CCOA Practice Test 10 — 10 Questions

Question 1

An incident response team is performing containment on a compromised Linux server that is part of a containerized environment. Given that the container is running in a Kubernetes cluster, which action is the most appropriate initial containment step to preserve the volatile memory for forensics while preventing further data exfiltration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pause the container process using container runtime tools. Pausing the container allows for the preservation of current memory states, whereas deletion or isolation via network policies might trigger cleanup scripts or lose memory artifacts.

Answer

Remove the container image from the registry

Answer

Update the Kubernetes NetworkPolicy to deny all ingress and egress

Answer

Delete the pod immediately to stop the communication

Question 2

A SIEM alert indicates a 'Golden Ticket' attack. What is the primary indicator of this attack in the logs?

Accepted Answer

Abnormally long TGT lifetime. A Golden Ticket attack involves Kerberos TGT (Ticket Granting Ticket) requests that appear abnormal because the ticket lifetime is extremely long, often years.

Answer

Frequent account lockout events

Answer

Unusual user agent strings

Answer

Excessive failed login attempts

Question 3

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

Remove the threat or root cause. The goal of eradication is to remove the root cause of the incident, such as deleting malware, removing accounts, or closing vulnerabilities.

Answer

Identify the attacker

Answer

Improve future security posture

Answer

Restore service to normal

Question 4

When drafting an incident report, what is the most important element to include for the executive summary?

Accepted Answer

Business impact and status. The executive summary must communicate the business impact and current status clearly to non-technical stakeholders.

Answer

Full raw packet captures

Answer

Detailed list of every command run

Answer

System architecture diagrams

Question 5

During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?

Accepted Answer

The EDR applies a restrictive host-based firewall policy. Network isolation in EDR typically uses a host-based firewall policy to block all traffic except for the management connection to the EDR controller.

Answer

The EDR clears the local ARP cache

Answer

The EDR shuts down the network interface completely

Answer

The EDR triggers a BIOS-level shutdown of the NIC

Question 6

A phishing simulation resulted in a user clicking a link. What is the next logical step in the incident response process?

Accepted Answer

Review user activity logs for account compromise. Checking logs for successful logins or abnormal activity from that user account is critical to determine if the phishing attempt led to an account compromise.

Answer

Reimage the machine immediately

Answer

Block the domain of the link

Answer

Change the user's password

Question 7

Which THREE steps are part of the 'Preparation' phase of incident response?

Accepted Answer

Defining security policies. Preparation involves ensuring the team is trained, the necessary tools are available, and the policies are in place to handle incidents.

Answer

Recovering from the incident

Answer

Analyzing the log files

Question 8

Which THREE of the following are standard best practices for securing cloud infrastructure?

Accepted Answer

Enable comprehensive audit logging. Least privilege, MFA, and audit logging are fundamental cloud security pillars.

Answer

Share account passwords between team members

Answer

Use only public IP addresses

Question 9

What is a 'False Positive' in the context of SIEM alerting?

Accepted Answer

A legitimate action flagged as malicious. A false positive is an alert that indicates a security incident when in reality, the activity is legitimate.

Answer

A system error causing a crash

Answer

A successful attack that was blocked

Answer

An incident that went undetected

Question 10

Which TWO tools are commonly used for memory forensic analysis?

Accepted Answer

Rekall. Volatility and Rekall are the industry-standard frameworks used for analyzing memory dumps to detect malicious code and system artifacts.

Answer

Nmap

Answer

Hashcat

Answer

Wireshark