CCOA Practice Test 17 — 15 Questions

Question 1

Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?

Accepted Answer

Data Owner. The Data Owner is the individual responsible for determining the classification and appropriate protection levels for data.

Answer

Chief Information Officer

Answer

Data Custodian

Answer

Auditor

Answer

Security Administrator

Question 2

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

Accepted Answer

To preserve volatile evidence in RAM. Turning off the machine clears the RAM, which contains volatile evidence that is critical for incident analysis.

Answer

To allow the attacker to keep working

Answer

Because the OS might crash

Answer

To save electricity

Question 3

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?

Accepted Answer

Access control policy. Administrative controls are the management-oriented, people-and-process safeguards in the NIST framework, so Access control policy (A) qualifies because it is a documented governance artifact that defines rules for granting and revoking access. Security awareness training (C) is also administrative because it is a personnel-focused program that educates users on policies, phishing, and acceptable use. Incident response plan (E) is administrative because it is a formal, documented procedure specifying roles, escalation, and coordination during security events. The unmarked options do not belong: Biometric locks (B) are a physical control, and Encryption (D) is a technical (logical) control.

Answer

Biometric locks

Answer

Encryption

Question 4

Which THREE of the following are considered 'Execution' techniques?

Accepted Answer

User Execution. In the MITRE ATT&CK framework, the Execution tactic covers techniques adversaries use to run malicious code. Option B, User Execution, is correct because it relies on tricking a legitimate user into running a malicious file or link, which directly triggers code execution on the victim's system. Option C, Command and Scripting Interpreter, is correct because it uses interpreters such as PowerShell, cmd.exe, Bash, or Python to execute commands and scripts. Option D, Native API, is correct because it calls operating system APIs (for example, Windows API functions like CreateProcess or VirtualAlloc) to execute code directly. Option A, Account discovery, belongs to the Discovery tactic, and option E, Registry persistence, belongs to the Persistence tactic (specifically Registry Run Keys or similar), so neither is an Execution technique.

Answer

Account discovery

Answer

Registry persistence

Question 5

Which THREE of the following are 'Privilege Escalation' techniques?

Accepted Answer

Exploitation for privilege escalation. Exploiting system software, abusing user accounts, and using local security exploits are common escalation vectors.

Answer

File discovery

Answer

Network exfiltration

Question 6

A security analyst is reviewing the Incident Response Plan (IRP) and notices that it lacks a defined communication protocol for notifying external stakeholders during a breach. Which phase of the incident response lifecycle does this gap primarily affect?

Accepted Answer

Preparation. The preparation phase encompasses all proactive measures, including developing communication plans for internal and external stakeholders. A missing protocol means the organization is unprepared to notify regulators, customers, or partners efficiently during a breach. This gap directly impacts the ability to meet legal and contractual obligations, which should be addressed before an incident occurs.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Detection and Analysis

Question 7

An analyst notices that a compromised host is generating a high volume of DNS queries for domains like 'a1b2c3d4e5f6g7h8.example.com', where the subdomain appears to be a hexadecimal string. The queries are frequent and vary in length. Which MITRE ATT&CK tactic is the adversary most likely employing?

Accepted Answer

Command and Control. The high volume of DNS queries with hexadecimal subdomains indicates DNS tunneling for command and control. Adversaries use this technique to send commands and receive data from compromised hosts, often evading network security controls that allow DNS traffic. This is categorized under Command and Control in MITRE ATT&CK, as it establishes a communication channel between the adversary and the victim.

Answer

Exfiltration

Answer

Discovery

Answer

Impact

Question 8

A threat hunter is reviewing logs from a workstation and finds evidence of an adversary attempting to impair defenses before deploying ransomware. Which TWO of the following observed actions are Defense Evasion techniques? (Choose two.)

Accepted Answer

Using 'sc stop WinDefend' to stop the Windows Defender service.. Defense Evasion includes actions that impair defenses or remove evidence. Clearing the Security event log destroys forensic artifacts, and stopping the Windows Defender service disables a primary security control. Both directly reduce the environment's ability to detect or block the adversary, distinguishing them from discovery, lateral movement, and persistence actions that serve different objectives.

Answer

Executing 'whoami /all' to enumerate current user privileges.

Answer

Creating a scheduled task that runs a payload every 15 minutes.

Answer

Mapping a remote administrative share with 'net use'.

Question 9

A security analyst is conducting a risk assessment for a new cloud-based CRM system. The analyst must identify TWO qualitative risk assessment techniques that can be used to prioritize risks based on expert judgment and descriptive scales. (Choose two.)

Accepted Answer

Risk matrix. Qualitative risk assessment techniques rely on expert judgment and descriptive scales to prioritize risks. The Delphi technique gathers expert opinions through iterative anonymous surveys, while a risk matrix categorizes risks by likelihood and impact using scales like high, medium, and low. Monte Carlo simulation and ALE are quantitative, and fault tree analysis is typically used for root cause analysis rather than risk prioritization.

Answer

Fault tree analysis

Answer

Monte Carlo simulation

Answer

Annualized loss expectancy (ALE)

Question 10

A CCOA analyst is reviewing a suspected credential-stuffing incident against the organization's customer portal. The web server logs show thousands of POST requests to /login with varying usernames but originating from a rotating set of source IPs. The analyst needs to determine whether the activity is a distributed brute-force attack or normal user behavior. Which data source would BEST provide the authoritative evidence of failed authentication attempts across all application instances?

Accepted Answer

Application authentication logs. Authentication outcomes are only reliably recorded by the authentication service itself. Application authentication logs capture each login attempt with its result, username, and source, which is exactly what is needed to distinguish a credential-stuffing campaign from normal traffic. Network and endpoint sources lack the application-layer context to prove failed authentication.

Answer

Firewall session logs

Answer

Endpoint detection and response telemetry

Answer

Web server access logs

Question 11

A security analyst is reviewing firewall logs and sees that an internal web server is making DNS queries to an external IP address that is not a known DNS resolver. The queries are for random-looking subdomains of a domain with no reputation. The volume of queries is high and consistent. The analyst suspects DNS tunneling for command and control. Which technology would best detect this activity by analyzing DNS query patterns and payload characteristics?

Accepted Answer

Network-based DNS security monitoring with machine learning. DNS tunneling encodes data in DNS queries and responses, often using random subdomains and high query volumes. Network-based DNS security monitoring with machine learning analyzes these patterns and payload characteristics to detect covert channels. It baselines normal DNS behavior and flags anomalies, providing the best detection for the described activity.

Answer

Host-based antivirus with signature updates

Answer

Web application firewall (WAF) with OWASP rules

Answer

Endpoint detection and response (EDR) with process monitoring

Question 12

An analyst observes an adversary using 'reg save HKLM\SAM sam.hive' and 'reg save HKLM\SYSTEM system.hive' on a compromised workstation. The files are then compressed and moved to a staging directory. Which MITRE ATT&CK tactic does this activity represent?

Accepted Answer

Credential Access. Extracting the SAM and SYSTEM registry hives with reg save is a classic credential access technique because those hives together allow offline recovery of local account password hashes. The adversary is targeting credential material, which places the activity squarely under Credential Access, even though the files are later staged for potential exfiltration.

Answer

Exfiltration

Answer

Collection

Answer

Defense Evasion

Question 13

An adversary has gained access to a workstation and is attempting to escalate privileges. Which TWO of the following actions are examples of the Privilege Escalation tactic in MITRE ATT&CK? (Choose two.)

Accepted Answer

Creating a scheduled task to run a malicious script with highest privileges. Exploiting a local service vulnerability and creating a scheduled task with highest privileges are both Privilege Escalation techniques. They directly result in the adversary gaining higher-level permissions on the compromised system. Keylogging, DNS queries, and network scanning are associated with other tactics such as Credential Access, Command and Control, and Discovery, respectively.

Answer

Using a keylogger to capture user credentials

Answer

Performing DNS queries to a command and control server

Answer

Scanning the local network for open ports

Question 14

A security operations analyst at a hospital is reviewing the risk register. A threat has been identified that could exploit a vulnerability in a legacy MRI machine's embedded OS, but the machine cannot be patched because the vendor no longer supports it. The CIO decides to accept the risk and document it. Which risk response strategy has been applied?

Accepted Answer

Risk acceptance. The CIO acknowledges the risk posed by the unpatched MRI machine but decides not to implement further controls, instead documenting the decision. This is risk acceptance, where the organization consciously retains the risk. Mitigation would involve adding controls, avoidance would mean stopping use of the machine, and transference would shift the risk to another party.

Answer

Risk avoidance

Answer

Risk transference

Answer

Risk mitigation

Question 15

A CCOA analyst is responding to an incident involving a compromised web server that is part of a load-balanced cluster. The analyst needs to preserve volatile evidence before the server is rebooted for remediation. Which TWO actions should the analyst perform to capture volatile data? (Choose two.)

Accepted Answer

Export the current network connection table and running process list. Volatile data such as memory contents, network connections, and running processes disappears when a system is powered off or rebooted. Capturing physical memory with a validated tool and exporting the live connection and process tables preserves the most perishable evidence. Disk imaging and log review are important but can occur after the system is taken down.

Answer

Create a full forensic image of the server's disk drives

Answer

Review the web server access logs stored on the server

Answer

Document the chain of custody for the server hardware