CCOA Practice Test 21 — 15 Questions

Question 1

A threat hunter is analyzing endpoint telemetry and notices a process that has established a network connection to an external IP address. The process is running from a temporary directory, has no digital signature, and its parent process is a known vulnerable service. Which of the following techniques is MOST consistent with this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploitation of a vulnerable service to drop and execute a payload. The combination of a vulnerable parent service, an unsigned child process in a temporary directory, and an external network connection strongly indicates exploitation followed by payload execution. Attackers often exploit services like web servers or SMB to drop tools in writable directories and establish command-and-control. This behavior is less consistent with LOLBin abuse, process injection, or legitimate scheduled tasks, which have different signatures.

Answer

Living-off-the-land binary (LOLBin) execution

Answer

Process injection into a trusted process

Answer

Scheduled task created by a legitimate application

Question 2

When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?

Accepted Answer

The VM acts as a direct node on the physical network.. A bridged network adapter connects the VM's virtual NIC directly to the physical network segment, making the VM appear as an independent host with its own MAC and IP address. From the network's perspective, the VM is a peer of the physical host and other devices — it can send and receive broadcast traffic, obtain DHCP leases, and be reached directly by other nodes. This expands the attack surface because the VM is no longer shielded by the host's network stack.

Answer

The VM is isolated from the physical network.

Answer

The VM can only communicate with the host.

Answer

The VM uses the host's IP address.

Question 3

A security operations team is implementing a new endpoint detection and response (EDR) solution. They need to ensure that the EDR agent has the necessary visibility to detect malicious activity and that the collected data is protected. Which TWO of the following actions are MOST critical to achieve these goals? (Choose two.)

Accepted Answer

Ensure the EDR agent has kernel-level visibility to monitor system calls and process creation.. The two most critical actions are ensuring kernel-level visibility and enabling tamper protection. Kernel-level visibility provides the deep telemetry needed to detect sophisticated threats, while tamper protection prevents attackers from disabling the agent. Together, they ensure both detection capability and data integrity. The other options either introduce risks, are not critical for EDR, or violate security best practices.

Answer

Store all EDR logs locally on the endpoint to reduce network bandwidth usage.

Answer

Configure the EDR agent to capture full packet payloads for all network traffic.

Answer

Use a shared service account with domain admin privileges for the EDR agent to access all endpoints.

Question 4

A financial analyst is evaluating a new trading platform. The platform provider claims that their system has a 'high' level of confidentiality, integrity, and availability. The analyst needs to determine the potential impact if the system were compromised. Which term best describes the potential loss or harm that could occur if a threat exploits a vulnerability?

Accepted Answer

Impact. The potential loss or harm resulting from a threat exploiting a vulnerability is called impact. Impact is a critical component of risk, which is often calculated as a function of likelihood and impact. In this scenario, the analyst is trying to determine the magnitude of harm, so impact is the correct term. Threat, vulnerability, and risk are related but distinct concepts.

Answer

Risk

Answer

Vulnerability

Answer

Threat

Question 5

A security operations center (SOC) analyst is investigating a suspected breach. The attacker used PowerShell to download and execute a payload in memory, leaving minimal disk artifacts. The analyst needs to reconstruct the attack by examining Windows event logs. Which Windows event log source should the analyst prioritize to find PowerShell script block logging and module logging details?

Accepted Answer

Microsoft-Windows-PowerShell/Operational. PowerShell script block logging and module logging are written to the Microsoft-Windows-PowerShell/Operational log. Event ID 4104 captures script blocks, and 4103 captures module and pipeline execution. These events provide the actual code and commands, enabling reconstruction of in-memory attacks. Other logs lack this level of detail.

Answer

Application

Answer

Security

Answer

System

Question 6

A security analyst is examining a suspicious PowerShell script that was executed on a Windows endpoint. The script appears to download and execute a payload from a remote server. Which of the following PowerShell features is MOST likely being abused to obfuscate the malicious code?

Accepted Answer

Base64 encoding of the command using the -EncodedCommand parameter.. Base64 encoding with the -EncodedCommand parameter is a widely used obfuscation technique in malicious PowerShell scripts. It transforms the entire command into a single encoded string, which can be executed directly by PowerShell. This hides the script's logic from plain sight and can bypass simple string-based detection. Security analysts should decode such strings to understand the script's behavior.

Answer

Using the Invoke-Expression cmdlet to execute dynamically constructed strings.

Answer

Using the Start-Job cmdlet to run the payload in a background job.

Answer

Leveraging PowerShell profiles to automatically run scripts at startup.

Question 7

A financial services firm is updating its risk management program and wants to strengthen how it treats risks that fall outside its risk appetite. The board has asked which activities are core components of a formal risk treatment process. (Choose two.)

Accepted Answer

Selecting treatment options such as mitigation, transfer, avoidance, or acceptance for each identified risk.. Risk treatment centers on deciding how each identified risk will be handled and ensuring someone owns that decision through implementation and monitoring. Selecting among mitigation, transfer, avoidance, and acceptance, paired with an accountable risk owner, constitutes the treatment process. Appetite definition, asset inventory, and penetration testing are important but belong to governance, identification, and assurance rather than treatment.

Answer

Establishing the organization's risk appetite and tolerance thresholds before any assessment begins.

Answer

Compiling the full inventory of information assets and their dependencies across the enterprise.

Answer

Performing penetration testing against all internet-facing systems on a quarterly schedule.

Question 8

A security operations centre analyst reviewing endpoint telemetry sees a process named 'rundll32.exe' executing with the command line 'rundll32.exe C:\Users\Public\upd.dat,Start'. The DLL was written to the Public folder minutes earlier by a macro-enabled document. The analyst must map this behaviour to the most appropriate MITRE ATT&CK technique. Which technique best fits this activity?

Accepted Answer

T1218.011 Signed Binary Proxy Execution: Rundll32. The combination of a signed Microsoft binary (rundll32.exe) executing a DLL from a user-writable location such as C:\Users\Public, immediately after a macro-enabled document ran, is textbook signed binary proxy execution. The technique abuses trust in legitimate system binaries to bypass application control and blend into normal process activity, which is why the rundll32 sub-technique is the accurate mapping rather than injection, scheduled tasks, or Run key persistence.

Answer

T1055 Process Injection

Answer

T1547.001 Registry Run Keys / Startup Folder

Answer

T1053.005 Scheduled Task/Job: Scheduled Task

Question 9

A security operations analyst is reviewing the hardening posture of a fleet of Windows Server 2022 hosts that run a custom line-of-business application requiring the legacy SMBv1 dialect for backward compatibility with an old vendor appliance. Leadership has approved a time-boxed exception but wants compensating controls. Which action BEST reduces the attack surface while honoring the approved exception?

Accepted Answer

Keep SMBv1 enabled but restrict it to the specific vendor appliance IP addresses with Windows Firewall rules and enable SMB signing and auditing on the hosts.. The approved exception exists because the legacy appliance cannot speak a modern SMB dialect. A proper compensating control honors that constraint while minimizing exposure, so scoping SMBv1 traffic to the single trusted peer and adding signing plus auditing is the balanced answer. Removing the protocol or assuming automatic negotiation both break the approved business function instead of containing its risk.

Answer

Leave SMBv1 enabled on all hosts without restriction but add a weekly vulnerability scan to detect exploitation attempts.

Answer

Disable the SMBv1 server service entirely and require the vendor appliance to be upgraded before the next audit cycle.

Answer

Replace SMBv1 with SMBv2 on the servers and configure the legacy appliance to negotiate down automatically.

Question 10

A cloud operations team manages thousands of container workloads in Kubernetes. The CISO wants to reduce the risk that a compromised container image introduces vulnerabilities into production. The team already scans images in the CI pipeline before deployment. Which additional control most directly addresses the risk of images being replaced or tampered with after scanning but before running?

Accepted Answer

Enforcing a Kubernetes admission controller that only admits images signed by a trusted authority and verified against a digest. The gap between CI scanning and runtime execution is closed by verifying image integrity at admission. A policy that requires a valid signature from a trusted authority and pins the immutable digest ensures only the exact scanned artifact runs. More frequent scanning, registry authentication, and audit logging improve detection or access control but do not prevent a substituted or retagged image from being deployed.

Answer

Configuring the container registry to require authentication for image pulls

Answer

Increasing the frequency of vulnerability scans in the CI pipeline to run on every commit

Answer

Enabling Kubernetes audit logging for all API server requests

Question 11

Which security framework is most commonly used by US federal agencies to manage security controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the mandatory security control catalog for US federal information systems.

Answer

ISO 27001

Answer

PCI-DSS

Answer

HIPAA

Question 12

A company is migrating its on-premises workloads to a hybrid cloud environment. The security team must ensure that data stored in the cloud object storage service is encrypted at rest and that the encryption keys are managed by the organization, not the cloud provider. The team also needs the ability to revoke access to the keys immediately if a compromise is suspected. Which key management approach should the team implement?

Accepted Answer

Customer-managed keys (CMK) using a hardware security module (HSM) in the cloud. Customer-managed keys with an HSM give the organization full control over key lifecycle, including the ability to revoke access immediately by disabling the key. Provider-managed keys and SSE-S3 leave control with the cloud provider, while client-side encryption with local keys does not integrate with cloud at-rest encryption and complicates revocation.

Answer

Server-side encryption with provider-managed keys (SSE-S3)

Answer

Provider-managed keys with automatic rotation

Answer

Client-side encryption with locally stored keys

Question 13

A CCOA analyst is triaging an alert from the SIEM indicating that a user account was added to the Domain Admins group outside of a change window. The analyst needs to determine whether this is a malicious privilege escalation or an authorized administrative action. Which immediate step BEST supports this determination?

Accepted Answer

Correlate the change with the change management system and the actor's identity. Privilege changes outside a change window are suspicious but not automatically malicious. The fastest way to resolve the ambiguity is to compare the event with change management records and identify the actor. If the change is authorized and documented, the alert can be closed; if not, it becomes a confirmed incident warranting containment.

Answer

Escalate the alert to the legal department for prosecution

Answer

Block all traffic from the source IP address of the change

Answer

Disable the user account and reset its password

Question 14

A financial institution's SOC is investigating a suspected data exfiltration incident. The team has collected network flow data, proxy logs, and endpoint logs. Which two of the following indicators are MOST indicative of data exfiltration over a covert channel? (Choose two.)

Accepted Answer

Large outbound data transfers to an external IP address during non-business hours. Large outbound transfers during off-hours and frequent DNS queries with long random subdomains are both strong indicators of covert exfiltration. The former suggests bulk data movement, while the latter indicates DNS tunneling used to sneak data past perimeter defenses. Other options describe authentication attacks, inbound traffic, or C2 communication, which are not direct evidence of data leaving the network via a covert channel.

Answer

Multiple failed login attempts from an internal host to a domain controller

Answer

Repeated connections to a known command-and-control server on port 443

Answer

A sudden increase in inbound HTTPS traffic to a web server

Question 15

A CCOA analyst is triaging an alert about a workstation that repeatedly contacts a known malicious IP address. The analyst wants to quickly block further communication from that host while preserving volatile evidence for later analysis. Which action best meets both goals?

Accepted Answer

Isolate the endpoint using the EDR console and capture a memory image before remediation. The goal is to stop communication while preserving volatile evidence. EDR isolation achieves network containment without powering off the host, and memory capture retains critical artifacts before remediation. Powering off, disabling accounts, or blocking a single IP either destroys evidence or fails to contain the host comprehensively.

Answer

Immediately power off the workstation to prevent further malicious activity

Answer

Add the malicious IP to the firewall blocklist at the perimeter

Answer

Disable the user's Active Directory account and reset the password