CCOA Practice Test 22 — 15 Questions

Question 1

You are auditing a web application server. You discover it is running with high privileges. What is the standard security practice to mitigate this risk?

Accepted Answer

Run as a non-privileged service account.. Running a web application server with high privileges means a compromise of the service yields administrative control over the host, so the standard mitigation is to run it under a dedicated non-privileged service account with only the permissions it needs. This enforces least privilege and limits blast radius if the service is exploited. It is a foundational hardening practice across CIS, NIST, and OWASP guidance.

Answer

Use a local administrator account.

Answer

Increase logging levels.

Answer

Disable the firewall.

Question 2

You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?

Accepted Answer

Implement cryptographic hashing/digital signatures. Tampering in STRIDE refers to unauthorized modification of data or code, so the most effective mitigation is cryptographic hashing and digital signatures (C), which let the receiver detect any alteration to data in transit or at rest. If a message or record is modified, the hash or signature verification fails, providing integrity assurance that no other control in the list delivers. This directly addresses the tampering threat at the data-integrity layer.

Answer

Implement TLS encryption

Answer

Implement logging and auditing

Answer

Implement Role-Based Access Control

Question 3

A security operations center is reviewing its endpoint detection and response (EDR) coverage. The team wants to ensure that the EDR solution can detect and respond to threats that use fileless techniques and living-off-the-land binaries (LOLBins). Which two capabilities are most critical for the EDR to provide this coverage? (Choose two.)

Accepted Answer

Script block logging and AMSI integration on Windows endpoints. Fileless attacks and LOLBin abuse rely on trusted system tools and in-memory execution, so EDR must monitor process behavior and command-line arguments, and leverage script block logging and AMSI to inspect script content. These capabilities provide the visibility needed to detect and respond to such threats, whereas encryption, vulnerability scanning, and segmentation do not address endpoint detection.

Answer

Periodic vulnerability scanning of installed applications

Answer

Network segmentation between user and server VLANs

Answer

Full disk encryption of endpoint storage

Question 4

A security analyst reviewing endpoint telemetry notices that shortly after a user opened a malicious email attachment, a process named 'outlook.exe' spawned 'powershell.exe' with an encoded command line. The encoded command decoded to a script that downloaded a payload from an external IP address. Which MITRE ATT&CK tactic best describes the initial spawning of PowerShell from Outlook?

Accepted Answer

Execution. The correct answer is Execution because the adversary is running malicious code via PowerShell spawned from Outlook. This is a direct example of the Execution tactic, where user interaction leads to code execution. The other tactics—Persistence, Privilege Escalation, and Defense Evasion—describe different adversary goals not present in the scenario.

Answer

Defense Evasion

Answer

Persistence

Answer

Privilege Escalation

Question 5

A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large volume of outbound traffic from an internal server to an external IP address over port 53. The analyst suspects DNS tunneling. Which of the following techniques would BEST confirm this suspicion?

Accepted Answer

Analyze the size and entropy of DNS query names and responses.. DNS tunneling encapsulates data within DNS queries and responses, often using subdomains to carry encoded payloads. These encoded strings tend to be long and have high entropy, resembling random characters. By analyzing the size and entropy of DNS query names and responses, an analyst can detect anomalies that deviate from normal DNS traffic. This method directly examines the content, making it the most reliable confirmation technique.

Answer

Check if the external IP is a known DNS server using a reverse DNS lookup.

Answer

Monitor for an increase in the number of DNS queries from the internal server.

Answer

Capture packets and inspect the DNS query types (e.g., A, AAAA, TXT).

Question 6

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

Accepted Answer

Lateral Movement. The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.

Answer

Credential Access

Answer

Exfiltration

Answer

Persistence

Question 7

An analyst notices that a process on a finance workstation is repeatedly writing compressed archives to a hidden directory and then uploading them to an external IP address during non-business hours. No user is logged in interactively at the time. Which adversarial tactic does this activity most directly represent?

Accepted Answer

Exfiltration. Repeatedly creating compressed archives and sending them to an external IP address during non-business hours reflects data being removed from the environment. That transfer of stolen data to an external destination is the defining characteristic of Exfiltration, distinguishing it from local staging or control-channel activity.

Answer

Collection

Answer

Discovery

Answer

Command and Control

Question 8

A SOC analyst notices a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' running a binary in C:\Users\Public\ that calls back to an external IP every 15 minutes. The task was created at 03:14, outside of the normal patch window. Under which MITRE ATT&CK tactic is this activity best categorized?

Accepted Answer

Persistence. Scheduled tasks configured to run adversary payloads on a recurring basis are a well-documented persistence mechanism because they survive reboots and can masquerade as legitimate update jobs. The unusual creation time and the binary location in a public user directory reinforce that this is an attempt to maintain long-term access rather than one-time execution or privilege elevation.

Answer

Command and Control

Answer

Privilege Escalation

Answer

Execution

Question 9

A healthcare organization's incident response team is investigating a breach involving a compromised web server that may have exposed patient data. The team must determine the scope of the data exposure. Which of the following actions should be performed FIRST to preserve evidence while enabling analysis?

Accepted Answer

Capture a forensic image of the server's memory and disk before making any changes.. The first step in forensic investigation is to preserve evidence, following the order of volatility. Capturing memory and disk images ensures that all potential evidence is retained without alteration. This allows the team to analyze the incident thoroughly and determine the scope of data exposure, which is necessary for accurate notification and remediation.

Answer

Review web server access logs to identify the initial attack vector.

Answer

Immediately power off the web server to prevent further data exfiltration.

Answer

Notify the affected patients and regulatory authorities as required by HIPAA.

Question 10

Which THREE items are typically included in a formal Risk Register?

Accepted Answer

Mitigation status. A formal Risk Register documents each identified risk along with its Mitigation status (A), which tracks the progress of the chosen risk response (e.g., mitigate, transfer, accept, avoid) and is essential for ongoing risk monitoring and reporting. The Risk description (D) is a core field that captures the nature of the risk, including its cause, event, and potential impact, so that it can be assessed and prioritized. The Asset owner (E) is also a standard register field because it assigns accountability for the affected asset and the associated risk treatment to a specific person or role. By contrast, a Vendor contact list (B) is supplier/contact management data, and a Hardware serial number (C) is an asset-inventory detail; neither is a defining element of a Risk Register, even though both may appear in related asset or vendor records.

Answer

Vendor contact list

Answer

Hardware serial number

Question 11

Which THREE of the following are common steps in performing a security audit of a Linux system?

Accepted Answer

Verify user account permissions. Option A (Verify user account permissions) is correct because a security audit must check for excessive privileges, weak file/directory permissions, and misconfigured accounts (e.g., via commands like ls -l, find / -perm -4000, or reviewing /etc/passwd and /etc/shadow) to ensure least privilege and detect unauthorized access. Option C (Examine open network ports) is correct because auditors use tools such as ss, netstat, or nmap to identify listening services and exposed ports, then compare them against expected services to find unnecessary or malicious listeners. Option E (Review active processes) is correct because inspecting running processes with ps, top, or systemd-analyze helps detect suspicious, unauthorized, or resource-abusing programs and verify that only approved services are running. Option B (Delete all system logs) is not a valid audit step because logs are critical evidence for detecting and investigating security events; deleting them destroys audit trails and violates forensic integrity. Option D (Disable all disk encryption) is not a valid audit step because encryption protects data at rest, and disabling it would weaken security rather than assess it.

Answer

Delete all system logs

Answer

Disable all disk encryption

Question 12

A security administrator is configuring a Linux web server to run as a non-privileged user. The server needs to bind to TCP port 80. Which capability should be assigned to the web server binary to allow binding to a privileged port without running as root?

Accepted Answer

CAP_NET_BIND_SERVICE. In Linux, binding to TCP or UDP ports below 1024 traditionally requires root privileges. The CAP_NET_BIND_SERVICE capability allows a non-root process to bind to these privileged ports. By assigning this capability to the web server binary, the administrator can run the service as a non-privileged user while still allowing it to listen on port 80. This reduces the risk of a compromised web server gaining full root access. Other capabilities like CAP_NET_RAW or CAP_SYS_ADMIN are not required and would violate least privilege.

Answer

CAP_DAC_OVERRIDE

Answer

CAP_NET_RAW

Answer

CAP_SYS_ADMIN

Question 13

During an incident, an analyst finds that an adversary used a legitimate remote monitoring and management (RMM) tool already installed in the environment to execute commands, then deleted the tool's logs and renamed the executable to match a system process. Which adversarial tactic is most clearly being used to avoid detection and prolong the intrusion?

Accepted Answer

Defense Evasion. The adversary leveraged a trusted RMM tool, erased its logs, and renamed the binary to resemble a system process. Each of these actions is intended to avoid detection and blend into normal activity, which aligns with Defense Evasion. Execution and Discovery describe different objectives, and no evidence of privilege gain is present.

Answer

Privilege Escalation

Answer

Discovery

Answer

Execution

Question 14

An organization's risk register shows a customer database risk with an annualized loss expectancy of $240,000. A proposed data loss prevention and encryption program costs $90,000 per year and is expected to reduce annualized loss expectancy to $60,000. The CFO asks whether the investment is justified on a purely quantitative basis. What should the analyst report?

Accepted Answer

The program is justified because it reduces annualized loss expectancy by $180,000, which exceeds the $90,000 annual cost.. Quantitative justification compares the annual cost of a control against the annualized loss expectancy it removes. Here the program cuts expected loss from $240,000 to $60,000, a $180,000 reduction that comfortably exceeds the $90,000 cost, leaving a positive net benefit. Residual-loss comparisons and invented thresholds misapply the cost-benefit method.

Answer

The program cannot be evaluated quantitatively because encryption benefits are inherently qualitative.

Answer

The program is not justified because the $90,000 cost exceeds the $60,000 residual annualized loss expectancy.

Answer

The program is justified because any control that lowers annualized loss expectancy below $100,000 is automatically cost-effective.

Question 15

A security administrator is implementing a new access control system. The administrator wants to ensure that users are granted the minimum level of access necessary to perform their job functions. Which principle is being applied?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum access necessary to perform their job functions. This reduces the risk of unauthorized access and limits the potential impact of a compromised account. Separation of duties divides tasks, need to know restricts information access, and defense in depth layers controls, but none directly match the administrator's goal.

Answer

Defense in depth

Answer

Need to know

Answer

Separation of duties