CCOA Practice Exam 2 — 20 Questions

Question 1

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident creation is toggled off in the rule configuration. If 'Incident creation' is disabled in the Microsoft Sentinel analytics rule settings, the rule will generate logs but will not group them into an incident for investigation.

Answer

The KQL query lacks a 'summarize' operator

Answer

Log Analytics workspace ingestion limit reached

Answer

The analytics rule is set to 'Disabled' instead of 'Enabled'

Question 2

While investigating a web server breach, you find malicious PHP web shells. What is the most effective way to identify the source of the upload?

Accepted Answer

Analyze web server access logs. Web server access logs record every HTTP request, including the method, URI, source IP, user agent, and response code, so they reveal exactly when and from where the web shell was uploaded or accessed. Analyzing these logs is the most effective way to trace the upload source and identify the attacker's entry point. This is the primary forensic artifact for web-based intrusions.

Answer

Check the file metadata (MACE)

Answer

Scan the server for viruses

Answer

Check system boot logs

Question 3

A CCOA analyst receives an alert that the account 'svc_backup' performed an interactive logon (Type 2) to a domain controller at 02:17. The account is normally used only for scheduled backup jobs. The analyst needs to determine whether this is a credential misuse incident. Which Windows event should the analyst examine first to confirm the logon type and source workstation?

Accepted Answer

Event ID 4624 in the Security log. The analyst needs to confirm an interactive logon by a service account and identify its source. Successful logon events in the Security log capture logon type and source network address, which directly supports this determination. Other events describe process, Kerberos, or share activity and would require additional correlation without answering the core question.

Answer

Event ID 4769 in the Security log

Answer

Event ID 5140 in the Security log

Answer

Event ID 4688 in the Security log

Question 4

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

Accepted Answer

Verify the digital signature of the referenced executable.. Run keys in the Windows Registry are a common persistence mechanism, and the most reliable way to determine whether an entry is malicious is to verify the digital signature of the referenced executable. A valid signature from a trusted publisher strongly suggests legitimacy, while an unsigned, invalid, or revoked signature is a red flag. This is a non-destructive, evidence-preserving step appropriate for forensic analysis.

Answer

Delete the registry key.

Answer

Reboot the server.

Answer

Rename the file to .txt.

Question 5

A CCOA analyst is reviewing a vulnerability scan report for a web server that hosts a public-facing application. The scan identified several vulnerabilities, including a critical remote code execution (RCE) flaw in a web framework, a medium-severity cross-site scripting (XSS) issue, and a low-severity information disclosure in an HTTP header. The RCE vulnerability has a known exploit available in the wild, but the web framework is only used for an internal administrative interface that is not accessible from the internet. The XSS vulnerability is on a public login page. Which vulnerability should the analyst prioritize for immediate remediation based on risk?

Accepted Answer

The medium-severity XSS on the public login page, because it is accessible to unauthenticated users and could lead to credential theft.. The XSS on the public login page is the top priority because it is exploitable by unauthenticated attackers and can lead to credential theft, which could result in full compromise. Although the RCE is critical, its internal-only exposure reduces its immediate risk. Risk-based prioritization considers both severity and context, such as network accessibility and exploit availability.

Answer

All three vulnerabilities should be remediated simultaneously with equal priority, because any vulnerability could be exploited.

Answer

The critical RCE vulnerability, because it has a known exploit and critical severity rating, regardless of network accessibility.

Answer

The low-severity information disclosure, because it could reveal sensitive information about the server that aids further attacks.

Question 6

A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts to various external IP addresses on port 445. The analyst suspects a compromised host is attempting to spread laterally or exfiltrate data. Which protocol is associated with port 445, and what is the primary security concern?

Accepted Answer

SMB; it can be used for file sharing and remote code execution, and outbound traffic may indicate data exfiltration or worm propagation.. Port 445 is the standard port for SMB, which is used for file sharing and can be exploited for remote code execution, data exfiltration, and worm propagation. Outbound SMB traffic to external IPs is a red flag and should be blocked at the perimeter to prevent data loss and lateral movement.

Answer

NetBIOS; it is used for legacy Windows networking and outbound traffic is normal.

Answer

LDAP; it is used for directory services and outbound traffic may indicate directory enumeration.

Answer

RDP; it allows remote desktop access and outbound traffic may indicate unauthorized remote control.

Question 7

You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?

Accepted Answer

~/.bashrc. ~/.bashrc is a per-user shell initialization file executed every time an interactive Bash shell starts, including on login for many configurations. Attackers commonly append reverse shells, aliases, or environment variable exports to it so malicious code runs silently each time the user opens a terminal. Because it lives in the user's home directory and is user-writable, it is a low-privilege, high-persistence target.

Answer

/bin/sh

Answer

/var/log/syslog

Answer

/etc/passwd

Question 8

What is the primary difference between a Red Team and a Blue Team in a security simulation?

Accepted Answer

Red Team acts as the adversary, Blue Team performs incident response. In security simulations, the Red Team emulates adversary tactics, techniques, and procedures (TTPs) to test defenses, while the Blue Team defends, detects, and responds to those attacks. This adversarial/defensive split is the defining characteristic of red vs. blue teaming. Option C captures both roles accurately.

Answer

Red Team creates policy, Blue Team audits it

Answer

Red Team handles infrastructure, Blue Team handles software

Answer

Red Team identifies vulnerabilities, Blue Team remediates them

Question 9

A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?

Accepted Answer

An explicit Deny entry is present.. In Windows ACL evaluation, an explicit Deny entry always overrides any Allow entries, regardless of group membership or inheritance. If Effective Access shows Deny, the most direct explanation is that an explicit Deny ACE exists on the resource or a parent object. This is deterministic behavior in the Windows access check algorithm.

Answer

The server is offline.

Answer

The drive is full.

Answer

They are not in the correct group.

Question 10

During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?

Accepted Answer

The EDR applies a restrictive host-based firewall policy. EDR network isolation works by applying a restrictive host-based firewall policy on the endpoint that blocks all network traffic except the EDR agent's own management channel. This allows the SOC to continue communicating with and controlling the endpoint while severing its connections to the attacker, lateral movement targets, and C2 infrastructure. The network interface remains up so the agent can receive commands and push telemetry.

Answer

The EDR clears the local ARP cache

Answer

The EDR shuts down the network interface completely

Answer

The EDR triggers a BIOS-level shutdown of the NIC

Question 11

A security operations center analyst observes an endpoint where the process 'rundll32.exe' has loaded a DLL from the user's Downloads folder and is making outbound SMB connections to several internal hosts. Which MITRE ATT&CK tactic is most likely being exercised by this behavior?

Accepted Answer

Lateral Movement. The outbound SMB connections from rundll32.exe loading a DLL from a user directory indicate lateral movement. Adversaries often use SMB to access administrative shares or execute remote services on other hosts. This behavior is distinct from execution alone, command and control, or persistence, as it focuses on moving from one system to another within the network.

Answer

Persistence

Answer

Command and Control

Answer

Execution

Question 12

A security analyst is reviewing a packet capture of an internal host that appears to be communicating with an external server. The analyst observes that the TCP three-way handshake completes successfully, but the session then becomes idle for approximately 30 seconds before a small application-layer message is sent. This pattern repeats consistently. Which type of malicious activity is most consistent with this behavior?

Accepted Answer

Command-and-control beaconing. The consistent idle periods followed by small periodic messages over established TCP connections strongly suggest command-and-control beaconing. Malware often uses such channels to receive instructions or exfiltrate small amounts of data while blending in with normal traffic. The other options do not match the observed pattern of established connections with low-volume periodic traffic.

Answer

Port scanning

Answer

TCP SYN flood attack

Answer

Data exfiltration via large file transfers

Question 13

A CCOA analyst is reviewing authentication logs for a Windows environment. The analyst observes a large number of successful logons using NTLMv2 for internal file share access, even though the domain is at a functional level that supports Kerberos. The analyst suspects that some clients are not using Kerberos due to misconfiguration. Which Windows command-line tool should the analyst use to verify the effective authentication protocol being used for a specific server?

Accepted Answer

klist. The klist tool shows the Kerberos ticket cache, so if a service ticket exists for the target server, Kerberos was used. If the access succeeds without a ticket, NTLM was likely used instead. This directly answers the analyst's need to verify the effective authentication protocol for a specific server connection. Other tools manage SPNs, test trusts, or query AD objects, but none reveal the protocol in use.

Answer

nltest

Answer

dsquery

Answer

setspn

Question 14

You are configuring a SIEM alert to trigger when a user account is locked out. Which Windows Event ID should your filter target?

Accepted Answer

Event ID 4740. Windows Event ID 4740 is logged when a user account is locked out due to too many failed logon attempts, making it the correct filter for a SIEM alert on account lockout. Event ID 4625 records individual failed logon attempts, which precede but do not equal a lockout. Event ID 4728 records a member being added to a security-enabled global group, and 4624 records a successful logon.

Answer

Event ID 4625

Answer

Event ID 4728

Answer

Event ID 4624

Question 15

Which THREE types of network logs are most effective for identifying a data breach?

Accepted Answer

Web proxy logs. Network logs (NetFlow, DNS, Proxy) provide visibility into communication patterns that reveal unauthorized data transfers.

Answer

DHCP lease logs

Answer

Printer queue logs

Question 16

You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?

Accepted Answer

Successful and failed login attempts.. Option A is correct because logging both successful and failed login attempts is essential for detecting brute-force attacks, credential stuffing, and unauthorized access, and it provides the audit trail required by standards such as PCI DSS, HIPAA, and SOX. Option B is correct because changes to user privileges or schema via commands like GRANT, REVOKE, ALTER, or DROP can indicate privilege escalation or tampering, and tracking them is a core compliance requirement for change auditing. Option E is correct because large-scale data exports or queries against sensitive tables can signal data exfiltration or insider threats, and monitoring them supports both breach detection and regulatory reporting. Option C does not belong because server hardware temperature is an infrastructure/availability metric, not a security or compliance event. Option D does not belong because the number of active sessions in a connection pool is a performance and capacity metric, not evidence of malicious activity or a compliance-relevant audit event.

Answer

The specific hardware temperature of the server.

Answer

The number of active user sessions in the connection pool.

Question 17

When reviewing cloud storage buckets, you find one is configured with 'public read access'. What is the risk?

Accepted Answer

Unauthorized data exfiltration.. A bucket configured with public read access allows anyone on the internet to list and download objects, which directly enables unauthorized data exfiltration of any sensitive content stored there. This is one of the most common cloud misconfigurations and a leading cause of data breaches. The risk is confidentiality loss, not availability or injection.

Answer

SQL injection.

Answer

Service denial.

Answer

Increased latency.

Question 18

You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?

Accepted Answer

Manual status update via Action menu. In Splunk Enterprise Security, notable events are updated through the Action menu on the incident review dashboard, where an analyst manually sets the status (e.g., In Progress, Resolved, Closed). No automated setting can force a notable to remain In Progress indefinitely — that state is maintained by the analyst's manual update and persists until another manual change occurs. This is the intended workflow for human-in-the-loop triage.

Answer

Retention policy override

Answer

Real-time notable event aggregation

Answer

Automated workflow action trigger

Question 19

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

Accepted Answer

windows.malfind. The 'windows.malfind' plugin in Volatility 3 is designed to locate injected code segments by scanning for memory regions with suspicious permissions (e.g., PAGE_EXECUTE_READWRITE).

Answer

windows.info

Answer

windows.netscan

Answer

windows.pstree

Question 20

When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?

Accepted Answer

Host isolation. Host isolation (network containment) in CrowdStrike Falcon severs the endpoint's network communication except for the Falcon sensor's own channel to the cloud, preventing lateral movement and C2 traffic while still allowing responders to issue commands such as memory dump collection. This preserves live forensic evidence and remote response capability, which is exactly what the scenario requires.

Answer

File Quarantine

Answer

Credential revocation

Answer

Sensor uninstallation