During an investigation, an analyst finds that an attacker used a legitimate remote management tool to move laterally and then created a scheduled task on a target host. The scheduled task runs a script that downloads a payload from an external IP. Which chain of events best describes the attack?

Lateral movement, then persistence via scheduled task, then command-and-control communication

Persistence via scheduled task, then lateral movement, then command-and-control

Lateral movement, then command-and-control, then persistence via scheduled task

Command-and-control, then lateral movement, then persistence via scheduled task

What is the first step in investigating a suspected IOA?

Collect and preserve relevant evidence

Contain the threat by isolating the affected system

Eradicate the threat by deleting malicious files

What is the purpose of persistence in an attacker's methodology?

To escalate privileges to administrator level

To exfiltrate data as quickly as possible

To maintain access to a compromised system across reboots or credential changes

To avoid detection by antivirus software

How can an attacker achieve persistence by creating a Windows service?

By adding a user to the Administrators group

By installing a service that runs automatically at system startup

CrowdStrikeCertified Cloud Specialist (CCCS)

Domain 6Objective 2

6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 4)

Part of the Findings and Detection Analysis domain, which makes up ~22% of our current practice bank.

38questions here

8free pages

10concepts

Questions 16–20

16application · easy
A Falcon alert shows a process attempting to create a new Windows service with a binary path pointing to a file in the Temp directory. The service is set to auto-start. Which persistence mechanism is the attacker attempting to establish?
Select an answer first
17expert · hard
During an investigation, an analyst finds that an attacker used a legitimate remote management tool to move laterally and then created a scheduled task on a target host. The scheduled task runs a script that downloads a payload from an external IP. Which chain of events best describes the attack?
Select an answer first
18foundation · easy
What is the first step in investigating a suspected IOA?
Select an answer first
19foundation · easy
What is the purpose of persistence in an attacker's methodology?
Select an answer first
20foundation · easy
How can an attacker achieve persistence by creating a Windows service?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCCS” is a trademark of its owner, used for identification only.