CCOA Practice Test 12 — 15 Questions

Question 1

When drafting an incident report, what is the most important element to include for the executive summary?

Accepted Answer

Business impact and status. An executive summary is written for non-technical leadership who need to make business decisions quickly, so the most important element is the business impact and current status of the incident. Executives need to know what was affected, the financial/operational/reputational impact, and whether the incident is ongoing or contained. Technical details belong in the body of the report, not the executive summary.

Answer

Full raw packet captures

Answer

Detailed list of every command run

Answer

System architecture diagrams

Question 2

A security operations analyst is reviewing a risk register entry for a web application vulnerability. The entry shows a high likelihood and high impact, but the business owner has decided to accept the risk because the application is scheduled for decommissioning in two months. Which risk treatment strategy is being applied?

Accepted Answer

Risk acceptance. The business owner has acknowledged the risk and chosen to retain it because the application will be decommissioned soon. This is risk acceptance, where no additional controls are applied and the organization tolerates the exposure. Avoidance would remove the system, transference would shift liability, and mitigation would add controls, none of which match the scenario.

Answer

Risk mitigation

Answer

Risk transference

Answer

Risk avoidance

Question 3

During an investigation, you discover that an adversary has modified the 'ImagePath' registry value for a legitimate Windows service to point to a malicious executable. The service is configured to start automatically. Which MITRE ATT&CK tactic does this technique primarily fall under?

Accepted Answer

Persistence. Modifying a legitimate service's ImagePath to point to a malicious executable and configuring it to start automatically ensures the malware runs on system boot. This is a persistence technique because it maintains the adversary's foothold across reboots. While it may also involve execution when the service starts, the configuration change itself is categorized under Persistence in MITRE ATT&CK.

Answer

Privilege Escalation

Answer

Execution

Answer

Defense Evasion

Question 4

A network engineer is designing a demilitarized zone (DMZ) for a company's public-facing web servers. The requirement is to ensure that if a web server is compromised, the attacker cannot directly reach internal database servers. Which control best achieves this segmentation?

Accepted Answer

A firewall rule set that denies all traffic from the DMZ to the internal database subnet. Segmenting the DMZ from the internal network requires an enforcement point that controls traffic between zones. A firewall with a default-deny rule set between the DMZ and the internal database subnet ensures that a compromised web server cannot directly access sensitive data stores. This aligns with defense-in-depth and least privilege, limiting lateral movement. Other controls address different layers and do not provide the required inter-zone restriction.

Answer

Host-based intrusion prevention system (HIPS) on each web server

Answer

VLAN hopping prevention using private VLANs

Answer

Network address translation (NAT) for outbound DMZ traffic

Question 5

A security analyst is investigating a suspected breach and needs to determine whether an attacker moved laterally within the network. The analyst has access to NetFlow records from core switches. Which analysis technique is most effective for identifying lateral movement?

Accepted Answer

Examining NetFlow records for repeated connections from a single internal host to multiple internal hosts on administrative ports. Lateral movement involves an attacker moving from one internal system to another, often using administrative protocols. NetFlow records provide a summary of network conversations, including source and destination IPs and ports. Detecting a single internal host connecting to many internal hosts on administrative ports is a strong indicator of lateral movement, such as scanning or exploitation. This method focuses on east-west traffic and is more effective than examining external connections or high-bandwidth transfers.

Answer

Reviewing NetFlow records for outbound connections to known malicious IP addresses

Answer

Correlating NetFlow records with DNS query logs for internal hosts

Answer

Analyzing NetFlow records for high-bandwidth transfers from internal hosts to external destinations

Question 6

Which THREE behaviors are characteristic of a potential data exfiltration attempt?

Accepted Answer

Traffic over non-standard ports. Option C is correct because data exfiltration often uses non-standard ports (e.g., TCP 4444, 8080, or 53 tunneling) to bypass firewall rules that typically only monitor well-known ports like 80 and 443. Option D is correct because connections to high-risk geographic regions (e.g., IPs geolocated in countries with weak cybercrime laws) are a common indicator of compromise, as attackers frequently route stolen data through infrastructure in those areas. Option E is correct because large data transfers to external IPs — especially volumetric spikes in outbound traffic to unfamiliar public addresses — directly signal bulk data being moved outside the organization. Option A is not correct because frequent screen locking is a physical security/endpoint policy behavior, not a network exfiltration indicator. Option B is not correct because increased local printer usage is an insider-threat or document-handling concern, not a characteristic of network-based data exfiltration.

Answer

Frequent screen locking

Answer

Increased local printer usage

Question 7

An analyst observes that an attacker has modified the Windows Registry to add a value under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' that points to a malicious executable. Which MITRE ATT&CK tactic is the attacker attempting to achieve?

Accepted Answer

Persistence. The correct answer is Persistence because modifying the Run key ensures the malicious executable runs automatically at logon, maintaining the attacker's access. The other tactics—Privilege Escalation, Defense Evasion, and Execution—describe different goals not achieved by this specific registry modification.

Answer

Defense Evasion

Answer

Execution

Answer

Privilege Escalation

Question 8

You are auditing your cloud environment for 'Shadow IT'. Which TWO of the following methods are effective for identifying unauthorized assets?

Accepted Answer

Reviewing firewall logs for connections to known cloud service provider CIDR blocks.. Option C is correct because reviewing firewall logs for connections to known cloud service provider CIDR blocks reveals traffic to AWS, Azure, or GCP ranges that may indicate unauthorized cloud resources, since egress to those IP ranges is a strong signal of Shadow IT usage. Option D is correct because analyzing DNS query logs for domains associated with common SaaS platforms (e.g., slack.com, dropbox.com, salesforce.com) exposes which SaaS services are actually being accessed, even when users bypass IT procurement. Option A is not ideal because Nmap port scanning only discovers hosts and open ports on the corporate network and cannot detect external cloud assets or SaaS usage outside the perimeter. Option B is unreliable because employee interviews depend on self-reporting and memory, so they miss unacknowledged or forgotten Shadow IT. Option E is irrelevant because physical office layout has no bearing on identifying unauthorized cloud or SaaS assets.

Answer

Scanning the corporate network using Nmap for open ports.

Answer

Interviewing all employees about their work habits.

Answer

Checking the physical office layout.

Question 9

In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?

Accepted Answer

Threat Event Frequency and Vulnerability. In FAIR, Loss Event Frequency (LEF) is the probable frequency, within a given timeframe, that a threat agent will inflict harm upon an asset. It is derived from Threat Event Frequency (TEF) — how often threat agents act against the asset — and Vulnerability, which is the probability that a threat event becomes a loss event. This decomposition is the core of FAIR's frequency side of risk.

Answer

Inherent risk and residual risk

Answer

Threat capability and control strength

Answer

Asset value and threat actor motivation

Question 10

A security operations center (SOC) analyst receives an alert from the SIEM indicating that a domain controller has generated a high volume of Kerberos ticket-granting service (TGS) requests using RC4 encryption, with service principal names (SPNs) that do not exist. The analyst suspects a Kerberoasting attack. Which artifact should the analyst collect first to confirm the attack and identify the targeted service accounts?

Accepted Answer

Windows Security event ID 4769 with encryption type 0x17 (RC4-HMAC) and failure code 0x0. Kerberoasting is confirmed by examining Kerberos service ticket requests. Event ID 4769 with RC4 encryption (0x17) and success code 0x0 reveals that a service ticket was issued using weak encryption, which attackers can crack offline. The SPNs in these events identify the targeted service accounts, allowing the analyst to scope the attack and remediate affected accounts. Other events do not provide this specific detail.

Answer

Windows Security event ID 4771 with failure code 0x18 and client address of the requesting host

Answer

Windows Security event ID 4768 with ticket options 0x40810010 and encryption type 0x12

Answer

Windows Security event ID 4624 with logon type 3 and authentication package Kerberos

Question 11

A CCOA analyst is hardening a Kubernetes cluster and wants to prevent any container from running with root privileges or escalating to root inside the pod. Which Kubernetes security control directly enforces this at admission time?

Accepted Answer

Apply a Pod Security Admission policy with the restricted profile to the namespace, which enforces runAsNonRoot, disallows privilege escalation, and drops capabilities.. Pod Security Admission with the restricted profile enforces security context requirements at admission time, including runAsNonRoot and allowPrivilegeEscalation false, which directly blocks root containers and privilege escalation. NetworkPolicy, audit logging, and resource quotas address network, detection, and resource concerns respectively, none of which prevent a container from running with elevated privileges.

Answer

Enable audit logging on the API server and forward events to a SIEM for alerting on privileged pod creation.

Answer

Set resource quotas and limit ranges on the namespace to cap CPU and memory consumption per pod.

Answer

Configure a NetworkPolicy that denies all ingress and egress traffic to pods in the namespace.

Question 12

Which THREE indicators should an analyst monitor to identify a potential web server compromise?

Accepted Answer

Changes to web server configuration files. Option A is correct because unauthorized modifications to web server configuration files (e.g., httpd.conf, nginx.conf, .htaccess) often indicate an attacker altering server behavior, adding malicious redirects, or enabling backdoors. Option B is correct because unauthorized outbound network connections from a web server can signal command-and-control (C2) traffic, data exfiltration, or reverse shells established by an attacker after compromise. Option D is correct because new files appearing in web root directories (e.g., /var/www/html) frequently represent web shells, defacement pages, or uploaded malware used to maintain persistence or execute arbitrary code. Option C is not a reliable web server compromise indicator because user password changes typically relate to identity or account management events rather than server-level intrusion activity. Option E is not a valid indicator because increased RAM capacity refers to a hardware upgrade, not a security event; memory utilization anomalies, not capacity, might be relevant.

Answer

User password changes

Answer

Increased server RAM capacity

Question 13

You are setting up a secure baseline for a new server. You need to ensure the operating system logs are sent to a centralized logging server. Which service should you configure?

Accepted Answer

rsyslog. rsyslog is a service that can be configured to send operating system logs to a centralized logging server. It supports multiple protocols (UDP, TCP, TLS) and is commonly used on Linux systems for log forwarding.

Answer

NTP

Answer

DHCP

Answer

SNMP Trap

Question 14

You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?

Accepted Answer

Incident Response (IR). Incident Response (IR) is the specific NIST 800-53 family governing the response to security incidents.

Answer

Access Control (AC)

Answer

Configuration Management (CM)

Answer

Risk Assessment (RA)

Question 15

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

Accepted Answer

Sysmon Event ID 11. File and Directory Discovery often involves listing files, which generates audit events when monitoring directory access via Sysmon Event ID 11 or Windows Security logs.

Answer

NetFlow

Answer

DHCP logs

Answer

Firewall logs