CCOA Practice Test 16 — 15 Questions

Question 1

Which of these is a typical 'Lateral Movement' technique?

Accepted Answer

Using RDP. Remote Desktop Protocol (RDP) is a standard tool used by adversaries to move laterally between machines.

Answer

Running a keylogger

Answer

Encrypting local files

Answer

Setting a registry key

Question 2

Which document outlines the formal commitment of top management to support information security objectives?

Accepted Answer

Information Security Policy (ISP). The Information Security Policy (ISP) is the top-level governance document that formally expresses management's commitment to information security objectives, defines the security program's scope, and assigns responsibilities. It is signed by executive leadership and serves as the foundation from which all lower-level standards, procedures, and guidelines derive. This is the canonical answer for demonstrating management support in frameworks like ISO 27001 and NIST.

Answer

System Security Plan (SSP)

Answer

Business Impact Analysis (BIA)

Answer

Standard Operating Procedure (SOP)

Question 3

You are investigating a potential credential harvesting site. Which tool is best suited to safely inspect the site without triggering a potential infection?

Accepted Answer

An isolated sandbox or VM. An isolated sandbox or VM is the correct choice because it provides a contained environment where any malicious payload, drive-by download, or exploit triggered by visiting the credential harvesting site is confined and cannot affect the analyst's production workstation or corporate network. This allows safe inspection of the site's behavior, redirects, and payloads without risking infection of the host system.

Answer

A local web browser

Answer

A command-line curl request

Answer

The organization's proxy server

Question 4

You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?

Accepted Answer

Use the 'Isolate Endpoint' feature in your EDR (e.g., CrowdStrike or Defender) to restrict network communication.. Using the EDR 'Isolate Endpoint' feature immediately cuts the laptop's network communication while preserving the agent's management channel, allowing the security team to investigate, collect forensic artifacts, and remediate remotely. This is the fastest, most effective containment action because it stops command-and-control and lateral movement without destroying evidence. It is the standard incident response containment step for a compromised endpoint.

Answer

Power off the laptop immediately to preserve volatile memory.

Answer

Delete the user account associated with the laptop in Active Directory.

Answer

Physically disconnect the ethernet cable from the building patch panel.

Question 5

A security analyst is quantifying risk for a new e-commerce platform. The asset value is $500,000, the exposure factor for a successful DDoS attack is 20%, and the annualized rate of occurrence is 3. What is the annualized loss expectancy (ALE)?

Accepted Answer

$300,000. Quantitative risk analysis uses ALE = SLE x ARO. Here the SLE is the asset value times the exposure factor ($500,000 x 0.20 = $100,000), and the ARO is 3, so the ALE is $300,000. This expected annual loss figure is what analysts compare against the cost of controls to determine whether a mitigation is cost-effective.

Answer

$1,500,000

Answer

$30,000

Answer

$100,000

Question 6

You are investigating a suspected data exfiltration incident. You need to analyze network traffic captured in a PCAP file. Which tool is the industry standard for performing deep packet inspection and protocol analysis during this investigation?

Accepted Answer

Wireshark. Wireshark is the industry-standard tool for deep packet inspection and protocol analysis, supporting hundreds of protocols, rich filtering (display and capture filters), and stream reconstruction. It is the go-to for analyzing PCAP files during incident response and forensic investigations. Its ability to decode, follow TCP/UDP streams, and export objects makes it ideal for exfiltration analysis.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 7

During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?

Accepted Answer

Modify the analytic rule logic using a 'where' clause to exclude the account entity from a Watchlist. Modifying the analytic rule logic to exclude the noisy service account using a 'where' clause with a Watchlist is the most effective approach because it allows granular exclusion without disabling the rule. Watchlists in Microsoft Sentinel provide a dynamic way to maintain lists of entities to exclude, and the rule continues to monitor other activities.

Answer

Delete the analytic rule and recreate it with a higher threshold

Answer

Disable the alert in the Data Connector settings

Answer

Set the incident severity to 'Informational'

Question 8

You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?

Accepted Answer

Use the 'Top values' aggregation on the source IP field in a Lens visualization. Using the 'Top values' aggregation on the source IP field in a Lens visualization is the most efficient way to get the top 10 unique source IPs for a specific destination over the last hour in Kibana. Lens allows you to create a chart that aggregates and ranks values, and you can filter by destination and time range.

Answer

Run an 'Update By Query' API call

Answer

Use a regex filter in the search bar

Answer

Export all logs to CSV and use Excel

Question 9

Which THREE factors are commonly used to calculate risk in a basic qualitative model?

Accepted Answer

Impact. In a basic qualitative risk model, risk is typically expressed as a function of the likelihood of a threat exploiting a weakness and the resulting impact on the organization, so option B (Impact) is correct because it captures the severity of harm if an adverse event occurs, and option D (Threat) is correct because it represents the potential source or event that could cause harm. Option E (Vulnerability) is also correct because it is the weakness or gap that a threat can exploit, and combining threat likelihood with vulnerability and impact is the standard qualitative formula (Risk = Threat × Vulnerability × Impact). The unmarked options do not belong: option A (System age) is an asset attribute that might influence likelihood but is not itself a core risk factor in the basic model, and option C (Vendor name) is irrelevant to calculating risk because it identifies a supplier rather than a threat, vulnerability, or impact component.

Answer

System age

Answer

Vendor name

Question 10

You are analyzing logs to detect a 'Lateral Movement' attack. Which THREE of the following behaviors are common indicators?

Accepted Answer

A user logging into 20 different workstations in 5 minutes.. Option A is correct because a single user authenticating to 20 different workstations within 5 minutes is a classic lateral-movement pattern, indicating credential reuse or automated spreading across hosts (e.g., via PsExec or SMB) rather than normal interactive work. Option D is correct because a sudden spike in RPC/WMI traffic between two internal servers often reflects remote execution and service control used by tools like Impacket's wmiexec or CrackMapExec to pivot between systems. Option E is correct because multiple successful logins with the same credential set from one internal source IP indicates an attacker using harvested credentials to authenticate to many targets from a compromised foothold, a hallmark of lateral movement. Option B does not belong because a single, expected 9:00 AM domain-controller logon by an administrator is routine administrative activity, not anomalous. Option C does not belong because changing a desktop background is a benign user action with no bearing on authentication, remote execution, or host-to-host pivoting.

Answer

An administrator logging into the domain controller once at 9:00 AM.

Answer

The user changing their desktop background image.

Question 11

Which THREE of the following represent critical areas to inspect when a web application has been suspected of an injection attack?

Accepted Answer

Application and database logs. Option A (Application and database logs) is correct because logs are the primary forensic evidence for an injection attack — web server access logs, application error logs, and database audit/SQL logs can reveal malicious payloads such as ' OR '1'='1, UNION SELECT statements, or unexpected error messages that indicate injected queries. Option B (Input validation routines) is correct because injection flaws typically stem from missing or improper validation/sanitization of user-supplied input, so reviewing how the application validates, filters, and escapes input (e.g., whitelisting, parameterization, encoding) directly identifies the vulnerability that allowed the attack. Option D (Database query construction) is correct because the way queries are built determines exploitability — inspecting for string concatenation of user input into SQL/NoSQL/LDAP queries versus the use of parameterized queries or prepared statements reveals the root cause of the injection. Option C (Screen resolution settings) is irrelevant because display configuration has no bearing on how input is processed or how queries are executed. Option E (Network cable integrity) is irrelevant because physical cabling issues relate to connectivity, not to application-layer injection vulnerabilities or their evidence.

Answer

Screen resolution settings

Answer

Network cable integrity

Question 12

Which TWO documents are essential to provide to a forensic investigator?

Accepted Answer

Chain of Custody form. The Chain of Custody form (C) is essential because it documents who collected, handled, transferred, and accessed each piece of evidence, along with timestamps and signatures, which preserves the evidence's integrity and admissibility in legal or disciplinary proceedings. The Incident timeline (D) is essential because it establishes the chronological sequence of events—detection, containment, eradication, and recovery—allowing the investigator to correlate system logs, user activity, and forensic artifacts to reconstruct exactly what happened and when. Together these two documents give the investigator both the evidentiary provenance and the temporal context needed for a defensible forensic report. The remaining options do not belong: employee employment contracts (A) and the company organizational chart (B) are HR/administrative records that may help identify personnel but are not core forensic artifacts, and the company's logo file (E) is irrelevant branding material with no investigative value.

Answer

Employee employment contracts

Answer

Company organizational chart

Answer

The company's logo file

Question 13

Which THREE types of data are typically found in a full forensic disk image?

Accepted Answer

File system metadata. A full forensic disk image captures the entire contents of a storage device bit-for-bit, so it includes file system metadata such as the MFT on NTFS, inodes on ext4, directory entries, timestamps, and allocation bitmaps (Option A). Because the image is a bit-level copy of all sectors, it also preserves deleted files whose data clusters and metadata entries have not yet been overwritten, which is essential for forensic recovery (Option B). The same bit-for-bit capture extends across the whole physical disk, including hidden or non-standard partitions, unallocated space, slack space, and partition tables, so hidden partitions are included (Option D). Live memory contents (Option C) reside in RAM and are acquired through memory forensics tools like Volatility or LiME, not from a disk image. Remote cloud storage files (Option E) exist on external providers' servers and are not present on the local disk unless cached or synced, so they are not part of a disk image.

Answer

Live memory contents

Answer

Remote cloud storage files

Question 14

Which TWO of the following are examples of good asset inventory management practices?

Accepted Answer

Maintaining a Configuration Management Database (CMDB) that maps asset relationships.. Option A is correct because a Configuration Management Database (CMDB) is a recognized ITIL practice that records assets and, critically, the relationships and dependencies between configuration items, which supports impact analysis, change management, and accurate inventory control. Option B is correct because automated discovery tools such as Lansweeper or Tenable.io continuously scan the network to detect and reconcile assets, keeping the inventory current and reducing the human error and staleness inherent in manual tracking. Option C is wrong because inventory should cover all assets, not only those involved in incidents; incident-driven tracking leaves most of the estate unmanaged. Option D is wrong because decommissioned or powered-off assets must still be tracked through their lifecycle (and securely disposed of) rather than simply deleted, which would break audit and compliance records. Option E is wrong because an annual manual Excel update is infrequent, error-prone, and not a continuous or authoritative inventory practice.

Answer

Only tracking assets that have had a security incident.

Answer

Deleting assets from the inventory once they are turned off.

Answer

Manually updating an Excel spreadsheet every year.

Question 15

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

Accepted Answer

Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. Local Account Password Complexity is enforced through the Password Policy node under Account Policies in the Security Settings of a Group Policy Object. The correct path is Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy, where settings like 'Password must meet complexity requirements' reside. This is the standard CIS Benchmark location for password policy hardening.

Answer

Computer Configuration > System Settings > Advanced > Security

Answer

User Configuration > Preferences > Control Panel Settings > Local Users and Groups

Answer

Computer Configuration > Administrative Templates > Windows Components > Password