CCOA Practice Test 24 — 15 Questions

Question 1

A financial services firm is inventorying its assets for a new risk assessment. The analyst must classify each asset by data sensitivity and business criticality. Which of the following best represents a 'Confidential' data classification for an asset in this environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A spreadsheet containing customer account numbers and Social Security numbers. Data classification should reflect the harm of unauthorized disclosure. Customer account numbers and Social Security numbers are regulated PII whose exposure causes identity theft, fraud, and legal liability, so they belong in the Confidential category. Public brochures, internal directories, and pre-publication press releases cause little or no harm if disclosed and therefore do not represent Confidential assets in a financial services risk assessment.

Answer

A public marketing brochure hosted on the corporate website

Answer

A press release draft scheduled for publication next week

Answer

An internal employee telephone directory available to all staff

Question 2

An analyst needs to verify the hash of a downloaded binary to ensure it has not been tampered with. Which command is used on Windows PowerShell?

Accepted Answer

Get-FileHash. Get-FileHash is the native PowerShell cmdlet that computes a cryptographic hash (default SHA256) of a file, which can be compared against a published hash to verify integrity. It is available in PowerShell 4.0 and later and supports algorithms like SHA1, SHA256, SHA384, SHA512, and MD5.

Answer

Hash-File

Answer

Verify-Binary

Answer

Check-Sum

Question 3

A financial services firm has classified its customer transaction database as 'Restricted'. The CISO wants to ensure that even if the storage array is physically stolen, the data cannot be read. Which control should be implemented to directly satisfy this requirement?

Accepted Answer

Full-disk encryption using AES-256 with keys stored in a hardware security module (HSM). The scenario requires protection against physical theft of the storage medium, which is a data-at-rest threat. Only encryption of the volume with keys held separately in an HSM ensures the ciphertext cannot be decrypted by the thief. Transit encryption, logical access control, and monitoring all operate at different layers and do not protect data on a stolen disk.

Answer

TLS 1.3 for all database connections between the application and the database server

Answer

Role-based access control (RBAC) restricting database access to authorized DBAs only

Answer

Database activity monitoring (DAM) with real-time alerting on anomalous queries

Question 4

You notice a surge in outbound traffic from a workstation to a series of random external IP addresses. This suggests a potential botnet infection. What is the most appropriate forensic data to collect first?

Accepted Answer

NetFlow logs from the network perimeter device.. NetFlow logs from the perimeter device provide a high-level summary of network connections, including source/destination IPs, ports, and byte counts, which can quickly confirm the botnet infection and identify the command-and-control (C2) servers. This data is lightweight, often retained for weeks, and can be queried without disrupting the workstation. It directly addresses the surge in outbound traffic to random external IPs, making it the most appropriate first forensic data to collect.

Answer

Full packet capture (pcap) for the last 30 days.

Answer

The browser history of the user.

Answer

A full disk image of the workstation.

Question 5

A CCOA analyst is reviewing endpoint hardening for a Windows 10 workstation used by a developer. The developer needs to run locally compiled binaries for testing but should not be able to bypass security controls. The analyst wants to prevent unauthorized executables from running while allowing approved development tools. Which Windows feature should the analyst configure to enforce application control based on code signing and reputation?

Accepted Answer

Windows Defender Application Control (WDAC). Application control on Windows is enforced through WDAC, which uses policies to allow only trusted, signed code. It can be tailored to permit approved development tools while blocking untrusted binaries, satisfying both the developer's needs and the security requirement. UAC, Windows Firewall, and BitLocker address different security concerns and do not provide execution control.

Answer

BitLocker Drive Encryption

Answer

Windows Firewall with Advanced Security

Answer

User Account Control (UAC)

Question 6

A CCOA analyst is leading the lessons learned review after a major incident. The team wants to improve future detection and response. Which output of the lessons learned phase is most directly used to update detection capabilities?

Accepted Answer

Revised detection rules and indicators based on observed attacker techniques. The lessons learned phase should produce actionable improvements, and detection enhancements are a primary output. Translating observed attacker techniques into revised rules and indicators directly strengthens future detection. Personnel lists, asset inventories, and executive summaries serve other purposes and do not update detection logic.

Answer

A list of all personnel who participated in the incident response

Answer

An updated asset inventory with hardware serial numbers

Answer

A summary of the incident timeline for executive reporting

Question 7

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

Accepted Answer

PowerShell scripts. PowerShell scripts are classified under the Execution tactic in MITRE ATT&CK because they represent a technique (T1059.001) adversaries use to run malicious code on a target system. Execution covers techniques that result in adversary-controlled code running on a local or remote system.

Answer

Password spraying

Answer

Data encryption

Answer

Network mapping

Question 8

A CCOA analyst is preparing to acquire volatile data from a compromised Windows system before shutting it down. Which two types of data should be collected first because they will be lost upon shutdown? (Choose two.)

Accepted Answer

Running processes and open network connections. Volatile data such as running processes, network connections, and RAM contents are lost when a system is powered off. Collecting them first preserves critical evidence like active malware and encryption keys. Disk-based artifacts like registry hives, event logs, and Prefetch files persist and can be collected later. Therefore, the two correct choices are the volatile memory and active process/network data.

Answer

Event log files (.evtx)

Answer

Windows Registry hive files

Answer

Prefetch files

Question 9

A CCOA analyst is reviewing a suspected data exfiltration incident. The analyst needs to identify the command and control (C2) channel used by malware. Which network artifact would best reveal the domain names and IP addresses contacted by the malware?

Accepted Answer

DNS server logs. DNS server logs capture domain name resolution requests from hosts, directly showing which domains the malware attempted to resolve. This is essential for identifying C2 domains. NetFlow, firewall, and proxy logs may show IP addresses or HTTP requests but lack the comprehensive domain resolution data. Thus, DNS logs are the best artifact for this scenario.

Answer

Firewall logs

Answer

NetFlow records

Answer

Proxy server logs

Question 10

A CCOA analyst at a healthcare provider is reviewing the risk treatment plan for a legacy on-premises EHR system. The system cannot be patched, and the vendor no longer supports it. The organization decides to purchase cyber insurance to cover potential losses from a breach of this system. Which risk treatment option does this decision represent?

Accepted Answer

Risk transference. Risk transference shifts the financial burden of a risk to another party. Cyber insurance is a classic example: the organization still owns the risk operationally but pays a premium to transfer the potential financial loss. Avoidance would eliminate the system, mitigation would add controls, and acceptance would mean no action.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 11

A CCOA analyst is performing a quantitative risk assessment for a new customer-facing API. The asset value is $500,000, the exposure factor is 40%, and the annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?

Accepted Answer

$40,000. Annualized loss expectancy is calculated by multiplying the single loss expectancy by the annualized rate of occurrence. The single loss expectancy is the asset value times the exposure factor. Here, SLE is $200,000, and multiplying by the ARO of 0.2 gives an ALE of $40,000, representing the expected yearly loss from this risk.

Answer

$200,000

Answer

$100,000

Answer

$10,000

Question 12

A security analyst is configuring a web application firewall to protect an e-commerce site from injection attacks. The analyst wants to block requests that contain suspicious SQL syntax in input fields while minimizing false positives on legitimate product searches. Which approach best meets this goal?

Accepted Answer

Enable a signature-based rule set tuned to the application's normal parameter patterns and monitor alerts before blocking. Tuning a signature-based rule set to the application's normal parameter patterns and running it in monitor mode before blocking is the standard way to catch injection attempts without disrupting legitimate traffic. This approach lets the analyst observe detections, adjust thresholds, and then enforce blocking with confidence. Blanket character blocks, relying only on code fixes, or using response time all fail to balance detection with false-positive control.

Answer

Rely solely on parameterized queries in the application and disable the web application firewall rules

Answer

Block all requests containing single quotes or the word SELECT in any parameter

Answer

Set the web application firewall to block any request with a response time exceeding the baseline

Question 13

A CCOA analyst is assessing the risk of a third-party SaaS provider that will process sensitive customer data. The provider's SOC 2 Type II report shows no exceptions, but the provider will not allow on-site audits. Which action should the analyst take to best address the residual risk?

Accepted Answer

Require the provider to implement additional contractual security requirements and right-to-audit clauses.. When a vendor cannot be audited on-site, the analyst should use contractual mechanisms to mitigate risk. Right-to-audit clauses, security requirements, and breach notification terms provide legal and operational safeguards. Terminating the contract or scanning without authorization are extreme and inappropriate, while accepting the risk ignores the need for further assurance.

Answer

Terminate the contract immediately because the provider refuses on-site audits.

Answer

Perform a vulnerability scan against the provider's external infrastructure without notifying them.

Answer

Accept the risk because the SOC 2 Type II report has no exceptions.

Question 14

A CCOA analyst is reviewing the security posture of an organization's public cloud tenancy. The team wants to reduce the risk of credential-based attacks against the cloud management plane. Which two measures most directly strengthen identity protection for administrative access? (Choose two.)

Accepted Answer

Enforce phishing-resistant multi-factor authentication for all administrative accounts. Phishing-resistant multi-factor authentication and short-lived federated credentials both directly reduce the value of stolen administrative credentials. The first blocks replay of captured passwords, and the second limits how long any leaked credential remains usable. Billing alerts, storage access controls, and password rotation address other risks and do not strengthen identity protection for the management plane in the same direct way.

Answer

Rotate the cloud root account password every ninety days

Answer

Configure object storage buckets to block public access

Answer

Enable detailed billing alerts for all administrative subscriptions

Question 15

A CCOA analyst receives an alert about a suspicious email attachment that was opened by a user. The analyst wants to determine if the attachment executed and established persistence. Which Windows artifact would provide the most direct evidence of the executable's file path and creation time?

Accepted Answer

Amcache.hve. Amcache.hve stores metadata about executed binaries, including file paths and first run times. This directly addresses the analyst's need to confirm execution and obtain the file path. Other artifacts like SRUM, Application.evtx, or MFT may provide related information but lack the direct execution and path details. Thus, Amcache is the most suitable artifact.

Answer

SRUM database

Answer

MFT (Master File Table)

Answer

Windows Event Log Application.evtx