CCOA Practice Test 13 — 15 Questions

Question 1

A red team member uses the Windows Management Instrumentation (WMI) command-line utility to create a new process on a remote host, specifying credentials of a compromised domain user. Which tactic does this activity primarily illustrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lateral Movement. Using WMI to create a process on a remote host with compromised credentials is a Lateral Movement technique. It enables the adversary to execute code on other systems, expanding their foothold. This is a common method because WMI is built into Windows and often allowed through firewalls.

Answer

Execution

Answer

Credential Access

Answer

Defense Evasion

Question 2

You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?

Accepted Answer

ss -tulpn. 'ss' (socket statistics) with the '-tulpn' flags is the modern, preferred tool over the deprecated 'netstat' for viewing listening sockets with process IDs.

Answer

lsof -i | grep LISTEN

Answer

ps aux | grep port

Answer

netstat -an | grep LISTEN

Question 3

You are reviewing a list of vulnerabilities found by an automated scanner. Which type of vulnerability would be considered the most critical to remediate first?

Accepted Answer

Remote Code Execution (RCE) on an internet-facing application.. Remote Code Execution on an internet-facing application is the most critical because it allows an unauthenticated attacker to execute arbitrary code on the server, potentially leading to full system compromise, data exfiltration, and lateral movement. Internet exposure removes the need for internal access, and RCE typically yields the highest impact with the lowest attacker effort. This combination of high exploitability and high impact places it at the top of any remediation priority list.

Answer

Unsupported software version that has no known exploits.

Answer

Information Disclosure of internal server paths.

Answer

Insecure cookie attributes (missing HttpOnly).

Question 4

You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?

Accepted Answer

PutBucketPolicy. 'PutBucketPolicy' is the specific API call recorded in CloudTrail when an IAM identity modifies the bucket policy of an S3 bucket.

Answer

UpdatePolicy

Answer

ModifyBucketPolicy

Answer

DescribeBucketPolicy

Question 5

What is the primary function of a 'C2 Beacon'?

Accepted Answer

To periodically check for new tasks. A C2 (command-and-control) beacon is the implant's periodic callback mechanism that reaches out to the attacker's infrastructure to check for new instructions, receive tasking, and confirm the host is still alive. Its primary function is to periodically check for new tasks (D), enabling the operator to maintain persistent, asynchronous control without needing an inbound connection. This pull-based model is what makes C2 resilient to firewalls and NAT.

Answer

To encrypt the local drive

Answer

To log user keystrokes

Answer

To transfer large files

Question 6

Which THREE factors should be considered when assessing the severity of a security incident?

Accepted Answer

Scope of the affected systems. Option A (Scope of the affected systems) is correct because severity scales with how many hosts, accounts, or network segments are involved—a single workstation compromise is far less severe than domain-wide or multi-site impact. Option C (Sensitivity of compromised data) is correct because the classification of the data (e.g., PII, PHI, credentials, trade secrets) drives regulatory, legal, and privacy consequences under frameworks like GDPR, HIPAA, or PCI DSS. Option D (Business impact) is correct because severity must reflect the effect on critical services, revenue, safety, and operations, which is why incident response frameworks such as NIST SP 800-61 assess functional and informational impact. Option B (day of the week) does not belong because timing may influence response logistics but is not a severity criterion, and Option E (analyst's personal opinion) is invalid because severity must be determined by objective, repeatable criteria rather than subjective judgment.

Answer

The day of the week the incident occurred

Answer

The analyst's personal opinion

Question 7

You are configuring an Endpoint Security policy to harden Windows 10 devices. Which TWO of the following settings are recommended as best practice to mitigate physical access risks?

Accepted Answer

Enable BitLocker Drive Encryption for all fixed drives.. Option A (Enable BitLocker Drive Encryption for all fixed drives) is correct because full-disk encryption protects data at rest, so if a device is lost or stolen an attacker with physical access cannot read the drive contents without the recovery key or TPM-based authentication. Option E (Disable 'AutoRun' for all removable media) is correct because AutoRun can automatically execute code from USB drives and other removable media, which is a classic physical-access attack vector; disabling it prevents automatic execution of malicious payloads when media is inserted. Options B, C, and D are not the best answers for physical access risks: disabling Windows Store apps and enabling SmartScreen are application/download controls that primarily address software and browsing threats, and a 12-character minimum password length is a general authentication hardening measure rather than a direct mitigation for physical access to the device.

Answer

Disable the 'Allow Windows Store apps' policy.

Answer

Enable 'Microsoft Defender SmartScreen'.

Answer

Set the 'Minimum Password Length' to 12 characters.

Question 8

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

Accepted Answer

Impact. Deleting volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' is a classic pre-ransomware step that removes the victim's ability to restore files from local backups. In MITRE ATT&CK, this maps to T1490 'Inhibit System Recovery,' which falls under the Impact tactic (A). The goal is to maximize the destructive effect of the subsequent encryption by eliminating recovery options.

Answer

Credential Access

Answer

Defense Evasion

Answer

Initial Access

Question 9

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

Accepted Answer

DHCP Snooping. DHCP Snooping is a switch feature that filters untrusted DHCP messages and prevents rogue DHCP servers by allowing DHCP server responses only on trusted ports. Implementing DHCP Snooping will block rogue DHCP servers from assigning IP addresses on the network.

Answer

VLAN Tagging

Answer

Dynamic ARP Inspection

Answer

Port Security

Question 10

A phishing simulation resulted in a user clicking a link. What is the next logical step in the incident response process?

Accepted Answer

Review user activity logs for account compromise. After a user clicks a phishing link, the immediate priority is to determine whether the click resulted in compromise — checking authentication logs, process execution, and network connections for signs of credential theft or malware execution. Reviewing user activity logs is the logical next step because it establishes whether the incident is a benign click or an active compromise, which drives all subsequent response actions. This aligns with the Detection & Analysis phase of incident response.

Answer

Reimage the machine immediately

Answer

Block the domain of the link

Answer

Change the user's password

Question 11

Which TWO of the following are common indicators of a compromised system found during host-based log analysis?

Accepted Answer

Unexpected outbound connections to high-numbered ports. Option B is correct because unexpected outbound connections to high-numbered ports (e.g., 4444, 8080, 31337) often indicate command-and-control (C2) beaconing, reverse shells, or data exfiltration, since legitimate services rarely initiate such traffic from a host. Option D is correct because the creation of new accounts with administrative rights is a classic persistence and privilege-escalation technique attackers use, and it is readily visible in Security event logs (e.g., Windows Event ID 4720 for account creation followed by 4732 for adding to Administrators). Option A is incorrect because stable CPU usage is a sign of normal operation, whereas compromises typically produce spikes, sustained high utilization, or unusual process behavior. Option C is incorrect because standard system update logs reflect routine patching activity and are expected, not an indicator of compromise. Option E is incorrect because successful logins from standard user accounts are normal activity; suspicious indicators would instead be failed login bursts, logins at odd hours, or logins from unusual locations.

Answer

Stable CPU usage patterns

Answer

Standard system update logs

Answer

Successful logins from standard user accounts

Question 12

Which THREE of the following are common 'Impact' techniques?

Accepted Answer

Data encrypted for impact. Data destruction, ransomware encryption, and service disruption are all forms of impact.

Answer

Credential access

Answer

Persistence setup

Question 13

A CISO asks for a list of indicators that should be monitored in the SIEM to detect potential account takeover attempts. Which THREE indicators are most relevant?

Accepted Answer

High volume of failed login attempts followed by a successful login. Option A is correct because a burst of failed authentication attempts immediately followed by a success is the classic brute-force or password-spraying pattern that signals a likely account takeover. Option C is correct because impossible travel detects credential compromise by correlating geographically distant logins within a timeframe that no legitimate user could physically traverse, a strong indicator of stolen credentials. Option D is correct because logins outside a user's established work hours are anomalous behavioral indicators that often accompany unauthorized access, especially when combined with other anomalies. Option B is not a reliable indicator because concurrent sessions from different operating systems can occur legitimately (e.g., a user with a laptop and phone) and lacks the geographic or temporal correlation needed to indicate takeover. Option E is not relevant because access from a known, trusted VPN range is expected legitimate behavior rather than a suspicious indicator.

Answer

Concurrent logins from different operating systems

Answer

Accessing the account from a known VPN IP range

Question 14

Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?

Accepted Answer

Exploit Code Maturity (e.g., is there a public exploit available?).. CVSS scoring includes base metrics like exploit code maturity, environmental impact, and temporal factors to prioritize remediation.

Answer

The number of employees in the department that owns the server.

Answer

The color of the server rack hardware.

Question 15

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

Accepted Answer

Event ID 1. Sysmon Event ID 1 tracks process creation, including command-line arguments and parent process information, which is essential for building a process tree.

Answer

Event ID 3

Answer

Event ID 11

Answer

Event ID 22