CCOA Practice Test 25 — 15 Questions

Question 1

A security operations analyst at a healthcare organization is reviewing asset inventory records and discovers a database server that stores electronic protected health information (ePHI). The server is not tagged with any data classification label, and the analyst needs to ensure it complies with the organization's data classification policy before it is connected to the production network. Which action should the analyst take FIRST according to data classification and handling best practices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the highest classification label (e.g., 'Confidential') to the server and restrict access until a formal data owner review is completed.. The correct action is to apply the highest classification label and restrict access until a formal review. This aligns with data classification best practices: when in doubt, classify conservatively and protect the asset. It prevents data exposure while allowing the data owner to determine the appropriate label, ensuring compliance with healthcare regulations.

Answer

Assign a 'Public' classification label because the server is not yet in production and no data has been confirmed to be stored on it.

Answer

Immediately disconnect the server from the network to prevent any data leakage, then schedule a meeting with the data owner.

Answer

Leave the server unclassified but monitor it closely for any unusual activity until the next scheduled data classification review.

Question 2

A CCOA analyst receives an alert about a possible phishing email that bypassed the secure email gateway. The analyst needs to extract and analyze the email headers to determine the true sender. Which email header field should the analyst examine to find the originating IP address of the sender?

Accepted Answer

Received. The Received header fields are added sequentially by each mail server that handles the message. The earliest Received header, which appears at the bottom of the header list, contains the IP address of the server that first received the message from the sender. This is the best field to determine the true origin, though it can be spoofed if the sender connects directly to the first server.

Answer

Return-Path

Answer

Message-ID

Answer

Reply-To

Question 3

A CCOA analyst is helping the security team select controls for a new public-facing web application. The team wants to apply the principle of defense in depth, ensuring that no single control failure exposes the application. Which two controls best demonstrate layered, independent protection for this scenario? (Choose two.)

Accepted Answer

Input validation and parameterized queries implemented within the application code.. Defense in depth uses independent controls that fail separately. A WAF inspects traffic at the network edge, while secure coding such as input validation and parameterized queries defends within the application itself. Because they operate at different layers and rely on different mechanisms, a failure in one does not automatically expose the other.

Answer

Daily full backups of the web application and its database stored on the same host.

Answer

A firewall rule permitting only port 443 inbound to the web servers.

Answer

A second WAF from the same vendor deployed in front of the first WAF.

Question 4

A security operations analyst is reviewing a packet capture and notices a large volume of TCP SYN packets sent to many different destination ports on a single internal host, with no corresponding SYN-ACK responses. The analyst wants to determine the intent of this traffic. Which type of activity does this pattern most likely represent?

Accepted Answer

A port scan used to enumerate open services on the internal host. The pattern of many TCP SYN packets to different ports on one host with no SYN-ACK replies is the classic fingerprint of a TCP SYN port scan. The scanner is probing for listening services, and closed or filtered ports simply do not answer. Recognizing this in packet captures helps the analyst distinguish reconnaissance from a denial-of-service flood, which would concentrate on one service and typically elicit some responses.

Answer

A TCP SYN flood used as a denial-of-service attack against the internal host

Answer

A smurf attack reflecting ICMP echo requests through the internal host

Answer

A DNS amplification attack using the internal host as an open resolver

Question 5

A CCOA analyst is reviewing the organization's residual risk position after implementing a new endpoint detection and response (EDR) tool. The original inherent risk score was 16 (high), and the control effectiveness assessment reduces it to a residual score of 6 (medium). The risk owner asks whether the risk can now be closed in the register. What is the most appropriate response?

Accepted Answer

Keep the risk open and monitor it, because residual risk remains and control effectiveness can change over time.. Residual risk is the exposure remaining after controls are applied, and it must continue to be monitored rather than closed. A medium score reflects genuine remaining exposure, and control effectiveness can degrade through misconfiguration, coverage gaps, or evolving threats, so the entry stays open with an updated rating and owner.

Answer

Close the risk because the residual score is now below the high threshold and the control is deployed.

Answer

Delete the original inherent risk score and record only the residual score going forward.

Answer

Reclassify the risk as transferred because the EDR vendor now shares responsibility for detection.

Question 6

A CCOA analyst is documenting the controls used to protect data at rest on a database server. The organization requires that stored data remain unreadable even if the physical disk is stolen. Which technology directly satisfies this requirement?

Accepted Answer

Full-disk encryption using a trusted platform module key. The requirement is to keep stored data unreadable if the physical disk is stolen, which is precisely what full-disk encryption provides. Sealing the encryption key to a trusted platform module prevents decryption when the disk is moved to different hardware. Network encryption, selective column encryption, and access controls all operate at other layers and do not protect the raw files on a removed disk.

Answer

Database column-level encryption applied only to the password hash column

Answer

Role-based access control restricting which users can query the database

Answer

Transport Layer Security for all client connections to the database

Question 7

A CCOA analyst is reviewing the security posture of a web server that hosts a public-facing application. The analyst discovers that the server has unnecessary services running, including Telnet and FTP. Which of the following actions should the analyst recommend FIRST to reduce the attack surface?

Accepted Answer

Disable the unnecessary services. Disabling unnecessary services is the most direct and effective way to reduce the attack surface on a server. Telnet and FTP are insecure and should be removed or disabled if not required. Other measures like firewalls, patching, and segmentation are valuable but do not eliminate the risk posed by running unnecessary services.

Answer

Apply the latest security patches to the server

Answer

Implement network segmentation to isolate the web server

Answer

Install a host-based firewall to block Telnet and FTP

Question 8

An analyst is reviewing authentication logs and sees repeated successful logons for a service account from several geographically distant locations within a short time window. The service account is configured with a long random password and is used by a scheduled backup job. Which explanation is most consistent with this pattern?

Accepted Answer

The logon events are being generated by a misconfigured backup application or proxy that routes traffic through multiple egress points. The key detail is that the account is a service account with a strong random password used by a scheduled backup job. Simultaneous successful logons from distant locations are more plausibly produced by the backup application authenticating through multiple egress points or proxies than by stolen credentials. Analysts should verify the job's network path and source addresses before escalating to a compromise.

Answer

The authentication logs are being spoofed by an attacker to hide unauthorized access

Answer

The account is being used in a pass-the-hash attack against multiple domain controllers

Answer

The account credentials have been compromised and are being used from multiple locations

Question 9

A security operations analyst is implementing a hardening baseline for a fleet of Linux servers that host a web application. The organization wants to minimize the attack surface by disabling unnecessary services and configuring secure settings. The analyst has already disabled Telnet and FTP. Which additional action should the analyst take to align with the principle of least functionality?

Accepted Answer

Remove or disable any unnecessary packages and services, such as a print server or HTTP proxy, that are not required for the web application.. The principle of least functionality dictates that systems should only run services and applications required for their role. Removing unnecessary packages and services, such as a print server or HTTP proxy, eliminates potential vulnerabilities and reduces the attack surface. This is a fundamental step in system hardening.

Answer

Install an intrusion detection system (IDS) to monitor for attacks on the unnecessary services.

Answer

Disable the SSH service and use a console-based management tool instead.

Answer

Enable the firewall to block all inbound traffic except HTTP and HTTPS, and allow all outbound traffic.

Question 10

During an incident response engagement, an analyst finds that an attacker used a signed, legitimate remote monitoring and management (RMM) tool to maintain access on several endpoints. The tool's binary was already installed by the IT department for administrative purposes. Which ATT&CK technique BEST describes the attacker's action of using this existing, signed tool to avoid detection?

Accepted Answer

T1219 Remote Access Software. Using a legitimate, signed RMM tool that is already installed for administrative purposes allows the attacker to maintain access while blending in with normal IT operations. This behavior is classified as Remote Access Software, which covers adversary use of such tools for command and control, persistence, and lateral movement. Defenders must baseline legitimate RMM usage and monitor for anomalous connections.

Answer

T1055 Process Injection

Answer

T1078 Valid Accounts

Answer

T1218 System Binary Proxy Execution

Question 11

A CCOA analyst is reviewing the organization's asset inventory practices. The analyst needs to identify TWO practices that are essential for maintaining an accurate and up-to-date asset inventory. (Choose two.)

Accepted Answer

Automated discovery tools that scan the network periodically to identify new devices and update the inventory.. Automated discovery and regular reconciliation are essential for an accurate asset inventory. Automated tools continuously detect new and changed assets, while reconciliation with other data sources validates the inventory and identifies gaps. Together, they ensure the inventory remains current and reliable, which is critical for effective security operations.

Answer

Updating the inventory only during annual audits to minimize disruption to IT operations.

Answer

Manual data entry of asset details by IT staff when new hardware is deployed.

Answer

Storing the asset inventory in a shared spreadsheet that is accessible to all employees for transparency.

Question 12

A CCOA analyst is investigating a suspected data exfiltration incident. The analyst has captured network traffic and wants to reconstruct files that were transferred over HTTP. Which tool should the analyst use to extract files from the packet capture?

Accepted Answer

Wireshark. Wireshark's Export Objects feature allows the analyst to extract files from HTTP streams within a packet capture. This is a standard method for reconstructing exfiltrated data. tcpdump lacks this capability, nmap is for scanning, and NetFlow analyzers only provide flow metadata. Therefore, Wireshark is the correct tool for this task.

Answer

NetFlow analyzer

Answer

nmap

Answer

tcpdump

Question 13

A security analyst is investigating an incident where an attacker used a technique to evade detection by injecting malicious code into a legitimate process. The analyst observes that the attacker used `CreateRemoteThread` to execute code in a remote process. Which MITRE ATT&CK technique does this represent?

Accepted Answer

T1055 Process Injection. The use of CreateRemoteThread to execute code in a remote process is a direct example of Process Injection (T1055). This technique allows adversaries to run malicious code within the context of a legitimate process, evading detection and potentially gaining elevated privileges. While specific sub-techniques like Process Hollowing or Portable Executable Injection exist, the scenario does not provide enough detail to select a sub-technique, making the parent technique the correct answer.

Answer

T1134 Access Token Manipulation

Answer

T1055.002 Portable Executable Injection

Answer

T1055.012 Process Hollowing

Question 14

A security analyst is examining a compromised host and observes the following activities: (1) a new local administrator account was created, (2) the Windows Security event log was cleared, (3) a tool was run to dump credentials from memory, and (4) a firewall rule was added to allow inbound traffic on port 4444. Which TWO of these activities are classified under the Credential Access tactic? (Choose two.)

Accepted Answer

Dumping credentials from memory. Credential Access involves techniques for stealing credentials like account names and passwords. Dumping credentials from memory and extracting hashes from the SAM database are both direct methods of obtaining credentials. Creating an account, clearing logs, and modifying firewall rules serve different purposes: persistence, defense evasion, and defense evasion, respectively.

Answer

Adding a firewall rule to allow inbound traffic on port 4444

Answer

Creating a new local administrator account

Answer

Clearing the Windows Security event log

Question 15

A CCOA analyst is reviewing the organization's cybersecurity policy framework. The analyst needs to identify the document that provides high-level direction and states the organization's commitment to cybersecurity, but does not include detailed procedures or technical configurations. Which type of document should the analyst reference?

Accepted Answer

Policy. A policy is the highest-level governance document, stating management's commitment and direction. It avoids technical details, which are covered in standards, procedures, and baselines. The analyst should reference the cybersecurity policy to understand the organization's overarching security objectives and principles.

Answer

Standard

Answer

Procedure

Answer

Baseline