CCOA Practice Test 12 — 15 Questions

Question 1

A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?

Accepted Answer

Resource Monitor. Resource Monitor is the standard Windows utility for granular monitoring of per-process disk, CPU, and memory activity.

Answer

System Configuration (msconfig)

Answer

Event Viewer

Answer

Task Manager

Question 2

Which THREE phases of the incident response lifecycle involve the most interaction with stakeholders?

Accepted Answer

Preparation. The Preparation, Communication, and Post-Incident phases require heavy interaction with management, users, and external parties.

Answer

Detection and Analysis

Answer

Containment and Eradication

Question 3

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

Accepted Answer

Detection and Analysis. The Detection and Analysis phase is where the team processes logs and alerts to identify if an event constitutes an incident.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 4

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

Accepted Answer

To provide continuous monitoring and automated response to threats on endpoints.. EDR tools are designed specifically to detect, investigate, and remediate advanced threats on endpoint devices.

Answer

To block all incoming traffic at the network edge.

Answer

To scan for vulnerabilities in web applications.

Answer

To manage user passwords and enforce complexity.

Question 5

You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?

Accepted Answer

The server hosts the primary company e-commerce database with customer credit card data.. Assets that hold PII or are required for business continuity are by definition critical.

Answer

The server is used for testing internal UI prototypes.

Answer

The server has an outdated version of Java installed.

Answer

The server is connected to a printer in the lobby.

Question 6

Which TWO of the following are true regarding the use of hashing in digital forensics?

Accepted Answer

Hashes ensure data integrity. Hashing ensures data integrity and can be used to identify known files (e.g., system files) to filter them out of an investigation.

Answer

Hashes allow for data decryption

Answer

Hashes are the same as encryption

Answer

Hashes compress the data

Question 7

A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?

Accepted Answer

Perform a frequency analysis of connection time intervals. Beaconing is characterized by high periodicity and low jitter, which can be identified by calculating the variance in the time interval between consecutive connections.

Answer

Identify top talkers by total bandwidth consumption

Answer

Filter connections by source port entropy

Answer

Calculate the mean of bytes transferred per session

Question 8

During the post-incident recovery phase, which TWO actions are essential to ensure the environment is returned to a secure state?

Accepted Answer

Implementing enhanced monitoring on the affected systems. Verification of security controls and monitoring for recurrence are critical to ensure the incident does not repeat.

Answer

Deleting all incident logs to preserve storage space

Answer

Decommissioning the entire production network

Answer

Changing the domain administrator password

Question 9

You are troubleshooting a failure in a 'Certificate-Based Authentication' setup for a VPN. The logs show 'Handshake Failure'. What tool should you use to verify the server's certificate chain status?

Accepted Answer

'openssl s_client -connect <server>:443 -showcerts'.. OpenSSL is the industry standard CLI tool for diagnosing TLS handshake issues and verifying certificate chain validity.

Answer

Wireshark to analyze the encrypted traffic.

Answer

'certutil -verify -urlfetch' on the Linux server.

Answer

Nmap with the '--script ssl-enum-ciphers' flag.

Question 10

You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?

Accepted Answer

Successful and failed login attempts.. Monitoring administrative changes, authentication success/failure, and data access are the pillars of database security logging.

Answer

The specific hardware temperature of the server.

Answer

The number of active user sessions in the connection pool.

Question 11

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

Accepted Answer

Disabling unused modules (e.g., WebDAV, directory listing) in the web server configuration.. Disabling unnecessary features and removing default configuration files are standard hardening steps to reduce the attack surface.

Answer

Changing the administrator's wallpaper to the company logo.

Answer

Configuring the server to auto-restart every 10 minutes.

Answer

Replacing the server's RAM with larger capacity sticks.

Question 12

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Accepted Answer

Advanced Security Settings - Effective Access. The 'Effective Access' tab in Windows Advanced Security Settings is the standard method for auditing actual permissions for a specific security principal.

Answer

Task Manager - Details tab

Answer

Local Security Policy (secpol.msc)

Answer

Event Viewer - System Log

Question 13

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API activity within an AWS account, including the identity and source of the request.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 14

Which TWO of the following are primary security controls for securing virtual machines in a production environment?

Accepted Answer

Hypervisor patching. Hypervisor hardening and regular patching are essential to prevent VM escape and local exploits.

Answer

Providing full physical access to the VM

Answer

Using only physical cabling

Answer

Disabling VM encryption

Question 15

You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this typically signify?

Accepted Answer

An immediate termination of a connection.. The RST (Reset) flag in TCP is used to immediately close a connection, often due to an error or an attempt to terminate a rejected session.

Answer

A request for retransmission.

Answer

A request for a new connection.

Answer

A data acknowledgment.