CCOA Practice Exam 2 — 20 Questions

Question 1

A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?

Accepted Answer

Isolate the host from the network. Isolating the affected host from the network prevents the ransomware from spreading to other shares or command-and-control servers while preserving local evidence.

Answer

Reboot the server

Answer

Delete the suspicious files

Answer

Change all user passwords

Question 2

During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?

Accepted Answer

Execution. WMIC is often used for remote execution and discovery in Windows environments.

Answer

Exfiltration

Answer

Collection

Answer

Impact

Question 3

Which THREE of the following are common 'Impact' techniques?

Accepted Answer

Data encrypted for impact. Data destruction, ransomware encryption, and service disruption are all forms of impact.

Answer

Credential access

Answer

Persistence setup

Question 4

A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?

Accepted Answer

Recover. The NIST CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Recover is the function focused on resilience and restoring capabilities.

Answer

Detect

Answer

Protect

Answer

Identify

Question 5

Which TWO of the following are examples of 'Initial Access' tactics?

Accepted Answer

Phishing. Phishing and exploiting public-facing applications are two common ways to gain the first foothold in an environment.

Answer

Registry modification

Answer

Screen capture

Answer

Network scanning

Question 6

Which THREE of the following are considered 'Collection' techniques?

Accepted Answer

Screen capture. Screen capture, audio capture, and file collection are all ways to steal data.

Answer

File and directory discovery

Answer

Network scanning

Question 7

You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?

Accepted Answer

Process creation logs (e.g., Sysmon Event ID 1). LotL attacks use legitimate system tools like PowerShell or WMI; therefore, process execution logs with command-line arguments are essential.

Answer

Firewall denied logs

Answer

Physical access logs

Answer

SMTP gateway logs

Question 8

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

Accepted Answer

windows.malfind. The 'windows.malfind' plugin in Volatility 3 is designed to locate injected code segments by scanning for memory regions with suspicious permissions (e.g., PAGE_EXECUTE_READWRITE).

Answer

windows.info

Answer

windows.netscan

Answer

windows.pstree

Question 9

Which of these is a 'Defense Evasion' technique?

Accepted Answer

Masquerading as a system process. Using masquerading (renaming files to look like system files) is a common way to hide malicious processes.

Answer

Creating a scheduled task

Answer

Stealing a hash

Answer

Scanning ports

Question 10

Which TWO of the following are examples of 'Discovery' techniques?

Accepted Answer

System owner/user discovery. Enumerating network shares and identifying current user context are discovery actions.

Answer

Data exfiltration

Answer

Process injection

Answer

System reboot

Question 11

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

Accepted Answer

Using stolen credentials obtained via phishing. Adversaries often use stolen credentials or social engineering to obtain legitimate user credentials to access systems as authorized users.

Answer

Exploiting a software vulnerability

Answer

Brute forcing a firewall

Answer

Installing a rootkit

Question 12

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

Accepted Answer

Searching for files with specific extensions like .docx or .xlsx. Data from Local System involves searching for and copying files from a user's machine.

Answer

Modifying a service

Answer

Creating a new user

Answer

Scanning the network

Question 13

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.

Answer

Probabilistic

Answer

Deterministic

Answer

Quantitative

Question 14

In a Palo Alto Networks environment, you need to identify if a specific internal host is beaconing to a command-and-control server. Which log type provides the necessary data?

Accepted Answer

Traffic logs. Traffic logs in Palo Alto Networks provide the session-level details required to perform frequency analysis and detect beaconing patterns.

Answer

Data filtering logs

Answer

Threat logs

Answer

URL filtering logs

Question 15

What is the purpose of 'T1027 Obfuscated Files or Information'?

Accepted Answer

To evade detection by signature-based tools. Obfuscation is used to hide code or scripts from static analysis and security tools, aiding Defense Evasion.

Answer

To escalate privileges

Answer

To increase execution speed

Answer

To facilitate lateral movement

Question 16

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Accepted Answer

SMB/Admin shares. Remote services like RDP and SMB/Admin shares are primary mechanisms for moving laterally.

Answer

DNS query analysis

Answer

Registry key editing

Answer

Keystroke logging

Question 17

Which THREE actions are essential to the 'Identify' function of the NIST CSF?

Accepted Answer

Risk management strategy. Identify covers inventory, risk management, and governance.

Answer

Malware scanning

Answer

Incident recovery time analysis

Question 18

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

Accepted Answer

Browser 'Login Data' SQLite databases. Password stores include browser data, local vaults, and credential managers.

Answer

Active Directory logs

Answer

Network packets

Answer

System logs

Question 19

Which THREE items are typically included in a formal Risk Register?

Accepted Answer

Mitigation status. A risk register tracks risks, including their probability, impact, and mitigation status.

Answer

Vendor contact list

Answer

Hardware serial number

Question 20

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?

Accepted Answer

Access control policy. Administrative controls are policies, procedures, and management tasks rather than technical or physical hardware.

Answer

Biometric locks

Answer

Encryption