determine whether it is an alternate protocol tunneling over 443 Correct answer.
  2. Assume the server is misconfigured and close the alert
  3. Conclude the traffic is benign because port 443 is allowed
  4. Block the destination IP and take no further analysis

Explanation

Port 443 does not guarantee TLS; non-TLS bytes on that port suggest protocol tunneling or a custom channel. Extracting the payload and identifying the actual protocol confirms or refutes malicious use before response actions.

Question 37Network Threat Detection and Traffic Analysis

Which flow metric is most appropriate for quantifying the regularity of command-and-control check-ins when only connection records are available?

  1. The number of unique source ports used
  2. The ratio of inbound to outbound packets
  3. The total bytes transferred per flow
  4. The standard deviation of inter-arrival times between successive connections from the host to the same destination Correct answer.

Explanation

Beaconing is defined by timing regularity, so measuring the variance of intervals between connections to the same destination captures periodicity directly. Low standard deviation relative to the mean interval suggests automated check-ins.

Question 38Network Threat Detection and Traffic Analysis

A firewall shows many inbound RDP attempts to port 3389 from diverse external addresses against one host. Which conclusion is best supported before any host-side data is reviewed?

  1. The firewall is misconfigured to allow all inbound traffic
  2. The host is definitely compromised and beaconing outbound
  3. The host is subject to internet-wide scanning and possible brute-force attempts, so exposure and authentication logs need review Correct answer.
  4. The attempts are benign health checks from a monitoring service

Explanation

Diverse external sources hitting one port indicate opportunistic scanning and brute-force pressure rather than confirmed compromise. The correct next step is to assess exposure and inspect authentication logs for successful logons.

Question 39Network Threat Detection and Traffic Analysis

An analyst sees ICMP echo requests with oversized payloads sent at regular intervals to an external host. Which detection conclusion is most defensible?

  1. The pattern indicates normal path MTU discovery
  2. The pattern is consistent with ICMP tunneling and warrants payload inspection for encoded data Correct answer.
  3. The pattern confirms a ping-based availability monitor
  4. The pattern proves the host is performing OS fingerprinting

Explanation

Large, regularly timed ICMP payloads are a known tunneling pattern because ICMP is often permitted through firewalls. Inspecting the payload for encoded or encrypted content distinguishes tunneling from ordinary monitoring.

Question 40Network Threat Detection and Traffic Analysis

Which combination of flow features best separates a compromised host performing internal lateral SMB scanning from normal file-share access?

  1. Multiple hosts connecting to one domain controller for authentication
  2. A few long-lived sessions to the same file server carrying large reads
  3. Periodic connections to an external update server on port 443
  4. Many distinct internal destinations on port 445 with short, failed sessions from one source Correct answer.

Explanation

Lateral SMB scanning shows one source touching many internal hosts on port 445 with brief, often failed sessions. Normal share access instead concentrates on a small set of servers with long, data-heavy sessions.

Question 41Endpoint Detection and Response

In an EDR deployment, which component is primarily responsible for collecting process creation, file modification, and network connection telemetry from the host?

  1. The SOAR playbook engine
  2. The management console dashboard
  3. The threat intelligence feed
  4. The endpoint sensor agent Correct answer.

Explanation

The endpoint sensor (agent) runs on the host and is the component that captures low-level telemetry such as process, file, registry, and network events. Consoles and playbooks consume that data but do not generate it at the source.

Question 42Endpoint Detection and Response

An analyst wants to see the full parent-child chain that led to a suspicious PowerShell execution. Which EDR data view is most directly suited to this?

  1. A DNS zone transfer record
  2. A vulnerability scan report
  3. A firewall rule audit log
  4. A process tree with parent process identifiers Correct answer.

Explanation

Process ancestry is reconstructed from parent process identifiers and creation events, which EDRs present as a process tree. This lets an analyst trace which program spawned PowerShell and what it in turn launched.

Question 43Endpoint Detection and Response

What is the primary purpose of a detection rule's 'false positive' tuning in an EDR platform?

  1. To increase the raw event ingestion rate from endpoints
  2. To reduce alerts generated by legitimate activity that matches the rule logic Correct answer.
  3. To encrypt the sensor's local telemetry cache
  4. To shorten the retention period of all audit logs

Explanation

Tuning adjusts rule conditions, exclusions, or thresholds so benign activity that resembles the malicious pattern stops triggering alerts. This preserves analyst attention for genuine threats without disabling detection entirely.

Question 44Endpoint Detection and Response

Which EDR capability allows an analyst to isolate a compromised host from the network while keeping the sensor management channel open?

  1. Network containment Correct answer.
  2. Patch deployment
  3. Disk imaging
  4. Log forwarding

Explanation

Network containment blocks most host network traffic while preserving the sensor's link to the management console, so the analyst can still investigate and issue commands. It limits lateral movement without fully losing visibility.

Question 45Endpoint Detection and Response

A rule alerts whenever 'cmd.exe' is the parent of 'whoami.exe'. During triage, which contextual factor most reduces the likelihood this is malicious?

  1. The user recently changed their password
  2. The activity occurred inside an approved administrative script run by the IT team Correct answer.
  3. The host has an outdated antivirus signature
  4. The endpoint has low free disk space

Explanation

Legitimate administrative automation frequently invokes discovery utilities like whoami through cmd.exe, so an approved script explains the pattern. Context such as the invoking account and change record is what separates benign administration from attacker reconnaissance.

Question 46Endpoint Detection and Response

What does an EDR 'telemetry retention window' define?

  1. How long collected endpoint events remain searchable before aging out Correct answer.
  2. The timeout for an analyst's console session
  3. How frequently the sensor checks for software updates
  4. The maximum number of endpoints a license permits

Explanation

Retention window is the period raw or processed events stay queryable in the platform before deletion or archival. It determines how far back an investigation can search without relying on external log storage.

Question 47Endpoint Detection and Response

Which event source best supports detecting a credential-dumping attempt that reads the LSASS process memory on a Windows host?

  1. Email gateway spam scores
  2. Web proxy URL categorization logs
  3. DHCP lease assignment records
  4. Kernel-level process access and memory-read telemetry Correct answer.

Explanation

Detecting memory access to LSASS requires kernel-level visibility into process handle requests and read operations. EDR sensors with such telemetry can flag tools that open LSASS with suspicious access rights.

Question 48Endpoint Detection and Response

An EDR alert fires on a script that creates a scheduled task pointing to a file in the user's temp directory. Which follow-up query is most valuable to confirm persistence?

  1. Check the system's time zone configuration
  2. List all installed printer drivers on the host
  3. Enumerate scheduled task registrations and their associated binary paths across the fleet Correct answer.
  4. Review the endpoint's screen resolution settings

Explanation

Scheduled task persistence is confirmed by enumerating task registrations and the executables they launch, especially from suspicious paths like temp. Fleet-wide enumeration reveals whether the same persistence was deployed elsewhere.

Question 49Endpoint Detection and Response

What is the main advantage of behavioral detection logic over purely signature-based detection in EDR?

  1. It guarantees zero false positives
  2. It can identify malicious intent from sequences of actions even when no known file hash matches Correct answer.
  3. It removes the requirement for log storage
  4. It eliminates the need for any endpoint agent

Explanation

Behavioral rules model action sequences and intent, so novel or modified malware that lacks a known signature can still be caught. Signature matching alone fails against polymorphic or new samples.

Question 50Endpoint Detection and Response

An analyst suspects lateral movement via remote service creation. Which combination of EDR telemetry most directly supports this hypothesis?

  1. Local disk defragmentation events
  2. Browser cookie modifications
  3. Printer spooler job completions
  4. Remote logon events correlated with service creation and new process starts on the target Correct answer.

Explanation

Lateral movement through service creation shows up as a remote logon followed by service registration and a spawned process on the target host. Correlating these three signals across hosts distinguishes it from normal local activity.