CCOA Practice Test 3 — 25 Questions

Question 1

A SOC analyst is investigating a suspected data exfiltration event on a Windows 10 endpoint. The analyst needs to enumerate all active network connections along with the owning process IDs to identify which process is communicating with an external IP. Which built-in Windows command should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

netstat -ano. The netstat command with -ano flags provides a comprehensive view of all active TCP connections and listening ports, including the numeric addresses and the owning process identifier. This allows the analyst to correlate a suspicious external connection with a specific process, which is essential for determining whether the traffic is legitimate or indicative of exfiltration.

Answer

route print

Answer

nslookup -type=ANY

Answer

ipconfig /all

Question 2

A security operations center is establishing a baseline for privileged account management across its server estate. The team must reduce the risk that compromised administrative credentials lead to widespread lateral movement. Which TWO controls should the team implement to directly limit the blast radius of a compromised privileged account? (Choose two.)

Accepted Answer

Enforce just-in-time elevation so administrative rights are granted only for the duration of an approved task. Blast radius is bounded by how much authority a stolen credential carries and for how long. Just-in-time elevation compresses the window in which administrative rights exist, and separating administrative accounts from daily-use identities prevents routine credential theft from yielding privilege. Password length, disk encryption, and antivirus all improve general security posture but none of them restrict what a valid privileged credential can reach once it is in an attacker's hands.

Answer

Increase the minimum password length for all accounts to 20 characters

Answer

Deploy a signature-based antivirus agent on every server

Answer

Enable full-disk encryption on all administrator workstations

Question 3

Which TWO of the following are considered 'Technical' controls?

Accepted Answer

Firewall configuration. Technical controls (logical controls) are implemented via software, hardware, or firmware.

Answer

Background checks

Answer

Security policy documentation

Answer

Guard patrol

Question 4

A healthcare organization's security operations team is mapping controls to the NIST Cybersecurity Framework. The CISO asks which function is primarily concerned with understanding the organization's assets, business environment, and risk appetite so that security activities can be prioritized. Which NIST CSF function should the analyst identify?

Accepted Answer

Identify. The Identify function establishes organizational understanding of assets, business environment, governance, and risk appetite, which is exactly what the CISO wants before prioritizing security activities. Protect, Detect, and Respond all depend on that foundational understanding and address safeguards, monitoring, or incident handling rather than asset and risk context.

Answer

Protect

Answer

Detect

Answer

Respond

Question 5

A security operations center (SOC) analyst is triaging a potential endpoint compromise. The EDR console shows a suspicious process created by a Microsoft Word document that spawned a child process of 'powershell.exe' with the arguments '-nop -w hidden -enc JABjAGwAaQBlAG4AdA...'. The parent process has since exited. Which detection technique would best confirm whether this activity represents a true positive?

Accepted Answer

Decoding the Base64 PowerShell argument and examining the resulting script for known malicious behaviors such as downloading a payload or establishing a reverse shell.. The encoded PowerShell command is the core artifact. Decoding it reveals the actual script, and if that script performs clearly malicious actions such as downloading a payload or creating a reverse shell, the activity is confirmed as a true positive. Other options provide supporting evidence but do not definitively prove malicious intent in this scenario.

Answer

Reviewing the Windows Security event log for Event ID 4688 to identify the full command line of the PowerShell process and its parent process ID.

Answer

Inspecting the Windows Registry for persistence mechanisms added by the PowerShell process, such as a Run key entry.

Answer

Checking the Microsoft Word document's file hash against VirusTotal to see if any antivirus engines flag it as malicious.

Question 6

During incident response for a suspected data exfiltration, the team captures full packet data at the perimeter. The CCOA analyst needs to determine whether large outbound transfers occurred over an encrypted channel that cannot be inspected. Which network flow artifact should the analyst use to identify the volume and duration of the transfers while preserving the ability to correlate with other logs?

Accepted Answer

NetFlow records exported from the perimeter router. Flow records provide the metadata needed to quantify outbound transfer volume and duration without decrypting payloads. They are lightweight, widely retained, and easily correlated with other telemetry, making them the right artifact for this encrypted-traffic scenario. Full packet capture is less efficient for volume analysis, while DNS and proxy logs address different aspects.

Answer

DNS query logs from the internal resolver

Answer

Full packet capture analyzed with a protocol analyzer

Answer

Proxy access logs with HTTP status codes

Question 7

A security operations center (SOC) analyst is triaging an alert indicating a potential phishing email that was delivered to several users. The analyst needs to determine if any user interacted with the malicious link. Which two data sources would be most directly useful for this determination? (Choose two.)

Accepted Answer

Endpoint detection and response (EDR) telemetry. Web proxy logs and EDR telemetry both provide direct evidence of user interaction with a link. Proxy logs show the outbound request to the malicious URL, while EDR captures the browser process and network connection on the endpoint. Together, they can confirm if a user clicked the link. Other sources lack the necessary user or process context to make that determination.

Answer

Firewall logs

Answer

Domain Name System (DNS) logs

Answer

Email gateway logs

Question 8

During a risk assessment, an analyst determines that a legacy payroll application has a vulnerability that could allow remote code execution. The vendor no longer issues patches, and the application is required for monthly payroll runs. The CISO accepts the residual risk and documents the decision. Which risk treatment option has the organization chosen?

Accepted Answer

Risk acceptance. When an organization acknowledges a risk and formally decides to retain it after weighing treatment options, the chosen response is risk acceptance. Avoidance would require eliminating the payroll application, transfer would shift impact to a third party, and mitigation would add controls. The documented CISO decision confirms acceptance of residual risk.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 9

A hospital's risk register lists ransomware against its electronic health record system with a likelihood of 'High' and an impact of 'Critical' on a five-point qualitative scale. The CISO must select a treatment option that reduces the residual risk to an acceptable level while preserving clinical availability. Which treatment approach BEST fits this scenario?

Accepted Answer

Mitigate the risk with layered controls such as immutable offline backups, network segmentation, and tested recovery procedures.. Because ransomware against clinical systems threatens both data and availability, the appropriate treatment is mitigation through layered preventive and recovery controls. Immutable offline backups remove the attacker's leverage, segmentation constrains spread, and tested recovery preserves patient care. Acceptance, pure transfer, and avoidance all fail to reduce the operational impact the hospital cannot tolerate.

Answer

Avoid the risk by disconnecting the electronic health record system from all external networks permanently.

Answer

Accept the risk because the electronic health record vendor contractually guarantees system uptime.

Answer

Transfer the risk entirely by purchasing a cyber insurance policy covering ransomware incidents.

Question 10

A security analyst is conducting a qualitative risk assessment for a new cloud-based customer relationship management (CRM) system. The team wants to prioritize risks without assigning monetary values. Which TWO factors are most relevant when using a qualitative risk matrix? (Choose two.)

Accepted Answer

Impact or severity to business operations if the risk materializes. Qualitative risk matrices rank risks by combining likelihood and impact using descriptive scales. These two factors allow prioritization without monetary calculations. ALE, NPV, and ROSI are quantitative or financial metrics that require monetary inputs, so they fall outside the scope of a qualitative assessment focused on relative ranking.

Answer

Net present value (NPV) of the CRM investment

Answer

Return on security investment (ROSI) percentage

Answer

Annualized loss expectancy (ALE) in monetary terms

Question 11

A CCOA analyst is evaluating a third-party SaaS vendor that will process regulated financial data. The vendor's SOC 2 Type II report covers security and availability but excludes confidentiality. The contract includes a right-to-audit clause and a 24-hour breach notification requirement. Which remaining action is MOST important to close the assurance gap?

Accepted Answer

Obtain a SOC 2 Type II report covering the confidentiality trust services criterion. The vendor already provides Type II attestation for security and availability, so the missing element is period-based, independently tested assurance over confidentiality. A SOC 2 Type II report scoped to the confidentiality criterion supplies that evidence and aligns with due diligence expectations for regulated financial data. Contract clauses and management-system certificates do not demonstrate tested operating effectiveness.

Answer

Accept the vendor's ISO/IEC 27001 certificate as equivalent coverage

Answer

Rely on the contractual right-to-audit clause as sufficient assurance

Answer

Request the vendor complete a SOC 2 Type I report for the confidentiality criterion

Question 12

A CCOA analyst is establishing a risk appetite statement for a hospital network that must balance patient safety, regulatory obligations under HIPAA, and operational availability of clinical systems. Which TWO characteristics must the risk appetite statement exhibit to be considered effective by ISACA risk governance principles? (Choose two.)

Accepted Answer

It is expressed in qualitative and quantitative terms tied to measurable thresholds. Effective risk appetite statements are measurable and executive-owned. Measurable thresholds let decision-makers judge whether a specific exposure sits inside or outside tolerance, while executive and board ownership ensures appetite reflects strategy and regulatory duty. For a hospital, that combination properly weights patient safety and HIPAA obligations against availability and cost trade-offs.

Answer

It is kept confidential and shared only with the security operations team

Answer

It eliminates all residual risk across clinical and administrative systems

Answer

It is revised annually regardless of changes in business strategy

Question 13

A CCOA analyst is investigating suspicious activity on a Linux web server running Apache. The analyst runs 'ss -tulpn' and sees that the server is listening on port 8443, but the organization's asset inventory lists this server as only providing HTTP on port 80 and HTTPS on port 443. The analyst needs to determine which process is bound to port 8443 and whether it is authorized. Which command should the analyst use next to identify the process name and PID associated with port 8443?

Accepted Answer

lsof -i :8443. Mapping an unexpected listening port to its owning process is a core incident response step. The 'lsof -i :8443' command lists open Internet sockets on that port and includes the process name, PID, and user. This gives the analyst the exact information needed to determine whether the process is authorized and to take further action such as terminating or investigating it.

Answer

nmap -sV -p 8443 localhost

Answer

tcpdump -i any port 8443

Answer

netstat -anp | grep 8443

Question 14

A manufacturing company is building a hardened baseline for its industrial control system (ICS) engineering workstations, which run Windows and connect to programmable logic controllers on the plant floor. The security team must reduce the attack surface without disrupting production. Which two controls are most appropriate to include in the baseline for these workstations? (Choose two.)

Accepted Answer

Disabling USB mass storage and restricting removable media to approved, scanned devices. ICS engineering workstations require compensating controls because patching is constrained by vendor certification and production uptime. Application allowlisting restricts execution to approved engineering and HMI software, and disabling USB mass storage with controlled, scanned media blocks a common infection path. Automatic untested updates, consumer antivirus, and unrestricted utility installation all introduce availability or integrity risk and do not belong in the baseline.

Answer

Enabling automatic operating system updates that install immediately without testing

Answer

Installing consumer antivirus software with aggressive heuristic scanning on all engineering hosts

Answer

Allowing engineers to install any utility from the internet to troubleshoot PLC connectivity

Question 15

A security operations team is designing the asset inventory for a hybrid environment that includes on-premises servers, cloud workloads, and employee-owned mobile devices. The team wants to ensure the inventory supports both vulnerability management and incident response. Which data element is MOST important to include for every asset so that responders can quickly determine ownership and escalation paths during an incident?

Accepted Answer

The assigned business owner and technical custodian with contact details. An asset inventory serves both vulnerability management and incident response only when each record answers who owns the asset and whom to contact. Business owner and technical custodian fields with current contact information create the escalation chain that responders rely on to authorize containment and interpret business impact. Technical attributes such as patch level, location, or identifiers support analysis but do not establish accountability, which is the deciding factor in this scenario.

Answer

The asset's physical rack location and data center row

Answer

The asset's operating system build number and patch level

Answer

The asset's primary MAC address and hostname

Question 16

A security analyst is reviewing the configuration of a Windows file server that stores personnel records. The analyst wants to verify that only members of the HR group can read the payroll folder and that all other authenticated users are explicitly denied access. Which type of access control model is being applied when permissions are assigned directly to named users and groups on each file and folder?

Accepted Answer

Discretionary access control (DAC). When permissions are written directly onto each file and folder and granted to named users or groups, the object owner or administrator is exercising discretion over access, which defines discretionary access control. NTFS access control lists on a Windows file server are a standard implementation. Mandatory, role-based, and attribute-based models each centralize or abstract the decision differently and do not match the direct per-object assignment described.

Answer

Mandatory access control (MAC)

Answer

Role-based access control (RBAC)

Answer

Attribute-based access control (ABAC)

Question 17

An analyst at a financial firm is reviewing network flow logs and notices a workstation repeatedly initiating SMB connections to multiple internal servers on TCP port 445, followed by large outbound data transfers to an external IP. The workstation's user reports no unusual activity. The analyst suspects lateral movement and data exfiltration. Which technology should the analyst use to correlate these network events with endpoint process and file activity to confirm the attack chain?

Accepted Answer

Security information and event management (SIEM) with endpoint detection and response (EDR) integration. Correlating network flows with endpoint telemetry requires a platform that ingests both network and host data. SIEM provides centralized correlation, and EDR supplies granular process and file activity. Together, they enable the analyst to reconstruct the sequence from initial SMB connections to data staging and outbound transfer, confirming lateral movement and exfiltration.

Answer

Network access control (NAC) with 802.1X authentication

Answer

Intrusion prevention system (IPS) with signature-based detection

Answer

Full packet capture (PCAP) with deep packet inspection (DPI)

Question 18

You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?

Accepted Answer

FTK Imager. FTK Imager is a widely accepted forensic tool that creates bit-stream (physical) images of storage media and generates MD5/SHA-1 hash values to verify that the image is an exact, unaltered copy of the original. It supports write-blocking awareness, E01 and raw formats, and hash verification, satisfying the integrity requirement for evidentiary purposes. This makes it the standard choice for imaging a SATA drive in a forensically sound manner.

Answer

Robocopy

Answer

Diskpart

Answer

Windows File Explorer

Question 19

During a control review, an analyst finds that a privileged service account used by a backup platform has a password that has not rotated in three years and is stored in a plaintext configuration file on a management server. The backup platform cannot support modern authentication methods. Which compensating control BEST addresses the credential risk without breaking the backup jobs?

Accepted Answer

Move the plaintext credential into a secrets vault and have the backup platform retrieve it at runtime through a privileged access management broker.. The problem is a static plaintext privileged secret that never rotates. Brokering retrieval through a vault and PAM layer removes the on-disk secret, enforces controlled access, and creates an audit trail while still letting the backup platform authenticate. Strengthening the password, rotating manually, or widening privileges all leave the fundamental exposure intact or make it worse.

Answer

Schedule a quarterly password rotation for the service account and update the configuration file manually each time.

Answer

Increase the service account password length to 25 characters and store the file with NTFS permissions restricted to administrators.

Answer

Grant the service account domain administrator rights so that any credential misuse can be traced more easily in the logs.

Question 20

A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?

Accepted Answer

Isolate the host from the network. Isolating the affected host from the network prevents the ransomware from spreading to other shares or command-and-control servers while preserving local evidence.

Answer

Reboot the server

Answer

Delete the suspicious files

Answer

Change all user passwords