CCOA Practice Exam 4 — 20 Questions

Question 1

A CCOA analyst is evaluating a third-party SaaS vendor that will process regulated financial data. The vendor's SOC 2 Type II report covers security and availability but excludes confidentiality. The contract includes a right-to-audit clause and a 24-hour breach notification requirement. Which remaining action is MOST important to close the assurance gap?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obtain a SOC 2 Type II report covering the confidentiality trust services criterion. The vendor already provides Type II attestation for security and availability, so the missing element is period-based, independently tested assurance over confidentiality. A SOC 2 Type II report scoped to the confidentiality criterion supplies that evidence and aligns with due diligence expectations for regulated financial data. Contract clauses and management-system certificates do not demonstrate tested operating effectiveness.

Answer

Accept the vendor's ISO/IEC 27001 certificate as equivalent coverage

Answer

Rely on the contractual right-to-audit clause as sufficient assurance

Answer

Request the vendor complete a SOC 2 Type I report for the confidentiality criterion

Question 2

A CCOA analyst is establishing a risk appetite statement for a hospital network that must balance patient safety, regulatory obligations under HIPAA, and operational availability of clinical systems. Which TWO characteristics must the risk appetite statement exhibit to be considered effective by ISACA risk governance principles? (Choose two.)

Accepted Answer

It is expressed in qualitative and quantitative terms tied to measurable thresholds. Effective risk appetite statements are measurable and executive-owned. Measurable thresholds let decision-makers judge whether a specific exposure sits inside or outside tolerance, while executive and board ownership ensures appetite reflects strategy and regulatory duty. For a hospital, that combination properly weights patient safety and HIPAA obligations against availability and cost trade-offs.

Answer

It is kept confidential and shared only with the security operations team

Answer

It eliminates all residual risk across clinical and administrative systems

Answer

It is revised annually regardless of changes in business strategy

Question 3

A CCOA analyst is investigating suspicious activity on a Linux web server running Apache. The analyst runs 'ss -tulpn' and sees that the server is listening on port 8443, but the organization's asset inventory lists this server as only providing HTTP on port 80 and HTTPS on port 443. The analyst needs to determine which process is bound to port 8443 and whether it is authorized. Which command should the analyst use next to identify the process name and PID associated with port 8443?

Accepted Answer

lsof -i :8443. Mapping an unexpected listening port to its owning process is a core incident response step. The 'lsof -i :8443' command lists open Internet sockets on that port and includes the process name, PID, and user. This gives the analyst the exact information needed to determine whether the process is authorized and to take further action such as terminating or investigating it.

Answer

nmap -sV -p 8443 localhost

Answer

tcpdump -i any port 8443

Answer

netstat -anp | grep 8443

Question 4

A manufacturing company is building a hardened baseline for its industrial control system (ICS) engineering workstations, which run Windows and connect to programmable logic controllers on the plant floor. The security team must reduce the attack surface without disrupting production. Which two controls are most appropriate to include in the baseline for these workstations? (Choose two.)

Accepted Answer

Disabling USB mass storage and restricting removable media to approved, scanned devices. ICS engineering workstations require compensating controls because patching is constrained by vendor certification and production uptime. Application allowlisting restricts execution to approved engineering and HMI software, and disabling USB mass storage with controlled, scanned media blocks a common infection path. Automatic untested updates, consumer antivirus, and unrestricted utility installation all introduce availability or integrity risk and do not belong in the baseline.

Answer

Enabling automatic operating system updates that install immediately without testing

Answer

Installing consumer antivirus software with aggressive heuristic scanning on all engineering hosts

Answer

Allowing engineers to install any utility from the internet to troubleshoot PLC connectivity

Question 5

A security operations team is designing the asset inventory for a hybrid environment that includes on-premises servers, cloud workloads, and employee-owned mobile devices. The team wants to ensure the inventory supports both vulnerability management and incident response. Which data element is MOST important to include for every asset so that responders can quickly determine ownership and escalation paths during an incident?

Accepted Answer

The assigned business owner and technical custodian with contact details. An asset inventory serves both vulnerability management and incident response only when each record answers who owns the asset and whom to contact. Business owner and technical custodian fields with current contact information create the escalation chain that responders rely on to authorize containment and interpret business impact. Technical attributes such as patch level, location, or identifiers support analysis but do not establish accountability, which is the deciding factor in this scenario.

Answer

The asset's physical rack location and data center row

Answer

The asset's operating system build number and patch level

Answer

The asset's primary MAC address and hostname

Question 6

A security analyst is reviewing the configuration of a Windows file server that stores personnel records. The analyst wants to verify that only members of the HR group can read the payroll folder and that all other authenticated users are explicitly denied access. Which type of access control model is being applied when permissions are assigned directly to named users and groups on each file and folder?

Accepted Answer

Discretionary access control (DAC). When permissions are written directly onto each file and folder and granted to named users or groups, the object owner or administrator is exercising discretion over access, which defines discretionary access control. NTFS access control lists on a Windows file server are a standard implementation. Mandatory, role-based, and attribute-based models each centralize or abstract the decision differently and do not match the direct per-object assignment described.

Answer

Mandatory access control (MAC)

Answer

Role-based access control (RBAC)

Answer

Attribute-based access control (ABAC)

Question 7

An analyst at a financial firm is reviewing network flow logs and notices a workstation repeatedly initiating SMB connections to multiple internal servers on TCP port 445, followed by large outbound data transfers to an external IP. The workstation's user reports no unusual activity. The analyst suspects lateral movement and data exfiltration. Which technology should the analyst use to correlate these network events with endpoint process and file activity to confirm the attack chain?

Accepted Answer

Security information and event management (SIEM) with endpoint detection and response (EDR) integration. Correlating network flows with endpoint telemetry requires a platform that ingests both network and host data. SIEM provides centralized correlation, and EDR supplies granular process and file activity. Together, they enable the analyst to reconstruct the sequence from initial SMB connections to data staging and outbound transfer, confirming lateral movement and exfiltration.

Answer

Network access control (NAC) with 802.1X authentication

Answer

Intrusion prevention system (IPS) with signature-based detection

Answer

Full packet capture (PCAP) with deep packet inspection (DPI)

Question 8

You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?

Accepted Answer

FTK Imager. FTK Imager is a widely accepted forensic tool that creates bit-stream (physical) images of storage media and generates MD5/SHA-1 hash values to verify that the image is an exact, unaltered copy of the original. It supports write-blocking awareness, E01 and raw formats, and hash verification, satisfying the integrity requirement for evidentiary purposes. This makes it the standard choice for imaging a SATA drive in a forensically sound manner.

Answer

Robocopy

Answer

Diskpart

Answer

Windows File Explorer

Question 9

During a control review, an analyst finds that a privileged service account used by a backup platform has a password that has not rotated in three years and is stored in a plaintext configuration file on a management server. The backup platform cannot support modern authentication methods. Which compensating control BEST addresses the credential risk without breaking the backup jobs?

Accepted Answer

Move the plaintext credential into a secrets vault and have the backup platform retrieve it at runtime through a privileged access management broker.. The problem is a static plaintext privileged secret that never rotates. Brokering retrieval through a vault and PAM layer removes the on-disk secret, enforces controlled access, and creates an audit trail while still letting the backup platform authenticate. Strengthening the password, rotating manually, or widening privileges all leave the fundamental exposure intact or make it worse.

Answer

Schedule a quarterly password rotation for the service account and update the configuration file manually each time.

Answer

Increase the service account password length to 25 characters and store the file with NTFS permissions restricted to administrators.

Answer

Grant the service account domain administrator rights so that any credential misuse can be traced more easily in the logs.

Question 10

A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?

Accepted Answer

Isolate the host from the network. Isolating the affected host from the network prevents the ransomware from spreading to other shares or command-and-control servers while preserving local evidence.

Answer

Reboot the server

Answer

Delete the suspicious files

Answer

Change all user passwords

Question 11

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

Accepted Answer

The attacker targeted a software vulnerability in an application. This technique involves exploiting a client-side application (like a browser or PDF reader) to execute code.

Answer

The user clicked a link

Answer

The attacker used social engineering

Answer

The user was logged in via RDP

Question 12

During incident response, an analyst observes that an attacker used 'reg save HKLM\SAM C:	emp\sam.hiv' and 'reg save HKLM\SYSTEM C:	emp\system.hiv' on a compromised host. The analyst then sees the files being exfiltrated. Which MITRE ATT&CK tactic is the attacker primarily performing with the 'reg save' commands?

Accepted Answer

Credential Access. The correct answer is Credential Access because the attacker uses 'reg save' to dump the SAM and SYSTEM hives, which store password hashes. This is a direct credential dumping technique. The other tactics—Collection, Exfiltration, and Discovery—describe different phases of the attack lifecycle that are not the primary purpose of these commands.

Answer

Exfiltration

Answer

Collection

Answer

Discovery

Question 13

Which of these is a 'Defense Evasion' technique?

Accepted Answer

Masquerading as a system process. Using masquerading (renaming files to look like system files) is a common way to hide malicious processes.

Answer

Creating a scheduled task

Answer

Stealing a hash

Answer

Scanning ports

Question 14

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.

Answer

Probabilistic

Answer

Deterministic

Answer

Quantitative

Question 15

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

Accepted Answer

$5,000. ALE = SLE * ARO. $10,000 * 0.5 = $5,000.

Answer

$10,000

Answer

$20,000

Answer

$2,500

Question 16

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 17

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

Accepted Answer

Non-repudiation. Non-repudiation refers to the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity.

Answer

Data integrity

Answer

Availability

Answer

Confidentiality

Question 18

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

Accepted Answer

Resetting compromised user credentials. Eradication involves removing the root cause, such as cleaning malware or removing unauthorized user accounts.

Answer

Updating documentation for the incident report

Answer

Restoring data from a known good backup

Answer

Identifying the initial attack vector

Question 19

A security operations analyst is building a data classification and handling standard for a new document management platform that stores contracts, HR records, and public marketing collateral. The analyst must define controls that apply to the highest sensitivity tier. Which TWO actions are appropriate for assets classified at the highest sensitivity level? (Choose two.)

Accepted Answer

Enforce least privilege with role-based access and log all access to the sensitive repositories for monitoring.. The highest sensitivity tier demands controls that both protect and monitor the data. Encrypting at rest and in transit with governed keys protects confidentiality, while least-privilege role-based access plus comprehensive logging limits and detects misuse. Reusing public access rules, allowing unmanaged local copies, or relying on documentation alone all fail to contain the risk that top-tier classification implies.

Answer

Apply the same access control policy used for public marketing collateral to simplify administration.

Answer

Allow users to store local copies on unmanaged endpoints to improve productivity during contract negotiations.

Answer

Publish the classification labels in a public wiki so all staff understand how data is tagged.

Question 20

An analyst reviewing endpoint telemetry sees rundll32.exe executing a DLL from a user's Downloads folder with an export named 'Start'. The DLL was downloaded from an external site minutes earlier. Which MITRE ATT&CK tactic is most directly represented by this activity?

Accepted Answer

Execution. Using rundll32.exe to call an exported function from a downloaded DLL is a straightforward execution technique. The adversary has already delivered the file and is now causing it to run. The tactic that most directly describes this step is execution, regardless of any secondary evasion benefit from abusing a signed binary.

Answer

Defense Evasion

Answer

Command and Control

Answer

Persistence