CCOA Practice Test 19 — 15 Questions

Question 1

You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?

Accepted Answer

TLS. TLS (Transport Layer Security) is the standard protocol for encrypting data in transit between a client and a database server, providing confidentiality, integrity, and server authentication via certificates. It operates at the transport layer and is natively supported by database engines (e.g., PostgreSQL sslmode, MySQL REQUIRE SSL, SQL Server Force Encryption). TLS negotiates ephemeral session keys so that even captured traffic cannot be decrypted without the session secret.

Answer

Hashing

Answer

VPN

Answer

AES-256

Question 2

A SIEM alert indicates a 'Golden Ticket' attack. What is the primary indicator of this attack in the logs?

Accepted Answer

Abnormally long TGT lifetime. A Golden Ticket attack involves Kerberos TGT (Ticket Granting Ticket) requests that appear abnormal because the ticket lifetime is extremely long, often years.

Answer

Frequent account lockout events

Answer

Unusual user agent strings

Answer

Excessive failed login attempts

Question 3

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

Accepted Answer

Disabling Windows Defender or modifying firewall rules. Impair Defenses involves disabling security software, such as antivirus or EDR agents, to remain undetected.

Answer

Downloading a remote tool

Answer

Running a password brute force

Answer

Listing files on a share

Question 4

You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this typically signify?

Accepted Answer

An immediate termination of a connection.. In TCP, the RST (reset) flag is used to abruptly terminate a connection. It is sent when a segment arrives that does not match any existing connection, or when a party wants to abort a connection due to an error or policy. This is distinct from a normal connection close, which uses FIN flags.

Answer

A request for retransmission.

Answer

A request for a new connection.

Answer

A data acknowledgment.

Question 5

A security operations center (SOC) analyst is reviewing logs from a Windows server and notices Event ID 4625 (An account failed to log on) occurring repeatedly for the same user account from a single source IP within a short time frame. Which type of attack does this pattern most likely indicate?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. A high volume of these events for the same user account from a single source IP in a short time frame is a hallmark of a brute-force password attack, where an attacker systematically tries many passwords. This pattern differs from other attacks like pass-the-hash or Kerberoasting, which typically involve different event IDs and success patterns. The SOC analyst should treat this as a potential brute-force attempt and consider mitigation such as account lockout and source IP blocking.

Answer

Kerberoasting attack

Answer

Pass-the-hash attack

Answer

Golden ticket attack

Question 6

A security analyst is investigating a suspected insider threat. The analyst has collected volatile data from a suspect's workstation, including running processes, network connections, and logged-in users. Which of the following should the analyst do NEXT to maintain the integrity of the evidence for potential legal proceedings?

Accepted Answer

Create a forensic image of the workstation's hard drive and document the chain of custody.. After collecting volatile data, the analyst must preserve non-volatile evidence by creating a forensic image of the hard drive and documenting the chain of custody. This ensures that the evidence remains unaltered and admissible in legal proceedings. Other actions like interviewing the suspect or running scans could compromise the investigation.

Answer

Review the suspect's email and file access logs to determine motive.

Answer

Run antivirus scans on the workstation to check for malware that might explain the activity.

Answer

Immediately interview the suspect to obtain a confession.

Question 7

A retail bank's security team is classifying a new customer-facing mobile application. The application stores no cardholder data but processes internal marketing statistics. The team must decide whether to apply the same security controls as the core banking platform or a lighter control set. Which activity should occur FIRST to make this decision defensible?

Accepted Answer

Assign an information asset owner to classify the application and its data by sensitivity and criticality.. Classification by the accountable asset owner is the foundational governance step that determines how much protection an asset requires. Sensitivity, criticality, and regulatory scope drive the control baseline, so the owner's decision must precede scanning, control deployment, or change approval. Once classification is documented, lighter controls can be justified and defended during audits.

Answer

Deploy the same controls used for the core banking platform to eliminate residual risk.

Answer

Perform a vulnerability scan against the mobile application to determine its exposure level.

Answer

Submit a change request to the change advisory board describing the lighter control set.

Question 8

A security operations center (SOC) analyst is reviewing firewall logs and notices that a workstation is making repeated connections to a known malicious IP address on port 443. The analyst wants to quickly identify the process responsible for these connections on the Windows workstation. Which of the following tools should the analyst use?

Accepted Answer

netstat -ano. netstat -ano is a built-in Windows command that lists all active connections with their associated process IDs. By matching the PID to a process using Task Manager or tasklist, the analyst can quickly identify the responsible application. This is a fundamental step in incident response to determine if the connection is from a legitimate process or malware.

Answer

tracert

Answer

nslookup

Answer

arp -a

Question 9

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

Accepted Answer

Monitor for handle access to lsass.exe. The most reliable detection for T1003 OS Credential Dumping is monitoring for suspicious handle access to lsass.exe. Attackers using tools like Mimikatz must open a handle to the LSASS process with rights such as PROCESS_VM_READ (0x0010) to read credential material from memory. Security tools like Sysmon (Event ID 10) or EDR sensors can flag non-standard processes requesting these access rights, which is the canonical behavioral indicator for credential dumping.

Answer

Monitor for lsass.exe process termination

Answer

Monitor for failed login attempts

Answer

Monitor registry read operations

Question 10

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

Accepted Answer

Command and Control. DNS tunneling is a technique used to bypass network firewalls and communicate with C2 servers, falling under Command and Control.

Answer

Discovery

Answer

Exfiltration

Answer

Lateral Movement

Question 11

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

Accepted Answer

Post-incident activity. The Post-Incident Activity phase (or Lessons Learned) is dedicated to documenting what happened and how to improve future responses.

Answer

Detection and Analysis

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 12

During incident response, an analyst observes that an adversary used 'net use \fileserver\share$ /user:DOMAIN\svc_backup' followed shortly by 'schtasks /create /s fileserver /ru SYSTEM /tn UpdateCheck /tr C:\Windows\Temp\upd.exe'. The analyst already confirmed the initial host was compromised via phishing. Which tactic does the 'net use' command most directly represent in this sequence?

Accepted Answer

Lateral Movement. Mapping an administrative share on a remote server using a service account and then creating a remote scheduled task is a recognized lateral movement pattern. The 'net use' command provides the authenticated connection to the remote file system, enabling the adversary to stage and execute code on another host, which is the essence of moving laterally through an environment.

Answer

Execution

Answer

Credential Access

Answer

Discovery

Question 13

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

Accepted Answer

Using stolen credentials obtained via phishing. Adversaries often use stolen credentials or social engineering to obtain legitimate user credentials to access systems as authorized users.

Answer

Exploiting a software vulnerability

Answer

Brute forcing a firewall

Answer

Installing a rootkit

Question 14

An analyst is reviewing a security incident and needs to determine the order of events. The analyst has collected logs from various sources with different timestamp formats and time zones. Which action should the analyst take first to ensure an accurate timeline?

Accepted Answer

Normalize all timestamps to a common time zone and format. To build an accurate timeline, all timestamps must be converted to a common time zone and format, typically UTC. This allows events from different systems to be placed in the correct chronological order. Without normalization, the analyst might misinterpret the sequence, leading to incorrect root cause analysis. Other actions like sorting by severity or filtering are secondary to this essential step.

Answer

Sort the logs by the severity of the events

Answer

Filter out logs from untrusted sources

Answer

Correlate events based on the source IP address

Question 15

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

Accepted Answer

Persistence. Modifying registry run keys is a standard technique to ensure a program executes automatically upon system startup, which defines Persistence.

Answer

Discovery

Answer

Execution

Answer

Privilege Escalation