CCOA Practice Test 18 — 15 Questions

Question 1

A security analyst is examining a Windows event log and notices Event ID 4625 followed by Event ID 4624 with Logon Type 3 from the same source IP within a few seconds. The account used is a local administrator. What is the most likely explanation for this sequence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A successful network logon after a failed attempt, indicating a possible brute-force attack that succeeded.. The combination of a failed logon (4625) immediately followed by a successful network logon (4624, Type 3) using a local administrator account from the same remote IP strongly suggests a brute-force attack that succeeded. Legitimate user error or service account issues would not typically produce this exact pattern with a privileged account and network logon type. This warrants immediate investigation and potential containment.

Answer

A user mistyped their password and then logged in correctly, which is normal user behavior.

Answer

The account was locked out due to multiple failed attempts, then unlocked by an administrator.

Answer

A service account password was updated, causing a failed logon until the service restarted.

Question 2

A security analyst notices that a user's workstation is repeatedly connecting to an external IP address every 60 seconds, sending small amounts of data. The traffic pattern is consistent and occurs even when the user is not actively working. Which type of malware behavior is most likely indicated?

Accepted Answer

A botnet command-and-control beacon.. The consistent, periodic connections to an external IP with small data payloads are a classic sign of malware beaconing to a command-and-control server. This behavior allows attackers to maintain control over the compromised system and receive instructions, often while evading detection by blending in with normal traffic.

Answer

A keylogger exfiltrating keystrokes in real time.

Answer

Ransomware encrypting files in the background.

Answer

A worm spreading to other systems on the network.

Question 3

A SOC analyst is investigating suspicious outbound traffic from an internal host to a known command-and-control server. The analyst needs to capture full packet payloads for deep inspection and later forensic analysis. Which tool should the analyst use to capture the traffic on the Linux-based sensor?

Accepted Answer

tcpdump -i eth0 -w capture.pcap host 203.0.113.50. Capturing full packet payloads requires a tool that writes raw packets to a file. tcpdump with the -w option and a host filter accomplishes this, preserving the complete data stream for later forensic examination. Other listed tools either show only connection metadata, generate new traffic, or map network paths, none of which provide the packet contents needed.

Answer

traceroute 203.0.113.50

Answer

nmap -sS -p 1-65535 203.0.113.50

Answer

netstat -an | grep 203.0.113.50

Question 4

A CCOA analyst is reviewing a memory image from a compromised Windows host. The analyst needs to identify evidence of process injection and persistence that may not appear in the file system. Which two artifacts should the analyst prioritize examining? (Choose two.)

Accepted Answer

In-memory process list showing parent-child relationships and command lines for anomalous processes such as a browser spawning cmd.exe or powershell.exe.. Process injection and memory-only persistence are best evidenced by in-memory process relationships and command lines, plus executable memory regions not backed by files on disk. These artifacts exist only in memory and reveal stealthy execution that file system analysis misses. Kernel modules, Prefetch, ShimCache, and registry hives are useful for other purposes but are not the primary indicators of injection in a memory image.

Answer

Loaded kernel modules and drivers, including unsigned or unexpectedly loaded entries that could indicate a rootkit or driver-based persistence.

Answer

Registry hives parsed from the memory image to enumerate Run keys and services for persistence.

Answer

Prefetch files and ShimCache entries stored on disk that record execution of binaries across reboots.

Question 5

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

Accepted Answer

Perimeter network (DMZ). The perimeter network (DMZ) is the first line of defense that separates the internal network from untrusted public networks.

Answer

Data encryption

Answer

Host-based security

Answer

Application layer

Question 6

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

Accepted Answer

Exfiltration. MITRE ATT&CK T1537 (Transfer Data to Cloud Account) is classified under the Exfiltration tactic because it describes an adversary moving data from a victim environment into an adversary-controlled cloud account (e.g., AWS S3 bucket, Azure Blob) to exfiltrate it. The technique's goal is data theft via cloud storage, which is exfiltration.

Answer

Execution

Answer

Discovery

Answer

Persistence

Question 7

You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?

Accepted Answer

AIDE. AIDE (Advanced Intrusion Detection Environment) is a host-based file integrity monitoring tool that creates a cryptographic database of file attributes (hashes, permissions, inodes, timestamps) and compares the live filesystem against it to detect unauthorized changes. It is specifically designed to catch tampering with system binaries, configuration files, and other critical files on Linux hosts like RHEL. Running 'aide --check' against a known-good baseline reveals added, removed, or modified files.

Answer

firewalld

Answer

systemctl status

Answer

yum check-update

Question 8

What is the primary goal of the 'Command and Control' (C2) tactic?

Accepted Answer

To manage the compromised host and receive instructions. The Command and Control (C2) tactic in the MITRE ATT&CK framework (TA0011) is the phase where an adversary establishes a communication channel to remotely manage compromised systems. The primary goal is to maintain interactive control over the victim host, allowing the attacker to send commands and receive output, exfiltrate data, or pivot to other systems. This is distinct from other tactics like Credential Access or Exfiltration, which focus on specific objectives rather than the management channel itself.

Answer

To encrypt data

Answer

To create user accounts

Answer

To steal user credentials

Question 9

You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?

Accepted Answer

client.geographicalContext.proxyType. The 'client.geographicalContext.proxyType' or similar risk-based fields in Okta logs identify if the connecting IP is associated with known proxies or VPNs.

Answer

outcome.reason

Answer

target.alternateId

Answer

debugContext.debugData

Question 10

A retail company stores payment card data in a database on a Linux server. The security team must ensure that the database files themselves are protected if the underlying storage is physically stolen or a disk image is copied. Which control best addresses this specific threat?

Accepted Answer

Enabling full-disk encryption on the server's storage volumes. The threat is offline access to payment card data via stolen or copied storage, which only encryption at rest can counter. Full-disk encryption ensures that disk images and removed drives remain unreadable without key material. Strong passwords, host intrusion detection, and network access restrictions all operate at runtime or over the network and cannot protect data once the storage medium is in an attacker's hands.

Answer

Configuring the database to require strong passwords for all application accounts

Answer

Implementing a host-based intrusion detection system on the database server

Answer

Restricting database network access to the application server IP address only

Question 11

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

Accepted Answer

Searching for files with specific extensions like .docx or .xlsx. Data from Local System involves searching for and copying files from a user's machine.

Answer

Modifying a service

Answer

Creating a new user

Answer

Scanning the network

Question 12

A healthcare organization must comply with regulations requiring that patient records remain available during a ransomware incident. The CIO asks which principle of the CIA triad is most directly addressed by maintaining immutable offline backups. Which principle applies?

Accepted Answer

Availability. The scenario centers on keeping patient records accessible during and after a ransomware event. Immutable offline backups are a recovery control whose primary security objective is availability: they let the organization restore service and continue operations. Confidentiality, integrity, and non-repudiation address different properties and do not capture the requirement to maintain access to records.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Integrity

Question 13

An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?

Accepted Answer

Distributed Denial of Service (DDoS) attack. Availability threats target the ability of legitimate users to access a system or its data when needed. A Distributed Denial of Service (DDoS) attack floods a target with traffic from many sources, exhausting bandwidth, connection tables, or application resources so the database becomes unreachable — a direct, textbook availability attack. The CIA triad classifies DDoS squarely under Availability because no data is read, altered, or forged; the service is simply denied.

Answer

Packet sniffing on the wire

Answer

Replay attack

Answer

Unauthorized data modification

Question 14

What is the function of the 'netstat' command in a Windows environment?

Accepted Answer

To view active network connections.. The netstat command displays active network connections, listening ports, routing tables, and protocol statistics on a Windows system. It is used to identify which processes are communicating over the network and on which ports, making it a fundamental tool for troubleshooting and security analysis.

Answer

To update the system time.

Answer

To flush the DNS cache.

Answer

To change the IP address.

Question 15

Which TWO of the following are examples of 'Discovery' techniques?

Accepted Answer

System owner/user discovery. Enumerating network shares and identifying current user context are discovery actions.

Answer

Data exfiltration

Answer

Process injection

Answer

System reboot