CCOA Practice Test 15 — 15 Questions

Question 1

Which TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?

Accepted Answer

Isolate the infected network segment to prevent lateral movement. Option B is correct because isolating the infected network segment during Containment limits an attacker's ability to move laterally to other hosts, a core containment objective that preserves evidence while stopping the spread. Option E is correct because disabling compromised user accounts revokes the attacker's authenticated access and prevents further abuse of those credentials, which is a standard containment action. Option A is not a containment best practice since immediately re-imaging the server destroys volatile evidence and is properly a recovery/eradication step. Option C is wrong because shutting down the entire corporate firewall would disrupt all network traffic and remove a key defensive control rather than contain the incident. Option D is incorrect because notifying law enforcement is a coordination/communication activity, not a technical containment action, and is only done when warranted.

Answer

Re-image the compromised server immediately to restore service

Answer

Shut down the entire corporate firewall

Answer

Notify the local police department

Question 2

Which THREE techniques do attackers use to maintain persistence on a Windows host?

Accepted Answer

Installing a malicious system service. Persistence is maintained by registering code with startup processes (Registry), system services, or scheduled tasks.

Answer

Changing the desktop background

Answer

Updating the browser's homepage

Question 3

Which THREE steps are part of the 'Preparation' phase of incident response?

Accepted Answer

Defining security policies. Option A (Defining security policies) is correct because the Preparation phase establishes the governance foundation—policies, procedures, and playbooks—that dictate how incidents will be detected, escalated, and handled before any event occurs. Option D (Training the incident response team) is correct because personnel readiness through regular training and exercises is a core Preparation activity that ensures the team can execute the plan effectively. Option E (Acquiring necessary forensic tools) is correct because provisioning and maintaining tools such as disk imagers, memory capture utilities, and network analysis software must be done ahead of time so responders are equipped when an incident strikes. Option B (Recovering from the incident) belongs to the Containment, Eradication, and Recovery phase, and Option C (Analyzing the log files) is part of the Detection and Analysis phase, so neither is a Preparation step.

Answer

Recovering from the incident

Answer

Analyzing the log files

Question 4

Which THREE of the following are examples of 'Access Control' implementations?

Accepted Answer

Setting file system permissions (e.g., Read/Write/Execute).. Access control is about determining who or what may access a resource and under what conditions, so option A is correct because setting file system permissions such as Read, Write, and Execute directly enforces which users or groups can perform specific operations on files and directories. Option B is correct because Role-Based Access Control (RBAC) on file shares assigns permissions through roles, so users inherit access rights based on their job function rather than individual identity, which is a classic access control model. Option E is correct because requiring Multi-Factor Authentication (MFA) for all remote logins strengthens authentication before access is granted, and authentication is a core component of access control that verifies identity prior to authorization. Option C is incorrect because cleaning the office floor is a physical maintenance task, not a mechanism for controlling access to information or systems. Option D is incorrect because using a high-quality monitor for security logs only improves visibility for monitoring or review and does not itself grant, deny, or constrain access to any resource.

Answer

Cleaning the office floor daily.

Answer

Using a high-quality monitor for security logs.

Question 5

When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?

Accepted Answer

Loaded DLLs and system handles. Fileless malware resides in memory and often leaves traces in process structures, injected code, and handles.

Answer

Browser history files

Answer

Unallocated space in the master file table

Question 6

A security analyst is triaging an alert about an unauthorized login from an unusual country. What is the first priority in the response workflow?

Accepted Answer

Verify the incident with the user or manager. Verifying the incident (confirming if it was a legitimate user traveling or an actual breach) is the vital first step to prevent unnecessary incident escalation.

Answer

Disable the user account immediately

Answer

Notify legal counsel

Answer

Reimage the user's laptop

Question 7

After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?

Accepted Answer

RAM image first, then disk. Memory (RAM) should be captured before disk storage because memory content is lost as soon as the machine is powered off or rebooted.

Answer

Network traffic logs, then RAM

Answer

Disk image first, then RAM

Answer

Reboot the machine, then image

Question 8

Which TWO of the following are examples of 'Persistence' tactics?

Accepted Answer

Scheduled tasks. Creating scheduled tasks and adding items to the Startup folder are standard ways to ensure malware survives reboot.

Answer

Credential dumping

Answer

Port scanning

Answer

Data encryption

Question 9

Which TWO of the following are primary security controls for securing virtual machines in a production environment?

Accepted Answer

Hypervisor patching. Hypervisor patching (A) is a primary security control because the hypervisor is the trusted computing base that isolates and mediates access between VMs; unpatched hypervisor vulnerabilities (e.g., escape flaws) can let a guest compromise the host and other VMs, so keeping it current is essential. Guest OS patch management (D) is also a primary control because each VM runs its own operating system whose unpatched services, kernels, and libraries are directly exploitable from the network, making OS-level patching necessary to harden the VM itself. Providing full physical access to the VM (B) is not a control but a risk, since physical access enables console tampering, data theft, and bypass of logical protections. Using only physical cabling (C) is irrelevant to VM security, as virtualization relies on virtual switches and logical networking rather than physical cabling alone. Disabling VM encryption (E) weakens security by removing protection for data at rest and in transit, so it is the opposite of a control.

Answer

Providing full physical access to the VM

Answer

Using only physical cabling

Answer

Disabling VM encryption

Question 10

You are the cybersecurity operations analyst for a hospital network. A workstation in the radiology department was compromised and used to pivot to the PACS image archive. During the post-incident review, the CISO asks which control would have most directly limited the attacker's ability to move laterally from the workstation to the archive server. Which of the following should you recommend?

Accepted Answer

Enforcing network segmentation with deny-by-default rules between clinical workstation VLANs and the PACS server VLAN. Lateral movement from a compromised clinical workstation to a PACS archive is an east-west traffic problem best solved by network segmentation. Deny-by-default rules between workstation and server VLANs, allowing only required DICOM flows, contain the attacker regardless of the initial access vector. Endpoint detection, password policy, and packet capture improve visibility or initial access resistance but do not block the pivot path itself.

Answer

Increasing the password complexity requirements for all radiology staff domain accounts

Answer

Enabling full packet capture on the core switch for later forensic analysis

Answer

Deploying endpoint detection and response agents on all radiology workstations

Question 11

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

Accepted Answer

Browser 'Login Data' SQLite databases. Password stores include browser data, local vaults, and credential managers.

Answer

Active Directory logs

Answer

Network packets

Answer

System logs

Question 12

A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?

Accepted Answer

Recover. The NIST CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Recover is the function focused on resilience and restoring capabilities.

Answer

Detect

Answer

Protect

Answer

Identify

Question 13

A software company operates a continuous integration pipeline where developers can push code directly to production branches. A recent post-incident review found that a single compromised developer credential allowed malicious code to reach customers. Which change to the pipeline's control environment MOST directly reduces this specific risk?

Accepted Answer

Require peer review and automated security testing before any code can merge into production branches.. The incident stemmed from unreviewed code reaching production through valid credentials, so the most direct fix is a mandatory verification gate before merge. Peer review plus automated security testing prevents a compromised credential from deploying malicious changes. Scanning cadence, rotation, and logging improve visibility or hygiene but do not block the deployment path that caused customer impact.

Answer

Increase the frequency of static application security testing scans across all repositories.

Answer

Rotate all developer credentials every ninety days and enforce a stronger password complexity policy.

Answer

Enable verbose logging on the production branch so all pushes are recorded for later forensic review.

Question 14

When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?

Accepted Answer

ssdt. The ssdt plugin (B) is correct because it parses the System Service Descriptor Table and compares the in-memory handler addresses against expected kernel functions, exposing hooks that kernel-mode rootkits use to intercept system calls. The modules plugin (D) is correct because it walks the kernel's loaded module list (PsLoadedModuleList) to reveal loaded drivers and kernel modules, allowing detection of suspicious or unlinked drivers typical of rootkits. pslist (A) only enumerates active processes from the process list and does not inspect kernel structures, so it is ineffective for kernel-mode rootkit detection. hashdump (C) extracts password hashes from the SAM, which is unrelated to identifying kernel rootkits. hivelist (E) lists registry hives in memory and does not analyze kernel code or driver integrity.

Answer

pslist

Answer

hashdump

Answer

hivelist

Question 15

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Accepted Answer

Advanced Security Settings - Effective Access. The Effective Access tab in Advanced Security Settings calculates the cumulative permissions a specific user or group has on a file or folder, taking into account group memberships, inheritance, and explicit deny entries. This directly answers whether the service account has the required Execute or Read permissions on the executable.

Answer

Task Manager - Details tab

Answer

Local Security Policy (secpol.msc)

Answer

Event Viewer - System Log