CCOA Practice Exam 4 — 20 Questions

Question 1

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Time window. In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.

Answer

Throttle field

Answer

Notable event urgency

Answer

Risk score adjustment

Question 2

You are investigating an alert in CrowdStrike Falcon. To determine if a file was moved laterally after its initial execution, which feature provides the most accurate visualization?

Accepted Answer

Process Tree view. The Process Tree visualization in CrowdStrike Falcon allows analysts to trace the execution history and lateral movement paths of malicious files across different endpoints.

Answer

Indicator of Compromise (IOC) search

Answer

Detection dashboard filter

Answer

Host search history

Question 3

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

Accepted Answer

Firewall logs. SIEMs ingest data from various layers including identity providers, network infrastructure, and endpoint monitoring tools to provide comprehensive visibility.

Answer

Employee payroll spreadsheets

Answer

Kitchen appliance status reports

Question 4

Which THREE techniques do attackers use to maintain persistence on a Windows host?

Accepted Answer

Installing a malicious system service. Persistence is maintained by registering code with startup processes (Registry), system services, or scheduled tasks.

Answer

Changing the desktop background

Answer

Updating the browser's homepage

Question 5

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.

Answer

Increasing password complexity

Answer

VLAN isolation

Answer

Firewall rules

Question 6

After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?

Accepted Answer

RAM image first, then disk. Memory (RAM) should be captured before disk storage because memory content is lost as soon as the machine is powered off or rebooted.

Answer

Network traffic logs, then RAM

Answer

Disk image first, then RAM

Answer

Reboot the machine, then image

Question 7

Which THREE factors should be considered when assessing the severity of a security incident?

Accepted Answer

Scope of the affected systems. Severity assessment depends on the impact to business operations, the sensitivity of the compromised data, and the scope of the affected systems.

Answer

The day of the week the incident occurred

Answer

The analyst's personal opinion

Question 8

In the context of the NIST Incident Response lifecycle, which phase involves the identification of the root cause?

Accepted Answer

Detection and Analysis. The Analysis phase involves determining the nature, scope, and magnitude of the incident, which leads to understanding the root cause.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 9

You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?

Accepted Answer

Windows Registry keys. Fileless malware often lives in the Windows Registry, specifically under 'Run' or 'RunOnce' keys, to ensure execution without a physical file on disk.

Answer

AppData/Roaming

Answer

System32 directory

Answer

Temp folder

Question 10

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

Accepted Answer

Resetting compromised user credentials. Eradication involves removing the root cause, such as cleaning malware or removing unauthorized user accounts.

Answer

Updating documentation for the incident report

Answer

Restoring data from a known good backup

Answer

Identifying the initial attack vector

Question 11

You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?

Accepted Answer

PutBucketPolicy. 'PutBucketPolicy' is the specific API call recorded in CloudTrail when an IAM identity modifies the bucket policy of an S3 bucket.

Answer

UpdatePolicy

Answer

ModifyBucketPolicy

Answer

DescribeBucketPolicy

Question 12

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

Accepted Answer

Incident creation is toggled off in the rule configuration. If 'Incident creation' is disabled in the Microsoft Sentinel analytics rule settings, the rule will generate logs but will not group them into an incident for investigation.

Answer

The KQL query lacks a 'summarize' operator

Answer

Log Analytics workspace ingestion limit reached

Answer

The analytics rule is set to 'Disabled' instead of 'Enabled'

Question 13

When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?

Accepted Answer

Loaded DLLs and system handles. Fileless malware resides in memory and often leaves traces in process structures, injected code, and handles.

Answer

Browser history files

Answer

Unallocated space in the master file table

Question 14

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

Accepted Answer

ICMP tunneling. ICMP tunneling uses the data payload of ICMP packets to encapsulate other protocol traffic, which is a common exfiltration or command-and-control technique.

Answer

DNS spoofing

Answer

Network congestion

Answer

A standard network ping

Question 15

You are investigating a potential insider threat. Which log is most useful for tracking file deletion activity on a Windows file server?

Accepted Answer

Object Access auditing logs. Enabling Object Access auditing in the Windows Security policy allows you to track specific file actions, including deletion (Event ID 4660).

Answer

System event logs

Answer

DNS query logs

Answer

Security account management logs

Question 16

When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?

Accepted Answer

ssdt. ssdt and modules are critical for identifying hooking and unauthorized kernel objects.

Answer

pslist

Answer

hashdump

Answer

hivelist

Question 17

You are evaluating a third-party application's access requirements. Which THREE of the following are considered 'Least Privilege' implementations?

Accepted Answer

Using a dedicated service account instead of a personal user account for application processes.. Least privilege requires granting only the absolute minimum permissions needed for a task, using granular roles, and scoping access by resource.

Answer

Granting the application access to all internal databases 'just in case' it needs them later.

Answer

Granting the application service account 'Owner' role on the entire Azure Subscription.

Question 18

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

Accepted Answer

Post-incident activity. The Post-Incident Activity phase (or Lessons Learned) is dedicated to documenting what happened and how to improve future responses.

Answer

Detection and Analysis

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 19

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

Accepted Answer

To preserve volatile evidence in RAM. Turning off the machine clears the RAM, which contains volatile evidence that is critical for incident analysis.

Answer

To allow the attacker to keep working

Answer

Because the OS might crash

Answer

To save electricity

Question 20

Which TWO of the following Windows log types are most useful for detecting lateral movement?

Accepted Answer

System logs. Lateral movement is often detected by monitoring authentication logs (logons/logoffs) and process creation events (for remote execution tools like PsExec).

Answer

Power management logs

Answer

Windows Update logs

Answer

DNS client logs