CCOA Practice Exam 3 — 20 Questions

Question 1

A security operations center (SOC) is implementing network segmentation to protect critical assets. Which TWO of the following are essential components of a secure segmented network design? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using VLANs to logically separate network traffic. Secure network segmentation requires both logical separation and enforcement of access controls. VLANs provide the logical separation, while firewalls between segments enforce policies to restrict traffic. Together, they limit lateral movement and protect critical assets. Flat topologies, endpoint-only protection, and promiscuous mode do not achieve segmentation and may introduce risks.

Answer

Enabling promiscuous mode on all switches to monitor traffic

Answer

Implementing a flat network topology to simplify management

Answer

Relying solely on endpoint antivirus for protection

Question 2

A security analyst reviewing endpoint telemetry observes that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' was modified to point to a PowerShell script in a user's AppData folder. The task runs daily with SYSTEM privileges. Which adversarial tactic does this activity most directly represent?

Accepted Answer

Persistence. Modifying a scheduled task to run a malicious payload with high privileges is a well-known persistence technique. It ensures the adversary's code executes automatically on a schedule, surviving restarts and user logoffs. The other tactics may be incidental, but the defining characteristic is maintaining long-term access, which is the goal of Persistence.

Answer

Execution

Answer

Defense Evasion

Answer

Privilege Escalation

Question 3

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

Accepted Answer

Disabling unused modules (e.g., WebDAV, directory listing) in the web server configuration.. Option D is correct because endpoint hardening of a web service requires reducing the attack surface by disabling unnecessary features such as WebDAV, autoindex/directory listing, and other unused modules in the web server configuration (e.g., Apache's LoadModule directives or IIS role services), which eliminates known vectors for information disclosure and exploitation. Option E is correct because default welcome pages, sample scripts, and demo applications (e.g., IIS iisstart.htm or Apache's default index) are well-known fingerprints and often contain vulnerabilities, so removing them is a standard hardening step. Option A is incorrect because changing a wallpaper is cosmetic and has no security impact on the web service. Option B is incorrect because auto-restarting every 10 minutes does not harden the service and could actually cause availability problems. Option C is incorrect because adding RAM is a performance/capacity upgrade, not a security hardening measure.

Answer

Changing the administrator's wallpaper to the company logo.

Answer

Configuring the server to auto-restart every 10 minutes.

Answer

Replacing the server's RAM with larger capacity sticks.

Question 4

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

Accepted Answer

ICMP tunneling. ICMP tunneling uses the data payload of ICMP packets to encapsulate other protocol traffic, which is a common exfiltration or command-and-control technique.

Answer

DNS spoofing

Answer

Network congestion

Answer

A standard network ping

Question 5

A CCOA analyst is helping to classify assets for a new cybersecurity program. The organization wants to identify which assets are most critical so that protection and monitoring efforts can be prioritized. Which criterion is the MOST appropriate basis for classifying an asset as high criticality?

Accepted Answer

The asset processes or stores regulated customer data and supports a revenue-generating service.. Asset criticality classification should be driven by the business impact of compromise or failure. Assets that process regulated data and directly enable revenue are high criticality because their loss triggers legal, financial, and reputational consequences. This aligns protection and monitoring resources with the organization's most important dependencies and compliance obligations.

Answer

The asset has the highest purchase price in the inventory.

Answer

The asset is managed by the IT team with the largest headcount.

Answer

The asset is the newest model in its category.

Question 6

A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?

Accepted Answer

Perform a frequency analysis of connection time intervals. Beaconing is characterized by regular, periodic callbacks (e.g., every 60 seconds), so analyzing the distribution of inter-connection time intervals reveals the low-variance periodicity that distinguishes C2 traffic from normal user-driven traffic. Frequency analysis (e.g., via histograms, Fourier transforms, or standard deviation of intervals) surfaces this pattern even in high-volume PCAP/NetFlow data. Bandwidth, port entropy, and byte counts do not capture the temporal regularity that defines beaconing.

Answer

Identify top talkers by total bandwidth consumption

Answer

Filter connections by source port entropy

Answer

Calculate the mean of bytes transferred per session

Question 7

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

Accepted Answer

Configure the service folder permissions to restrict write access to the 'Administrators' group only.. Hardening services that run as SYSTEM requires securing the directory permissions so only authorized users can write to the application folder, preventing the loading of malicious DLLs.

Answer

Change the service account to a local 'Guest' account.

Answer

Enable 'Service Isolation' in the Registry using the 'ServiceSidType' key.

Answer

Rename the service executable to a random string.

Question 8

Which THREE of the following are common 'Exfiltration' techniques?

Accepted Answer

Exfiltration over alternative protocol. Exfiltration over alternative protocol (A) is correct because attackers commonly move stolen data out of a network using protocols other than the primary C2 channel, such as DNS, FTP, SMTP, or ICMP, to evade detection and blend with legitimate traffic. Exfiltration over C2 channel (C) is correct because the same command-and-control channel already established for remote access is frequently reused to transfer collected data out of the environment, often encoded or tunneled within the C2 traffic. Exfiltration to cloud storage (E) is correct because adversaries increasingly upload data to legitimate cloud services (e.g., Dropbox, Google Drive, OneDrive) using APIs or web protocols, which can bypass traditional perimeter controls and appear as normal user activity. Keylogging (B) is not an exfiltration technique but a collection technique, as it captures keystrokes for later theft rather than moving data off the system. File system enumeration (D) is also not exfiltration; it is a discovery technique used to identify files and directories of interest before collection or staging occurs.

Answer

Keylogging

Answer

File system enumeration

Question 9

A financial services firm wants to reduce the likelihood that a former employee can use still-valid credentials to access internal systems after termination. Which administrative control should the security team implement FIRST?

Accepted Answer

Establish a formal offboarding procedure that disables accounts immediately upon termination.. The most direct way to prevent a former employee from using valid credentials is to ensure those credentials are disabled as part of a formal offboarding process. Administrative controls such as documented procedures govern how and when accounts are revoked. Technical measures like PAM, MFA, and segmentation are useful but do not replace timely account deactivation.

Answer

Implement network segmentation to isolate internal systems from remote access.

Answer

Deploy a privileged access management (PAM) solution to vault administrator credentials.

Answer

Enable multi-factor authentication (MFA) for all internal system logins.

Question 10

Which type of log provides the most granular detail regarding local account creation on a Windows Server?

Accepted Answer

Security logs. Windows Security logs (recorded in the Security event log, viewable in Event Viewer under Windows Logs > Security) capture authentication, authorization, and account management events, including local account creation (Event ID 4720), password changes (4723/4724), and group membership changes (4728/4732). These events include the actor, target account, and timestamp, providing the granular audit trail needed for account-creation forensics.

Answer

System logs

Answer

Application logs

Answer

DNS logs

Question 11

A SOC analyst is investigating a suspected data exfiltration event on a Windows 10 endpoint. The analyst needs to enumerate all active network connections along with the owning process IDs to identify which process is communicating with an external IP. Which built-in Windows command should the analyst use?

Accepted Answer

netstat -ano. The netstat command with -ano flags provides a comprehensive view of all active TCP connections and listening ports, including the numeric addresses and the owning process identifier. This allows the analyst to correlate a suspicious external connection with a specific process, which is essential for determining whether the traffic is legitimate or indicative of exfiltration.

Answer

route print

Answer

nslookup -type=ANY

Answer

ipconfig /all

Question 12

A security operations center is establishing a baseline for privileged account management across its server estate. The team must reduce the risk that compromised administrative credentials lead to widespread lateral movement. Which TWO controls should the team implement to directly limit the blast radius of a compromised privileged account? (Choose two.)

Accepted Answer

Enforce just-in-time elevation so administrative rights are granted only for the duration of an approved task. Blast radius is bounded by how much authority a stolen credential carries and for how long. Just-in-time elevation compresses the window in which administrative rights exist, and separating administrative accounts from daily-use identities prevents routine credential theft from yielding privilege. Password length, disk encryption, and antivirus all improve general security posture but none of them restrict what a valid privileged credential can reach once it is in an attacker's hands.

Answer

Increase the minimum password length for all accounts to 20 characters

Answer

Deploy a signature-based antivirus agent on every server

Answer

Enable full-disk encryption on all administrator workstations

Question 13

Which TWO of the following are considered 'Technical' controls?

Accepted Answer

Firewall configuration. Technical controls (logical controls) are implemented via software, hardware, or firmware.

Answer

Background checks

Answer

Security policy documentation

Answer

Guard patrol

Question 14

A healthcare organization's security operations team is mapping controls to the NIST Cybersecurity Framework. The CISO asks which function is primarily concerned with understanding the organization's assets, business environment, and risk appetite so that security activities can be prioritized. Which NIST CSF function should the analyst identify?

Accepted Answer

Identify. The Identify function establishes organizational understanding of assets, business environment, governance, and risk appetite, which is exactly what the CISO wants before prioritizing security activities. Protect, Detect, and Respond all depend on that foundational understanding and address safeguards, monitoring, or incident handling rather than asset and risk context.

Answer

Protect

Answer

Detect

Answer

Respond

Question 15

A security operations center (SOC) analyst is triaging a potential endpoint compromise. The EDR console shows a suspicious process created by a Microsoft Word document that spawned a child process of 'powershell.exe' with the arguments '-nop -w hidden -enc JABjAGwAaQBlAG4AdA...'. The parent process has since exited. Which detection technique would best confirm whether this activity represents a true positive?

Accepted Answer

Decoding the Base64 PowerShell argument and examining the resulting script for known malicious behaviors such as downloading a payload or establishing a reverse shell.. The encoded PowerShell command is the core artifact. Decoding it reveals the actual script, and if that script performs clearly malicious actions such as downloading a payload or creating a reverse shell, the activity is confirmed as a true positive. Other options provide supporting evidence but do not definitively prove malicious intent in this scenario.

Answer

Reviewing the Windows Security event log for Event ID 4688 to identify the full command line of the PowerShell process and its parent process ID.

Answer

Inspecting the Windows Registry for persistence mechanisms added by the PowerShell process, such as a Run key entry.

Answer

Checking the Microsoft Word document's file hash against VirusTotal to see if any antivirus engines flag it as malicious.

Question 16

During incident response for a suspected data exfiltration, the team captures full packet data at the perimeter. The CCOA analyst needs to determine whether large outbound transfers occurred over an encrypted channel that cannot be inspected. Which network flow artifact should the analyst use to identify the volume and duration of the transfers while preserving the ability to correlate with other logs?

Accepted Answer

NetFlow records exported from the perimeter router. Flow records provide the metadata needed to quantify outbound transfer volume and duration without decrypting payloads. They are lightweight, widely retained, and easily correlated with other telemetry, making them the right artifact for this encrypted-traffic scenario. Full packet capture is less efficient for volume analysis, while DNS and proxy logs address different aspects.

Answer

DNS query logs from the internal resolver

Answer

Full packet capture analyzed with a protocol analyzer

Answer

Proxy access logs with HTTP status codes

Question 17

A security operations center (SOC) analyst is triaging an alert indicating a potential phishing email that was delivered to several users. The analyst needs to determine if any user interacted with the malicious link. Which two data sources would be most directly useful for this determination? (Choose two.)

Accepted Answer

Endpoint detection and response (EDR) telemetry. Web proxy logs and EDR telemetry both provide direct evidence of user interaction with a link. Proxy logs show the outbound request to the malicious URL, while EDR captures the browser process and network connection on the endpoint. Together, they can confirm if a user clicked the link. Other sources lack the necessary user or process context to make that determination.

Answer

Firewall logs

Answer

Domain Name System (DNS) logs

Answer

Email gateway logs

Question 18

During a risk assessment, an analyst determines that a legacy payroll application has a vulnerability that could allow remote code execution. The vendor no longer issues patches, and the application is required for monthly payroll runs. The CISO accepts the residual risk and documents the decision. Which risk treatment option has the organization chosen?

Accepted Answer

Risk acceptance. When an organization acknowledges a risk and formally decides to retain it after weighing treatment options, the chosen response is risk acceptance. Avoidance would require eliminating the payroll application, transfer would shift impact to a third party, and mitigation would add controls. The documented CISO decision confirms acceptance of residual risk.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 19

A hospital's risk register lists ransomware against its electronic health record system with a likelihood of 'High' and an impact of 'Critical' on a five-point qualitative scale. The CISO must select a treatment option that reduces the residual risk to an acceptable level while preserving clinical availability. Which treatment approach BEST fits this scenario?

Accepted Answer

Mitigate the risk with layered controls such as immutable offline backups, network segmentation, and tested recovery procedures.. Because ransomware against clinical systems threatens both data and availability, the appropriate treatment is mitigation through layered preventive and recovery controls. Immutable offline backups remove the attacker's leverage, segmentation constrains spread, and tested recovery preserves patient care. Acceptance, pure transfer, and avoidance all fail to reduce the operational impact the hospital cannot tolerate.

Answer

Avoid the risk by disconnecting the electronic health record system from all external networks permanently.

Answer

Accept the risk because the electronic health record vendor contractually guarantees system uptime.

Answer

Transfer the risk entirely by purchasing a cyber insurance policy covering ransomware incidents.

Question 20

A security analyst is conducting a qualitative risk assessment for a new cloud-based customer relationship management (CRM) system. The team wants to prioritize risks without assigning monetary values. Which TWO factors are most relevant when using a qualitative risk matrix? (Choose two.)

Accepted Answer

Impact or severity to business operations if the risk materializes. Qualitative risk matrices rank risks by combining likelihood and impact using descriptive scales. These two factors allow prioritization without monetary calculations. ALE, NPV, and ROSI are quantitative or financial metrics that require monetary inputs, so they fall outside the scope of a qualitative assessment focused on relative ranking.

Answer

Net present value (NPV) of the CRM investment

Answer

Return on security investment (ROSI) percentage

Answer

Annualized loss expectancy (ALE) in monetary terms