CCOA Practice Test 15 — 15 Questions

Question 1

You are configuring a SIEM alert to trigger when a user account is locked out. Which Windows Event ID should your filter target?

Accepted Answer

Event ID 4740. Event ID 4740 is the standard Windows Security log event for an account lockout.

Answer

Event ID 4625

Answer

Event ID 4728

Answer

Event ID 4624

Question 2

A vulnerability report shows that your web application is susceptible to 'Clickjacking'. Which HTTP header should you implement to mitigate this?

Accepted Answer

X-Frame-Options: DENY. The 'X-Frame-Options' header (or the more modern 'Content-Security-Policy: frame-ancestors') prevents a site from being rendered within an iframe on an external site.

Answer

Access-Control-Allow-Origin: *

Answer

Strict-Transport-Security: max-age=31536000

Answer

X-Content-Type-Options: nosniff

Question 3

A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?

Accepted Answer

Least Privilege. The principle of Least Privilege dictates that users should only have the minimum level of access required to perform their job functions.

Answer

Accountability

Answer

Separation of Duties

Answer

Need to know

Question 4

You are implementing 'Just-in-Time' (JIT) access for Azure Virtual Machines using Microsoft Defender for Cloud. A developer complains they cannot request access to a VM. What is the most likely reason?

Accepted Answer

The developer lacks the required Azure RBAC permissions to modify the Network Security Group associated with the VM.. Defender for Cloud's JIT VM Access requires the user to have specific RBAC permissions (typically 'Microsoft.Compute/virtualMachines/write') on the resource group or subscription.

Answer

The VM is not joined to an Azure Active Directory domain.

Answer

The developer lacks the 'Security Reader' role, which is mandatory for requesting JIT access.

Answer

The developer has not enabled 'Multi-Factor Authentication' on their local machine.

Question 5

You are reviewing a list of vulnerabilities found by an automated scanner. Which type of vulnerability would be considered the most critical to remediate first?

Accepted Answer

Remote Code Execution (RCE) on an internet-facing application.. An RCE (Remote Code Execution) vulnerability allows an attacker to execute arbitrary code with the privileges of the application, representing the highest possible threat.

Answer

Unsupported software version that has no known exploits.

Answer

Information Disclosure of internal server paths.

Answer

Insecure cookie attributes (missing HttpOnly).

Question 6

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

Accepted Answer

Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. The standard path for local security policy settings in GPO is Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.

Answer

Computer Configuration > System Settings > Advanced > Security

Answer

User Configuration > Preferences > Control Panel Settings > Local Users and Groups

Answer

Computer Configuration > Administrative Templates > Windows Components > Password

Question 7

You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?

Accepted Answer

AIDE. AIDE (Advanced Intrusion Detection Environment) is a file integrity checker that monitors system files against a baseline hash database.

Answer

firewalld

Answer

systemctl status

Answer

yum check-update

Question 8

You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?

Accepted Answer

TLS. TLS (Transport Layer Security) is the industry standard for encrypting data in transit between clients and databases.

Answer

Hashing

Answer

VPN

Answer

AES-256

Question 9

Which type of log provides the most granular detail regarding local account creation on a Windows Server?

Accepted Answer

Security logs. Windows Security Event Logs (specifically Event ID 4720) record the creation of new user accounts, providing the most granular detail.

Answer

System logs

Answer

Application logs

Answer

DNS logs

Question 10

You are performing a credentialed vulnerability scan using Nessus Professional on a Linux server. The scan reports that the 'Remote Windows SMB' service is missing patches, but the target is Linux. What is the most likely cause of this discrepancy?

Accepted Answer

The Nessus scanner has performed a fingerprinting mismatch due to an incorrect 'Credentialed Patch Audit' policy setting.. This is a common issue when the 'Safe Checks' are enabled or when the SSH service is configured to allow legacy protocols that trigger incorrect plugin attribution in the vulnerability database.

Answer

The scanner is configured to run 'Non-Credentialed' scans only, resulting in false positives.

Answer

The Linux server is hosting a Windows VM, and the scanner is reporting on the guest OS.

Answer

The Linux server has Samba installed, and the vulnerability scanner is correctly identifying a vulnerability in the SMB stack.

Question 11

Which THREE of the following represent critical areas to inspect when a web application has been suspected of an injection attack?

Accepted Answer

Application and database logs. Input sanitization, database query logic, and logs are the primary areas to investigate during an injection incident.

Answer

Screen resolution settings

Answer

Network cable integrity

Question 12

Which TWO of the following are essential components of a secure network design for a segmented corporate network?

Accepted Answer

Virtual Local Area Networks (VLANs). VLANs provide logical isolation, and Firewalls provide traffic control between those segments.

Answer

Shared administrative credentials

Answer

Hubs to connect all devices

Answer

Disabling all internal logging

Question 13

When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?

Accepted Answer

The date when the asset was last patched.. Asset criticality is based on business value, regulatory impact, and data sensitivity; 'last patch date' is a hygiene metric, not a classification criterion.

Answer

The regulatory requirements associated with the asset (e.g., PCI-DSS/HIPAA).

Answer

The sensitivity of data residing on the asset.

Answer

The impact to business operations if the asset is offline.

Question 14

You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?

Accepted Answer

CrowdStrike 'Host Management'.. The CrowdStrike 'Host Management' dashboard provides a real-time view of sensor status, version, and connectivity.

Answer

CrowdStrike 'Custom Detections'.

Answer

CrowdStrike 'Threat Graph'.

Answer

CrowdStrike 'Zero Trust Assessment'.

Question 15

You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?

Accepted Answer

iptables -A INPUT -s 192.168.10.0/24 -j DROP. The 'iptables -A INPUT -s [network] -j DROP' syntax correctly appends a rule to the INPUT chain to drop traffic from the specified source.

Answer

iptables -I OUTPUT -d 192.168.10.0/24 -j REJECT

Answer

iptables -A FORWARD -s 192.168.10.0/24 -j DROP

Answer

iptables -A INPUT -d 192.168.10.0/24 -j DROP