CCOA Practice Exam 1 — 20 Questions

Question 1

Which of these is a typical 'Lateral Movement' technique?

Accepted Answer

Using RDP. Remote Desktop Protocol (RDP) is a standard tool used by adversaries to move laterally between machines.

Answer

Running a keylogger

Answer

Encrypting local files

Answer

Setting a registry key

Question 2

Which THREE of the following are 'Command and Control' techniques?

Accepted Answer

Standard application layer protocol. Web service protocols, non-standard port traffic, and standard application layer protocols are all C2 channels.

Answer

Registry modification

Answer

Credential dumping

Question 3

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

Accepted Answer

Sysmon Event ID 11. File and Directory Discovery often involves listing files, which generates audit events when monitoring directory access via Sysmon Event ID 11 or Windows Security logs.

Answer

NetFlow

Answer

DHCP logs

Answer

Firewall logs

Question 4

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Accepted Answer

Running 'whoami' or 'net view'. Discovery involves gathering information about the system and network to plan subsequent steps.

Answer

Installing a backdoor

Answer

Deleting logs to hide traces

Answer

Encrypting files for ransom

Question 5

Which TWO of the following are examples of 'Persistence' tactics?

Accepted Answer

Scheduled tasks. Creating scheduled tasks and adding items to the Startup folder are standard ways to ensure malware survives reboot.

Answer

Credential dumping

Answer

Port scanning

Answer

Data encryption

Question 6

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

Accepted Answer

Persistence. Modifying registry run keys is a standard technique to ensure a program executes automatically upon system startup, which defines Persistence.

Answer

Discovery

Answer

Execution

Answer

Privilege Escalation

Question 7

Which THREE of the following are 'Privilege Escalation' techniques?

Accepted Answer

Exploitation for privilege escalation. Exploiting system software, abusing user accounts, and using local security exploits are common escalation vectors.

Answer

File discovery

Answer

Network exfiltration

Question 8

Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?

Accepted Answer

SIEM log analysis. Detection focus on identifying anomalies and security events continuously.

Answer

System hardening

Answer

Backups

Answer

Firewall blocking

Question 9

Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?

Accepted Answer

Data Owner. The Data Owner is the individual responsible for determining the classification and appropriate protection levels for data.

Answer

Chief Information Officer

Answer

Data Custodian

Answer

Auditor

Answer

Security Administrator

Question 10

You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?

Accepted Answer

client.geographicalContext.proxyType. The 'client.geographicalContext.proxyType' or similar risk-based fields in Okta logs identify if the connecting IP is associated with known proxies or VPNs.

Answer

outcome.reason

Answer

target.alternateId

Answer

debugContext.debugData

Question 11

You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?

Accepted Answer

Use the '_GetWatchlist' KQL function. In Microsoft Sentinel, you use the 'in' operator combined with the _GetWatchlist function in your KQL query to compare incoming logs against the watchlist content.

Answer

Assign IPs to a 'Threat Intelligence' tag

Answer

Hardcode the IPs in the query

Answer

Automatically block them via Network Security Group

Question 12

During a digital forensics investigation of a Windows host, an analyst suspects an attacker used PowerShell 'Fileless' execution. Which artifact within the Windows Event Logs would provide the most definitive evidence of the specific command line arguments used during the execution?

Accepted Answer

Event ID 4104. Event ID 4104 records Script Block Logging, which captures the full content of executed PowerShell blocks, including obfuscated code.

Answer

Event ID 4688 with Command Line Auditing enabled

Answer

Event ID 1102

Answer

Event ID 4624

Question 13

Which THREE of the following are considered 'Execution' techniques?

Accepted Answer

User Execution. Command scripting, binary execution, and scheduled task execution are all ways to start code.

Answer

Account discovery

Answer

Registry persistence

Question 14

You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?

Accepted Answer

AES-256 Encryption. Confidentiality ensures that only authorized parties can access data, which is achieved through encryption.

Answer

Two-Factor Authentication

Answer

Hashing Algorithms

Answer

Digital Signatures

Question 15

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

Accepted Answer

Lateral Movement. The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.

Answer

Credential Access

Answer

Exfiltration

Answer

Persistence

Question 16

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

Accepted Answer

Command and Control. DNS tunneling is a technique used to bypass network firewalls and communicate with C2 servers, falling under Command and Control.

Answer

Discovery

Answer

Exfiltration

Answer

Lateral Movement

Question 17

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

Accepted Answer

T1059 describes the execution mechanism, T1204 describes the delivery. T1059 focuses on the interpretation of code (PowerShell, Bash), while T1204 focuses on the user-driven triggering of the malicious file.

Answer

There is no distinction

Answer

T1059 is for Windows, T1204 is for Linux

Answer

T1059 is the technique, T1204 is the outcome

Question 18

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

Accepted Answer

Disabling Windows Defender or modifying firewall rules. Impair Defenses involves disabling security software, such as antivirus or EDR agents, to remain undetected.

Answer

Downloading a remote tool

Answer

Running a password brute force

Answer

Listing files on a share

Question 19

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

Accepted Answer

The attacker targeted a software vulnerability in an application. This technique involves exploiting a client-side application (like a browser or PDF reader) to execute code.

Answer

The user clicked a link

Answer

The attacker used social engineering

Answer

The user was logged in via RDP

Question 20

You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?

Accepted Answer

Process Tree view. Process tree visualization is a core feature of EDR platforms like Falcon or Defender for Endpoint, allowing analysts to trace execution lineage.

Answer

Host status dashboard

Answer

Network connections tab

Answer

Event search logs