CCOA Practice Test — Free ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) Questions with Explanations

A company is deploying a new web application in a public cloud. The security team must ensure that the application's data at rest is encrypted and that the encryption keys are managed by the cloud provider while still allowing the company to control key rotation. Which cloud key management service should they use?

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?

A security analyst is reviewing the configuration of a Windows Server 2022 file server that stores HR records. The server is a member of an Active Directory domain. The analyst finds that the local Administrators group contains the domain group 'Helpdesk_Tier1'. Helpdesk technicians need to reset user passwords and unlock accounts, but they should not have full control over the HR file server. Which action should the analyst take to enforce least privilege while preserving the technicians' ability to perform their duties?

A security operations analyst is reviewing the configuration of a newly deployed Windows Server 2022 file server that stores PII. The server has SMB signing disabled. Which of the following best describes the primary risk of leaving SMB signing disabled in this environment?

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

A security operations center (SOC) analyst is triaging an alert indicating that a user's workstation has been infected with malware that is attempting to communicate with a command-and-control (C2) server. The analyst wants to quickly identify the process responsible for the network connection. Which of the following tools is MOST appropriate for this task on a Windows system?

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

While investigating a web server breach, you find malicious PHP web shells. What is the most effective way to identify the source of the upload?

A CCOA analyst receives an alert that the account 'svc_backup' performed an interactive logon (Type 2) to a domain controller at 02:17. The account is normally used only for scheduled backup jobs. The analyst needs to determine whether this is a credential misuse incident. Which Windows event should the analyst examine first to confirm the logon type and source workstation?

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

A CCOA analyst is reviewing a vulnerability scan report for a web server that hosts a public-facing application. The scan identified several vulnerabilities, including a critical remote code execution (RCE) flaw in a web framework, a medium-severity cross-site scripting (XSS) issue, and a low-severity information disclosure in an HTTP header. The RCE vulnerability has a known exploit available in the wild, but the web framework is only used for an internal administrative interface that is not accessible from the internet. The XSS vulnerability is on a public login page. Which vulnerability should the analyst prioritize for immediate remediation based on risk?