CCOA Practice Test 23 — 15 Questions

Question 1

A security analyst is performing a qualitative risk assessment for a new cloud-based customer portal. The CISO wants risk ratings that reflect both the likelihood of a threat event and the severity of its impact, using a consistent descriptive scale. Which TWO techniques should the analyst use to produce these ratings? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Combine the likelihood and impact ratings in a risk matrix to derive an overall risk level. Qualitative risk assessment relies on descriptive scales for likelihood and impact, then combines them in a risk matrix to yield an overall rating. The ordinal scale ensures consistency, and the matrix ensures both dimensions are reflected. Quantitative methods such as Annualized Loss Expectancy and Monte Carlo simulation produce monetary or statistical outputs, and incident counts alone omit impact severity.

Answer

Derive risk ratings solely from the number of historical incidents recorded for each asset

Answer

Calculate the Annualized Loss Expectancy by multiplying single loss expectancy by annualized rate of occurrence

Answer

Run a Monte Carlo simulation to model the distribution of potential annual losses

Question 2

Which TWO of the following are true regarding the use of hashing in digital forensics?

Accepted Answer

Hashes ensure data integrity. Option B is correct because cryptographic hash functions such as SHA-256 or MD5 produce a fixed-length digest that changes if even a single bit of the evidence changes, so comparing pre- and post-acquisition hashes verifies that the data has not been altered, which is the core of forensic data integrity. Option C is correct because a hash value acts as a unique fingerprint of file content, allowing investigators to match hashes against reference sets like the NSRL RDS to quickly identify known files (e.g., known-good system files or known-bad malware) without examining each file manually. Option A is incorrect because hashing is a one-way function and cannot be reversed to recover plaintext; decryption requires the appropriate key and cipher. Option D is incorrect because hashing is not encryption: encryption is reversible with a key, whereas hashing is irreversible and used for integrity and identification, not confidentiality. Option E is incorrect because hash functions do not compress data; they map arbitrary-length input to a fixed-length digest and the original data cannot be reconstructed from the hash.

Answer

Hashes allow for data decryption

Answer

Hashes are the same as encryption

Answer

Hashes compress the data

Question 3

A multinational retailer must comply with a regulation requiring that personal data of European customers not be transferred to countries lacking an adequate level of data protection. The security team is asked to identify the primary principle that governs this restriction. Which principle applies?

Accepted Answer

Data sovereignty and cross-border transfer restrictions. The regulation restricts transferring personal data to jurisdictions without adequate protection, which is the principle of data sovereignty combined with cross-border transfer rules. Data minimization, purpose limitation, and storage limitation are separate privacy principles addressing collection scope, use purpose, and retention duration rather than geographic transfer.

Answer

Data minimization

Answer

Storage limitation

Answer

Purpose limitation

Question 4

During threat hunting, an analyst sees a workstation authenticate to multiple servers using a single NTLM authentication event that is relayed to a different host within seconds. The workstation account is not the user's account, and the target servers log successful logons with the workstation's machine account. Which adversarial tactic is best supported by this evidence?

Accepted Answer

Lateral Movement. Relayed NTLM authentication that lets a machine account access several servers is a hallmark of an adversary extending control across the network. Because the activity moves access from one internal host to others, it fits Lateral Movement rather than initial entry, pre-attack staging, or destructive impact.

Answer

Impact

Answer

Initial Access

Answer

Resource Development

Question 5

During an internal audit, a CCOA analyst finds that the organization's data classification policy labels customer PII as 'Confidential' and requires AES-256 encryption at rest, but the backup team stores nightly database dumps on unencrypted LTO-9 tapes in a third-party vault. Which risk response strategy is the organization currently exhibiting with respect to the tape backups?

Accepted Answer

Risk acceptance. Because the classification policy mandates AES-256 encryption at rest for Confidential data, but the backup team continues writing unencrypted tapes, the organization is retaining a known risk without reducing, shifting, or eliminating it. That behavior maps to risk acceptance regardless of whether a formal acceptance memo exists. Auditors would flag this as undocumented acceptance requiring executive sign-off.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 6

A security operations center (SOC) is implementing a new SIEM and needs to ensure that log data from various sources is normalized for effective correlation. Which TWO of the following are key considerations when normalizing log data? (Choose two.)

Accepted Answer

Ensuring that timestamps are converted to a consistent time zone and format.. Normalization involves transforming log data into a consistent format for analysis. Two critical aspects are adopting a common schema to map fields uniformly and standardizing timestamps to a single time zone and format. These steps enable the SIEM to correlate events across disparate sources by ensuring that similar data elements are comparable and that events can be sequenced accurately.

Answer

Encrypting all log data at rest to protect sensitive information.

Answer

Retaining raw logs in their original format for compliance purposes.

Answer

Parsing logs using regular expressions to extract relevant fields.

Question 7

You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?

Accepted Answer

Use the '_GetWatchlist' KQL function. In Microsoft Sentinel, you use the 'in' operator combined with the _GetWatchlist function in your KQL query to compare incoming logs against the watchlist content.

Answer

Assign IPs to a 'Threat Intelligence' tag

Answer

Hardcode the IPs in the query

Answer

Automatically block them via Network Security Group

Question 8

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

Accepted Answer

It evades detection by appearing as normal activity. Living-off-the-land (LotL) binaries are legitimate, signed system executables (e.g., PowerShell, WMI, certutil, rundll32) already present on the host, so their execution blends into normal administrative activity and bypasses application allowlisting and signature-based detection. Custom malware introduces new files, hashes, and behaviors that EDR and antivirus can flag, whereas LotL activity uses trusted processes that defenders are reluctant to block outright. This makes LotL the preferred technique for stealth and persistence in mature environments.

Answer

It is faster to execute

Answer

It is easier to compile

Answer

It requires less memory

Question 9

A healthcare organization stores electronic protected health information (ePHI) on a database server. An analyst recommends implementing AES-256 encryption at rest with keys managed by a hardware security module (HSM). Which security objective does this control primarily address?

Accepted Answer

Confidentiality. Encryption at rest with AES-256 and HSM-managed keys prevents unauthorized parties from reading stored ePHI, directly satisfying the confidentiality objective. Integrity addresses unauthorized modification, availability addresses timely access, and non-repudiation addresses proof of origin. Only confidentiality aligns with the scenario's goal of protecting stored data from disclosure.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 10

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

Accepted Answer

Firewall logs. SIEMs ingest data from various layers including identity providers, network infrastructure, and endpoint monitoring tools to provide comprehensive visibility.

Answer

Employee payroll spreadsheets

Answer

Kitchen appliance status reports

Question 11

Which THREE of the following are considered 'Collection' techniques?

Accepted Answer

Screen capture. In the MITRE ATT&CK framework, Collection (TA0009) covers techniques adversaries use to gather data of interest before exfiltration. Screen capture (A) is a Collection technique (T1113) because it captures an image of the display to obtain on-screen information. Audio capture (C) is a Collection technique (T1123) because it records microphone input to harvest audio data. Data from local system (D) is a Collection technique (T1005) because it searches local sources such as the file system, configuration files, and databases for information. File and directory discovery (B) belongs to Discovery (T1083), and network scanning (E) is also a Discovery technique (T1046), so neither is a Collection technique.

Answer

File and directory discovery

Answer

Network scanning

Question 12

Which TWO elements should be included when performing threat modeling using the STRIDE methodology?

Accepted Answer

Identify data flows. STRIDE threat modeling requires decomposing the system to understand where threats can occur, and identifying data flows (B) is a core step because it maps how information moves between components, processes, and external entities so each flow can be analyzed against STRIDE categories. Identifying trust boundaries (E) is equally essential because threats such as spoofing, tampering, and elevation of privilege typically arise where data crosses between zones of differing trust, so these boundaries must be explicitly documented. Vulnerability scanning (A) and penetration testing (C) are reactive/validation activities performed after or alongside threat modeling, not elements of the STRIDE modeling process itself. Budget approval (D) is a project management concern and has no role in the technical STRIDE methodology.

Answer

Perform vulnerability scan

Answer

Conduct penetration test

Answer

Budget approval

Question 13

An analyst is reviewing host telemetry to identify behaviours that map to the Defense Evasion tactic. Which two of the following observed actions should be mapped to Defense Evasion? (Choose two.)

Accepted Answer

An attacker timestomps a dropped executable by setting its creation time to match a legitimate system file in the same directory.. Defense Evasion covers actions that impair defenses or hide adversary activity. Disabling Windows Defender real-time protection directly removes a security control, and timestomping alters file metadata to avoid scrutiny, so both qualify. Enumerating domain trusts is Discovery, reading the SAM hive is Credential Access, and creating a reboot-surviving scheduled task is Persistence, which is why those three do not map to Defense Evasion.

Answer

A process uses the Windows API to read the contents of the SAM registry hive for offline password hash extraction.

Answer

An adversary runs 'net user /domain' and 'nltest /domain_trusts' to enumerate domain accounts and trust relationships.

Answer

An adversary establishes a scheduled task that launches a beacon every 30 minutes to maintain access across reboots.

Question 14

You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?

Accepted Answer

Sigcheck. 'sigcheck' from the Sysinternals suite is the standard command-line utility for verifying the digital signature of a file.

Answer

Task Manager

Answer

Process Explorer

Answer

Event Viewer

Question 15

A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?

Accepted Answer

Least Privilege. Least Privilege dictates that users receive only the minimum permissions necessary to perform their job functions. An Administrator account performing daily data entry has far more access than the task requires, violating this principle. The excess privileges expand the attack surface and potential blast radius if the account is compromised.

Answer

Accountability

Answer

Separation of Duties

Answer

Need to know