CCOA Practice Test 14 — 15 Questions

Question 1

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Accepted Answer

Exploiting an exposed VPN gateway. T1133 involves exploiting VPNs, Citrix, or other external-facing access points to enter a network.

Answer

Exploiting an internal web server

Answer

Phishing a user

Answer

Using a USB drive

Question 2

Which document outlines the formal commitment of top management to support information security objectives?

Accepted Answer

Information Security Policy (ISP). The Information Security Policy (ISP) is the foundational document signed by management showing their commitment and authority.

Answer

System Security Plan (SSP)

Answer

Business Impact Analysis (BIA)

Answer

Standard Operating Procedure (SOP)

Question 3

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

Accepted Answer

A central database containing customer Personally Identifiable Information (PII) and credit card data.. Assets that hold PII, financial data, or are critical to core business functions are universally classified as 'High'.

Answer

A guest Wi-Fi access point used for public internet access.

Answer

A local printer used for departmental documents.

Answer

An internal employee breakroom display showing weather and news.

Question 4

You are auditing your cloud environment for 'Shadow IT'. Which TWO of the following methods are effective for identifying unauthorized assets?

Accepted Answer

Reviewing firewall logs for connections to known cloud service provider CIDR blocks.. Cloud access security brokers (CASB) and firewall/proxy logs are the primary visibility points for detecting traffic to unauthorized cloud services.

Answer

Scanning the corporate network using Nmap for open ports.

Answer

Interviewing all employees about their work habits.

Answer

Checking the physical office layout.

Question 5

A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?

Accepted Answer

An explicit Deny entry is present.. In Windows, an explicit 'Deny' permission always overrides any 'Allow' permissions granted through other groups.

Answer

The server is offline.

Answer

The drive is full.

Answer

They are not in the correct group.

Question 6

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

Accepted Answer

PowerShell scripts. Execution involves running malicious code on a system.

Answer

Password spraying

Answer

Data encryption

Answer

Network mapping

Question 7

When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?

Accepted Answer

The VM acts as a direct node on the physical network.. Bridged networking gives the VM its own IP on the physical network, exposing it directly to network-based attacks like the host machine.

Answer

The VM is isolated from the physical network.

Answer

The VM can only communicate with the host.

Answer

The VM uses the host's IP address.

Question 8

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

Accepted Answer

WriteProcessMemory to a remote process. Process hollowing involves creating a legitimate process in a suspended state and replacing its memory with malicious code, a hallmark of execution techniques.

Answer

CreateServiceW

Answer

GetSystemTime

Answer

RegCreateKeyEx

Question 9

Which TWO of the following are primary functions of an Information Security Governance program?

Accepted Answer

Strategic alignment. Governance ensures security aligns with business goals and manages risk effectively.

Answer

Writing code

Answer

Wiring network cables

Answer

Patching server OS

Question 10

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Accepted Answer

Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.. The Nessus Agent must communicate with the Tenable.io platform via a specific port. If the agent isn't showing up, checking the link status and connectivity to the cloud backend is the primary requirement.

Answer

Reinstall the Nessus Agent using the 'Force Install' flag.

Answer

Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.

Answer

Restart the Windows Management Instrumentation (WMI) service.

Question 11

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

Accepted Answer

Defense Evasion. Clearing logs is an explicit attempt to remove traces of activity to evade detection.

Answer

Impact

Answer

Persistence

Answer

Discovery

Question 12

What is the primary goal of the 'Command and Control' (C2) tactic?

Accepted Answer

To manage the compromised host and receive instructions. C2 is about maintaining a communication channel between the compromised host and the attacker's infrastructure.

Answer

To encrypt data

Answer

To create user accounts

Answer

To steal user credentials

Question 13

You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?

Accepted Answer

Software. The 'Software' object in MITRE ATT&CK describes the tools used by adversaries to perform techniques.

Answer

Tactic

Answer

Group

Answer

Technique

Question 14

You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?

Accepted Answer

Implement cryptographic hashing/digital signatures. Tampering threats involve unauthorized modification of data. Digital signatures and integrity checks ensure that data has not been altered.

Answer

Implement TLS encryption

Answer

Implement logging and auditing

Answer

Implement Role-Based Access Control

Question 15

What is the primary objective of a 'Business Impact Analysis' (BIA)?

Accepted Answer

To determine the criticality of business processes. The BIA identifies the potential consequences of disruption to business functions and processes.

Answer

To identify all system vulnerabilities

Answer

To test incident response playbooks

Answer

To create a list of software patches