CCOA Practice Test 14 — 15 Questions

Question 1

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

Accepted Answer

Physical and Environmental Security. Physical and Environmental Security is the domain within ISO 27001 that covers physical site security.

Answer

Human Resource Security

Answer

Operations Security

Answer

Access Control

Question 2

A SIEM has triggered an alert for 'Excessive Failed Login Attempts' followed by a 'Successful Login'. Which technique is this most likely attempting to detect?

Accepted Answer

Brute force attack. A pattern of excessive failed login attempts immediately followed by a successful login is the classic signature of a brute force attack, where an attacker systematically guesses credentials until one works. The SIEM correlation rule is designed to surface this sequence because the successful login after many failures suggests the attacker eventually guessed the correct password. This is a well-known detection use case in SOC operations.

Answer

Data exfiltration

Answer

DNS tunneling

Answer

Privilege escalation

Question 3

Which of the following best describes the function of a 'container runtime' in a virtualization environment?

Accepted Answer

It executes containerized applications.. A container runtime is the software layer that actually executes containers — it pulls images, creates namespaces and cgroups, and runs the containerized process. Examples include containerd, CRI-O, and Docker's runtime. It sits below the orchestrator (like Kubernetes) and above the OS kernel, translating container specs into running processes.

Answer

It encrypts network traffic between nodes.

Answer

It virtualizes the hardware layer.

Answer

It provides a web GUI for managing clusters.

Question 4

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

Remove the threat or root cause. The Eradication phase in incident response is specifically focused on eliminating the threat actor's presence and removing the root cause of the incident — deleting malware, closing exploited vulnerabilities, disabling compromised accounts, and patching the entry vector. This is distinct from containment (stopping spread) and recovery (restoring normal operations). The goal is to ensure the threat cannot persist or re-emerge once recovery begins.

Answer

Identify the attacker

Answer

Improve future security posture

Answer

Restore service to normal

Question 5

In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?

Accepted Answer

Protocol: TCP, Port: 443, Source: 10.0.1.0/24. A Security Group rule must match the protocol and port of the intended traffic and scope the source as narrowly as possible. HTTPS uses TCP port 443, and restricting the source to 10.0.1.0/24 limits inbound connections to that specific subnet, satisfying least privilege. This is the only option that combines the correct protocol, correct port, and a scoped source.

Answer

Protocol: UDP, Port: 443, Source: 10.0.1.0/24

Answer

Protocol: TCP, Port: 80, Source: 10.0.1.0/24

Answer

Protocol: All Traffic, Port: All, Source: 0.0.0.0/0

Question 6

A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?

Accepted Answer

Resource Monitor. Resource Monitor (resmon.exe) provides per-process disk activity, including read/write bytes per second and which files each process is touching, making it the right tool to pinpoint the top writer. It breaks down disk usage by process, file, and response time, which is exactly what is needed for high disk I/O triage. Task Manager shows aggregate disk percentage but not the granular per-process write volume required here.

Answer

System Configuration (msconfig)

Answer

Event Viewer

Answer

Task Manager

Question 7

A multinational retailer is expanding into a new country and must comply with that country's data protection law, which requires personal data of citizens to remain within national borders. The security team is asked to recommend an architecture that satisfies this requirement while still allowing the global analytics team to process aggregated, non-personal data. Which approach BEST meets these constraints?

Accepted Answer

Deploy a local data center or in-country cloud region for personal data and replicate only anonymized or aggregated datasets to the global analytics platform.. Data localization laws require personal data to remain within national borders. The only approach that satisfies this while enabling global analytics is to keep personal data in-country and share only anonymized or aggregated datasets externally. Contractual clauses, encryption with local keys, and CDN caching do not change where the data resides and therefore fail the requirement.

Answer

Use a content delivery network (CDN) to cache personal data at edge locations closest to citizens.

Answer

Store all personal data in the retailer's existing global cloud region and rely on standard contractual clauses for transfers.

Answer

Encrypt personal data with customer-managed keys and store it in the global cloud region, providing keys only to local staff.

Question 8

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Accepted Answer

Email filtering policies. T1566 Phishing is an initial-access technique delivered primarily via email, so email filtering policies that block malicious senders, attachments, and URLs are the most direct and effective control. Defender for Endpoint integrates with Exchange Online Protection and Defender for Office 365 to inspect inbound mail and neutralize phishing before it reaches the endpoint. This addresses the attack at its delivery vector.

Answer

Network Isolation

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control

Question 9

Which THREE of the following are standard best practices for securing cloud infrastructure?

Accepted Answer

Enable comprehensive audit logging. Option A (Enable comprehensive audit logging) is correct because capturing API activity, authentication events, and resource changes via services like AWS CloudTrail, Azure Monitor/Activity Log, or GCP Cloud Audit Logs provides the traceability needed for detection, incident response, and compliance. Option B (Enable Multi-Factor Authentication) is correct because MFA adds a second authentication factor beyond a password, mitigating credential theft, phishing, and brute-force attacks on privileged cloud accounts. Option D (Implement Principle of Least Privilege) is correct because granting identities only the minimum permissions required (scoped IAM policies, roles, and just-in-time access) reduces the blast radius of compromised credentials or misconfigured services. Option C is wrong because sharing account passwords destroys individual accountability and non-repudiation, and violates standard identity practices; unique named accounts with federation or role assumption should be used instead. Option E is wrong because exposing resources only via public IP addresses increases the attack surface and ignores private networking constructs such as VPCs, private subnets, security groups, and private endpoints.

Answer

Share account passwords between team members

Answer

Use only public IP addresses

Question 10

Which TWO tools are commonly used for memory forensic analysis?

Accepted Answer

Rekall. Rekall (A) is a memory forensics framework derived from Volatility that analyzes RAM captures (e.g., raw, crash dump, hibernation files) to extract processes, network connections, and injected code, making it a standard memory-analysis tool. Volatility (D) is the most widely used open-source memory forensics framework, supporting plugins like pslist, netscan, and malfind against memory images to reconstruct system state. Nmap (B) is a network port scanner used for host discovery and service enumeration, not memory analysis. Hashcat (C) is a password-recovery tool that performs GPU-accelerated hash cracking, unrelated to parsing memory images. Wireshark (E) is a packet analyzer for capturing and inspecting network traffic (pcap), not volatile memory contents.

Answer

Nmap

Answer

Hashcat

Answer

Wireshark

Question 11

You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?

Accepted Answer

Process creation logs (e.g., Sysmon Event ID 1). LotL attacks use legitimate system tools like PowerShell or WMI; therefore, process execution logs with command-line arguments are essential.

Answer

Firewall denied logs

Answer

Physical access logs

Answer

SMTP gateway logs

Question 12

You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?

Accepted Answer

The server hosts the primary company e-commerce database with customer credit card data.. Option B is correct because hosting the primary e-commerce database that stores customer credit card data makes the asset critical: it processes and holds regulated cardholder data (PCI DSS scope), so its compromise would cause severe financial, legal, and reputational damage. Option C is correct because the server is required for the core 'Order Processing' function to remain operational, meaning its failure directly halts a business-critical process, which is the defining characteristic of a Critical asset in a vulnerability assessment. Options A and E describe low-impact, non-essential assets (internal UI prototype testing and a lobby printer connection) that would typically be rated low or medium, not Critical. Option D does not indicate criticality at all; an outdated Java version is a vulnerability finding that raises risk on whatever asset it resides, but it says nothing about the asset's business importance or data sensitivity.

Answer

The server is used for testing internal UI prototypes.

Answer

The server has an outdated version of Java installed.

Answer

The server is connected to a printer in the lobby.

Question 13

Which THREE of the following are 'Command and Control' techniques?

Accepted Answer

Standard application layer protocol. Web service protocols, non-standard port traffic, and standard application layer protocols are all C2 channels.

Answer

Registry modification

Answer

Credential dumping

Question 14

You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?

Accepted Answer

CrowdStrike 'Host Management'.. The CrowdStrike Falcon 'Host Management' dashboard provides a consolidated view of all endpoints with the Falcon sensor installed, showing sensor status, last check-in time, and version information. It is the designated interface for verifying agent health and coverage across the organization. Administrators use it to identify endpoints that are missing the sensor or have stopped reporting.

Answer

CrowdStrike 'Custom Detections'.

Answer

CrowdStrike 'Threat Graph'.

Answer

CrowdStrike 'Zero Trust Assessment'.

Question 15

When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?

Accepted Answer

The date when the asset was last patched.. The date an asset was last patched is a vulnerability-management metric, not a criterion for determining business criticality. Criticality should reflect the asset's importance to the organization based on data sensitivity, regulatory scope, and operational impact—not its maintenance history. Patch recency tells you about hygiene, not about how much damage a compromise would cause.

Answer

The regulatory requirements associated with the asset (e.g., PCI-DSS/HIPAA).

Answer

The sensitivity of data residing on the asset.

Answer

The impact to business operations if the asset is offline.