CCOA Practice Test 4 — 25 Questions

Question 1

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 2

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

Accepted Answer

Non-repudiation. Non-repudiation refers to the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity.

Answer

Data integrity

Answer

Availability

Answer

Confidentiality

Question 3

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

Accepted Answer

Resetting compromised user credentials. Eradication involves removing the root cause, such as cleaning malware or removing unauthorized user accounts.

Answer

Updating documentation for the incident report

Answer

Restoring data from a known good backup

Answer

Identifying the initial attack vector

Question 4

A security operations analyst is building a data classification and handling standard for a new document management platform that stores contracts, HR records, and public marketing collateral. The analyst must define controls that apply to the highest sensitivity tier. Which TWO actions are appropriate for assets classified at the highest sensitivity level? (Choose two.)

Accepted Answer

Enforce least privilege with role-based access and log all access to the sensitive repositories for monitoring.. The highest sensitivity tier demands controls that both protect and monitor the data. Encrypting at rest and in transit with governed keys protects confidentiality, while least-privilege role-based access plus comprehensive logging limits and detects misuse. Reusing public access rules, allowing unmanaged local copies, or relying on documentation alone all fail to contain the risk that top-tier classification implies.

Answer

Apply the same access control policy used for public marketing collateral to simplify administration.

Answer

Allow users to store local copies on unmanaged endpoints to improve productivity during contract negotiations.

Answer

Publish the classification labels in a public wiki so all staff understand how data is tagged.

Question 5

An analyst reviewing endpoint telemetry sees rundll32.exe executing a DLL from a user's Downloads folder with an export named 'Start'. The DLL was downloaded from an external site minutes earlier. Which MITRE ATT&CK tactic is most directly represented by this activity?

Accepted Answer

Execution. Using rundll32.exe to call an exported function from a downloaded DLL is a straightforward execution technique. The adversary has already delivered the file and is now causing it to run. The tactic that most directly describes this step is execution, regardless of any secondary evasion benefit from abusing a signed binary.

Answer

Defense Evasion

Answer

Command and Control

Answer

Persistence

Question 6

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Accepted Answer

Revoke all active sessions/tokens. Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).

Answer

Upgrade the user's OS

Answer

Block the user's physical building access

Answer

Delete the user's home directory

Question 7

What is a 'False Positive' in the context of SIEM alerting?

Accepted Answer

A legitimate action flagged as malicious. A false positive in SIEM alerting is a detection that fires on activity which is actually legitimate, such as an admin running a script that matches a suspicious command pattern. The alert is 'positive' (the SIEM flagged something) but 'false' because no real malicious event occurred. This is distinct from a false negative, which is a real attack that the SIEM failed to detect.

Answer

A system error causing a crash

Answer

A successful attack that was blocked

Answer

An incident that went undetected

Question 8

A security operations analyst is reviewing how a critical database server is protected. The server stores customer payment data and runs on a hardened host, but the analyst notices that the database service account can read its own data files directly from the file system, and that backup images of the volume are stored unencrypted on a shared network share. Which change MOST directly reduces the risk of bulk data exposure from a stolen backup image?

Accepted Answer

Encrypt the backup images before they leave the host and restrict the shared network share to the backup service identity.. The specific risk is that a copy of the database ends up readable outside the hardened host. Encrypting the backup image with keys kept separate from the image, plus restricting the share to the backup identity, ensures a stolen copy yields no usable data and limits who can take it. Controls aimed at the live host or network path leave the backup artifact itself exposed.

Answer

Remove the database service account's ability to read its own data files so it must query through the database engine.

Answer

Move the database to a more isolated network segment and add intrusion detection to the segment.

Answer

Enable transparent data encryption on the database so the data files are encrypted at rest on the server.

Question 9

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered two days ago. The analyst needs to perform dynamic analysis of the URL to determine if it leads to a malicious payload. Which two actions should the analyst take to safely analyze the URL and gather threat intelligence? (Choose two.)

Accepted Answer

Query threat intelligence platforms for the domain's reputation and associated indicators of compromise.. Submitting the URL to a sandbox allows safe dynamic analysis, recording network traffic and file downloads to identify malicious behavior. Querying threat intelligence platforms provides reputation and associated indicators without direct interaction. Together, these actions safely determine if the URL is malicious and gather actionable intelligence.

Answer

Use a web browser on the analyst's workstation to visit the URL and inspect the page content.

Answer

Perform a WHOIS lookup to obtain the registrar and registrant details of the domain.

Answer

Run a command-line tool like curl to download the URL's content to the analyst's workstation for inspection.

Question 10

A security operations center (SOC) analyst notices that an attacker has been using the 'at' command to schedule a job that runs a reverse shell every day at 9 AM on a compromised Linux server. Which MITRE ATT&CK tactic does this activity represent?

Accepted Answer

Persistence. The correct answer is Persistence because scheduling a recurring job with 'at' ensures the reverse shell runs regularly, maintaining the attacker's access. The other tactics—Execution, Command and Control, and Privilege Escalation—describe different aspects of the attack that are not the primary purpose of this scheduling action.

Answer

Privilege Escalation

Answer

Execution

Answer

Command and Control

Question 11

An analyst observes an endpoint resolving hundreds of unique subdomains under a single parent domain, each subdomain encoded as a long hexadecimal string, and the responses frequently return NXDOMAIN. The endpoint process generating these queries is a signed Office add-in. Which adversarial tactic is the endpoint most likely exhibiting?

Accepted Answer

Command and Control. Encoded subdomain labels under a single parent domain, repeated queries, and NXDOMAIN-heavy responses are the classic fingerprint of DNS-based command and control. Adversaries use this channel because DNS is widely permitted through perimeter controls and blends with normal name resolution. The signed Office add-in generating the queries indicates a trusted process has been co-opted to reach the C2 server, which places the behaviour firmly in the Command and Control tactic.

Answer

Exfiltration Over Alternative Protocol

Answer

Reconnaissance

Answer

Resource Development

Question 12

An analyst detects that an adversary used the PsExec utility to copy a service binary to a remote host and create a temporary Windows service that executed the binary as SYSTEM. The analyst must classify this behaviour. Which MITRE ATT&CK technique does this activity represent?

Accepted Answer

T1569.002 System Services: Service Execution. PsExec achieves remote execution by copying a binary to the target and installing a temporary Windows service that runs the binary as SYSTEM. That service-based execution matches the System Services: Service Execution sub-technique. The temporary nature of the service distinguishes it from persistence-oriented service creation, and the absence of Task Scheduler activity rules out scheduled task abuse, so the correct classification is service execution.

Answer

T1021.002 SMB/Windows Admin Shares

Answer

T1543.003 Create or Modify System Process: Windows Service

Answer

T1053.005 Scheduled Task/Job: Scheduled Task

Question 13

A financial services firm stores customer account data in a database. The security team is asked to ensure that even if the storage media is stolen, the data cannot be read without additional secret material. Which control best satisfies this requirement?

Accepted Answer

Full-disk encryption using AES-256 with keys managed by a hardware security module. The scenario requires that stolen storage media remain unreadable without additional secret material, which is the definition of encryption at rest. Full-disk encryption with AES-256 and HSM-protected keys provides that protection. Transit encryption, access control, and monitoring address different threat vectors and cannot prevent offline reading of stolen disks.

Answer

Role-based access control restricting database queries to authorized analysts

Answer

Database activity monitoring generating alerts on anomalous queries

Answer

TLS 1.3 for all client connections to the database

Question 14

A CCOA analyst is building a threat model for a new API gateway that exposes internal microservices to partner organizations. The analyst wants to prioritize threats using a methodology that combines adversary capability, intent, and opportunity against the organization's specific attack surface. Which approach best fits this requirement?

Accepted Answer

PASTA (Process for Attack Simulation and Threat Analysis) seven-stage methodology. PASTA was designed precisely to blend business impact with attacker behavior. Its stages move from business objectives through technical scope, application decomposition, threat analysis, vulnerability analysis, attack modeling, and risk impact analysis. Because it explicitly weighs adversary capability, intent, and opportunity against the exposed attack surface of the API gateway, it delivers prioritized, business-aligned threats rather than a flat enumeration.

Answer

MITRE ATT&CK Navigator mapping of relevant techniques to the gateway

Answer

STRIDE per element applied to each microservice data flow diagram

Answer

OCTAVE Allegro with information asset profiling workshops

Question 15

During an investigation, a CCOA analyst observes that a Linux web server's /var/log/auth.log shows repeated successful sudo commands by the www-data account, which should never have interactive privileges. The analyst must preserve volatile evidence before remediation. Which action best follows accepted order of volatility while enabling later forensic reconstruction?

Accepted Answer

Capture volatile data with a script that records running processes, network sockets, and loaded kernel modules, then acquire the auth.log and relevant file metadata.. Order of volatility requires collecting the most transient artifacts first, which in this scenario means live process, network, and kernel state, before acquiring persistent files such as auth.log. Halting services, rebooting, or modifying accounts destroys volatile evidence and can alter timestamps. Capturing volatile data and then acquiring logs and metadata preserves both live and persistent evidence for reconstruction.

Answer

Change the www-data password and remove it from the sudoers group to contain the incident, then review auth.log for further unauthorized commands.

Answer

Reboot the server into a trusted rescue environment to ensure no attacker processes interfere, then image the disk and parse auth.log from the image.

Answer

Immediately run systemctl stop apache2 to halt the compromised service, then copy /var/log/auth.log to external media.

Question 16

A CCOA analyst is evaluating a zero trust architecture for a hybrid environment. The organization wants to ensure that every access request is authenticated and authorized based on multiple signals before a session is established. Which core zero trust principle does this requirement embody?

Accepted Answer

Never trust, always verify, by making access decisions per request using identity, device health, and contextual signals.. The requirement that every access request be authenticated and authorized using multiple signals before session establishment is the definition of never trust, always verify. Assume breach focuses on containment, flat networks and perimeter-only controls rely on implicit trust. Only continuous, context-based verification per request satisfies the zero trust principle described.

Answer

Rely on a single strong perimeter firewall and VPN concentrator to control all north-south traffic entering the environment.

Answer

Assume breach and minimize blast radius by segmenting workloads and encrypting all internal traffic.

Answer

Implement a flat network with implicit trust for internal hosts to simplify policy management and reduce latency.

Question 17

During an incident investigation, an analyst discovers that an attacker used a compromised service account to move laterally across multiple systems. The analyst needs to determine the extent of the compromise by identifying all systems where the account was used to authenticate. Which data source would be most effective for this purpose?

Accepted Answer

Windows Security event logs on each domain controller. Domain controller security logs capture authentication events, including the account name, logon type, and source workstation. These logs are essential for tracing lateral movement because they record where and how an account was used. Other sources lack user context or do not cover authentication events across the domain, making them less effective for this specific investigation.

Answer

Antivirus logs on each endpoint

Answer

NetFlow data collected from network devices

Answer

Firewall logs showing outbound connections

Question 18

Which TWO sources are used to populate threat intelligence feeds for incident detection?

Accepted Answer

Honeypot monitoring data. Threat intelligence feeds are compiled from observed malicious activity (honeypots, sensor networks) and security research.

Answer

Building maintenance schedules

Answer

Internal employee social media posts

Answer

Public weather reports

Question 19

During a forensic analysis, you find a suspicious file that was renamed to look like a system file. What is the most reliable way to identify its true nature?

Accepted Answer

Calculate the file hash. Calculating the file hash (e.g., MD5, SHA-1, SHA-256) produces a unique fingerprint of the file's contents that can be compared against threat intelligence databases like VirusTotal or internal IOC lists to identify known malware regardless of the filename or extension. This is the most reliable method because it is based on actual content, not metadata that can be trivially altered.

Answer

Review the file's creation date

Answer

Check the file size

Answer

Check the file extension

Question 20

A threat actor gains initial access to a network by sending a phishing email with a malicious macro-enabled document. After the user enables macros, the document executes PowerShell to download and run a payload. Which MITRE ATT&CK tactic does the macro execution represent?

Accepted Answer

Execution. The macro execution after a user enables macros is an Execution tactic. It allows the adversary to run PowerShell and download a payload. This is categorized under Execution in MITRE ATT&CK, as it involves running malicious code. The phishing email is Initial Access, but the macro execution itself is Execution.

Answer

Persistence

Answer

Initial Access

Answer

Defense Evasion