Which location is commonly used for file-based persistence?

The C:\Program Files\Common Files folder

The C:\Users\Public\Documents folder

The C:\Windows\System32\drivers\etc folder

An attacker creates a new user account and adds it to the Administrators group. Which persistence mechanism does this IOA map to?

Registry and startup persistence

Account and credential persistence

Which of the following is a persistence mechanism that uses the Windows startup folder?

Modifying the system's hosts file

Placing a shortcut to a malicious executable in the Startup folder

During an investigation, an analyst confirms that a compromised host has a malicious scheduled task and a rogue user account. Which sequence of response actions is most appropriate?

Eradicate the malware first, then contain the host and collect evidence

Delete the scheduled task and account immediately, then collect evidence

Contain the host, collect evidence, remove the scheduled task and account, then eradicate any remaining malware

Collect evidence, then contain the host, but leave the scheduled task and account in place for monitoring

An attacker gains initial access via a phishing email, then uses a scheduled task to run a script that periodically downloads and executes additional payloads. Which IOA category and persistence mechanism pair best matches this activity?

Privilege escalation and startup folder persistence

Command-and-control communication and scheduled task persistence

Lateral movement and service persistence

Credential theft and registry persistence

CrowdStrikeCertified Cloud Specialist (CCCS)

Domain 6Objective 2

6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 1)

Part of the Findings and Detection Analysis domain, which makes up ~22% of our current practice bank.

38questions here

8free pages

10concepts

Questions 1–5

1foundation · easy
Which location is commonly used for file-based persistence?
Select an answer first
2foundation · easy
An attacker creates a new user account and adds it to the Administrators group. Which persistence mechanism does this IOA map to?
Select an answer first
3foundation · easy
Which of the following is a persistence mechanism that uses the Windows startup folder?
Select an answer first
4application · medium
During an investigation, an analyst confirms that a compromised host has a malicious scheduled task and a rogue user account. Which sequence of response actions is most appropriate?
Select an answer first
5application · medium
An attacker gains initial access via a phishing email, then uses a scheduled task to run a script that periodically downloads and executes additional payloads. Which IOA category and persistence mechanism pair best matches this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCCS” is a trademark of its owner, used for identification only.