CCOA Practice Test 10 — 10 Questions

Question 1

A CCOA analyst is evaluating a zero trust architecture for a hybrid environment. The organization wants to ensure that every access request is authenticated and authorized based on multiple signals before a session is established. Which core zero trust principle does this requirement embody?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Never trust, always verify, by making access decisions per request using identity, device health, and contextual signals.. The requirement that every access request be authenticated and authorized using multiple signals before session establishment is the definition of never trust, always verify. Assume breach focuses on containment, flat networks and perimeter-only controls rely on implicit trust. Only continuous, context-based verification per request satisfies the zero trust principle described.

Answer

Rely on a single strong perimeter firewall and VPN concentrator to control all north-south traffic entering the environment.

Answer

Assume breach and minimize blast radius by segmenting workloads and encrypting all internal traffic.

Answer

Implement a flat network with implicit trust for internal hosts to simplify policy management and reduce latency.

Question 2

During an incident investigation, an analyst discovers that an attacker used a compromised service account to move laterally across multiple systems. The analyst needs to determine the extent of the compromise by identifying all systems where the account was used to authenticate. Which data source would be most effective for this purpose?

Accepted Answer

Windows Security event logs on each domain controller. Domain controller security logs capture authentication events, including the account name, logon type, and source workstation. These logs are essential for tracing lateral movement because they record where and how an account was used. Other sources lack user context or do not cover authentication events across the domain, making them less effective for this specific investigation.

Answer

Antivirus logs on each endpoint

Answer

NetFlow data collected from network devices

Answer

Firewall logs showing outbound connections

Question 3

Which TWO sources are used to populate threat intelligence feeds for incident detection?

Accepted Answer

Honeypot monitoring data. Threat intelligence feeds are compiled from observed malicious activity (honeypots, sensor networks) and security research.

Answer

Building maintenance schedules

Answer

Internal employee social media posts

Answer

Public weather reports

Question 4

During a forensic analysis, you find a suspicious file that was renamed to look like a system file. What is the most reliable way to identify its true nature?

Accepted Answer

Calculate the file hash. Calculating the file hash (e.g., MD5, SHA-1, SHA-256) produces a unique fingerprint of the file's contents that can be compared against threat intelligence databases like VirusTotal or internal IOC lists to identify known malware regardless of the filename or extension. This is the most reliable method because it is based on actual content, not metadata that can be trivially altered.

Answer

Review the file's creation date

Answer

Check the file size

Answer

Check the file extension

Question 5

A threat actor gains initial access to a network by sending a phishing email with a malicious macro-enabled document. After the user enables macros, the document executes PowerShell to download and run a payload. Which MITRE ATT&CK tactic does the macro execution represent?

Accepted Answer

Execution. The macro execution after a user enables macros is an Execution tactic. It allows the adversary to run PowerShell and download a payload. This is categorized under Execution in MITRE ATT&CK, as it involves running malicious code. The phishing email is Initial Access, but the macro execution itself is Execution.

Answer

Persistence

Answer

Initial Access

Answer

Defense Evasion

Question 6

During an incident, an analyst finds that a domain controller's NTDS.dit file was accessed by a process running under the context of a service account, and shortly afterwards the same account authenticated to several member servers using NTLM. The analyst must determine which adversarial tactic the combined activity represents. Which tactic does this activity primarily represent?

Accepted Answer

Credential Access. Accessing NTDS.dit is a credential theft technique that yields password hashes for domain accounts, which is the essence of the Credential Access tactic. The follow-on NTLM authentications to member servers show the adversary using those credentials to move laterally, but they are a downstream effect. Correctly mapping the primary activity to Credential Access keeps the analysis focused on the enabling action and prevents conflating cause with consequence.

Answer

Collection

Answer

Lateral Movement

Answer

Privilege Escalation

Question 7

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

Accepted Answer

Defense Evasion. Clearing Windows Event Logs with 'wevtutil cl' is a Defense Evasion technique (MITRE ATT&CK T1070.001 — Indicator Removal: Clear Windows Event Logs). Adversaries clear logs to destroy evidence of their activity and hinder forensic investigation, which is explicitly categorized under Defense Evasion, not Impact or Persistence.

Answer

Impact

Answer

Persistence

Answer

Discovery

Question 8

You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?

Accepted Answer

AES-256 Encryption. Confidentiality ensures that only authorized parties can access data, which is achieved through encryption.

Answer

Two-Factor Authentication

Answer

Hashing Algorithms

Answer

Digital Signatures

Question 9

During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?

Accepted Answer

Risk acceptance. Risk acceptance is the decision to accept the risk because the cost of mitigation outweighs the potential impact or because business requirements forbid the change.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 10

Which protocol is most appropriate for secure remote management of network infrastructure devices?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted remote access, whereas Telnet, HTTP, and SNMPv1 are insecure.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP