CCOA Practice Test 13 — 15 Questions

Question 1

Which of the following best describes the function of a 'container runtime' in a virtualization environment?

Accepted Answer

It executes containerized applications.. The container runtime is responsible for executing containers and managing image layers and namespaces.

Answer

It encrypts network traffic between nodes.

Answer

It virtualizes the hardware layer.

Answer

It provides a web GUI for managing clusters.

Question 2

An analyst needs to verify the hash of a downloaded binary to ensure it has not been tampered with. Which command is used on Windows PowerShell?

Accepted Answer

Get-FileHash. Get-FileHash is the native PowerShell cmdlet for calculating file integrity hashes like SHA256.

Answer

Hash-File

Answer

Verify-Binary

Answer

Check-Sum

Question 3

Which TWO of the following are considered 'Defense Evasion' techniques?

Accepted Answer

Masquerading. Clearing logs and masquerading as a legitimate process are used to avoid detection.

Answer

Account manipulation

Answer

Data staging

Answer

Remote service creation

Question 4

Which TWO elements should be included when performing threat modeling using the STRIDE methodology?

Accepted Answer

Identify data flows. STRIDE focuses on identifying threats based on specific categories like Spoofing and Information Disclosure.

Answer

Perform vulnerability scan

Answer

Conduct penetration test

Answer

Budget approval

Question 5

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Accepted Answer

Email filtering policies. Defender for Office 365 / MDE integration provides specialized filtering for malicious attachments and URLs linked to phishing.

Answer

Network Isolation

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control

Question 6

In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?

Accepted Answer

Threat Event Frequency and Vulnerability. FAIR defines Loss Event Frequency as the combination of Threat Event Frequency and Vulnerability (the probability that a threat event results in a loss).

Answer

Inherent risk and residual risk

Answer

Threat capability and control strength

Answer

Asset value and threat actor motivation

Question 7

What is the primary function of a 'C2 Beacon'?

Accepted Answer

To periodically check for new tasks. Beacons are small packets sent periodically from the infected host to the attacker's server to check for instructions.

Answer

To encrypt the local drive

Answer

To log user keystrokes

Answer

To transfer large files

Question 8

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

Accepted Answer

Impact. Deleting shadow copies is a specific technique used to hinder forensic analysis and recovery, categorized under Impact.

Answer

Credential Access

Answer

Defense Evasion

Answer

Initial Access

Question 9

Which THREE of the following are common 'Exfiltration' techniques?

Accepted Answer

Exfiltration over alternative protocol. Using cloud storage, scheduled transfers, and network protocols are common ways to move data out.

Answer

Keylogging

Answer

File system enumeration

Question 10

Which THREE factors are commonly used to calculate risk in a basic qualitative model?

Accepted Answer

Impact. Risk is typically defined by the combination of a threat, the vulnerability, and the potential impact.

Answer

System age

Answer

Vendor name

Question 11

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

Accepted Answer

It evades detection by appearing as normal activity. LotL binaries are legitimate system tools, making them harder to flag as malicious by signature-based defenses.

Answer

It is faster to execute

Answer

It is easier to compile

Answer

It requires less memory

Question 12

What is the primary difference between a Red Team and a Blue Team in a security simulation?

Accepted Answer

Red Team acts as the adversary, Blue Team performs incident response. The Red Team performs the offensive actions to emulate threats, while the Blue Team defends and monitors.

Answer

Red Team creates policy, Blue Team audits it

Answer

Red Team handles infrastructure, Blue Team handles software

Answer

Red Team identifies vulnerabilities, Blue Team remediates them

Question 13

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

Accepted Answer

Exfiltration. This is a form of Exfiltration.

Answer

Execution

Answer

Discovery

Answer

Persistence

Question 14

An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?

Accepted Answer

Distributed Denial of Service (DDoS) attack. Availability ensures systems are up. A Distributed Denial of Service (DDoS) attack explicitly targets uptime.

Answer

Packet sniffing on the wire

Answer

Replay attack

Answer

Unauthorized data modification

Question 15

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

Accepted Answer

Monitor for handle access to lsass.exe. LSASS.exe is the process that handles local security; monitoring it for non-system process access is a high-fidelity detection method.

Answer

Monitor for lsass.exe process termination

Answer

Monitor for failed login attempts

Answer

Monitor registry read operations