CCOA Practice Test 4 — 25 Questions

Question 1

When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?

Accepted Answer

ssdt. ssdt and modules are critical for identifying hooking and unauthorized kernel objects.

Answer

pslist

Answer

hashdump

Answer

hivelist

Question 2

You are evaluating a third-party application's access requirements. Which THREE of the following are considered 'Least Privilege' implementations?

Accepted Answer

Using a dedicated service account instead of a personal user account for application processes.. Least privilege requires granting only the absolute minimum permissions needed for a task, using granular roles, and scoping access by resource.

Answer

Granting the application access to all internal databases 'just in case' it needs them later.

Answer

Granting the application service account 'Owner' role on the entire Azure Subscription.

Question 3

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

Accepted Answer

Post-incident activity. The Post-Incident Activity phase (or Lessons Learned) is dedicated to documenting what happened and how to improve future responses.

Answer

Detection and Analysis

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 4

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

Accepted Answer

To preserve volatile evidence in RAM. Turning off the machine clears the RAM, which contains volatile evidence that is critical for incident analysis.

Answer

To allow the attacker to keep working

Answer

Because the OS might crash

Answer

To save electricity

Question 5

Which TWO of the following Windows log types are most useful for detecting lateral movement?

Accepted Answer

System logs. Lateral movement is often detected by monitoring authentication logs (logons/logoffs) and process creation events (for remote execution tools like PsExec).

Answer

Power management logs

Answer

Windows Update logs

Answer

DNS client logs

Question 6

Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?

Accepted Answer

Exploit Code Maturity (e.g., is there a public exploit available?).. CVSS scoring includes base metrics like exploit code maturity, environmental impact, and temporal factors to prioritize remediation.

Answer

The number of employees in the department that owns the server.

Answer

The color of the server rack hardware.

Question 7

You are hardening a web server. Which directive in an Apache configuration file helps prevent Clickjacking attacks?

Accepted Answer

X-Frame-Options: SAMEORIGIN. The 'X-Frame-Options' header prevents the site from being embedded in iframes, which is the primary vector for clickjacking.

Answer

Strict-Transport-Security

Answer

Content-Security-Policy: default-src 'self'

Answer

X-XSS-Protection: 1

Question 8

When using Wireshark to investigate a data exfiltration incident, you want to filter for TCP streams involving a specific internal IP that are larger than 1MB. How is this achieved?

Accepted Answer

Use 'Statistics > Conversations > TCP' and sort by bytes. Wireshark provides flow-level statistics via 'Statistics > Conversations > TCP', which allows for filtering and viewing stream sizes.

Answer

Apply a filter: 'data.len > 1MB'

Answer

Apply a display filter: 'ip.addr == 10.0.0.5 && tcp.len > 1048576'

Answer

Use 'Analyze > Expert Info'

Question 9

You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?

Accepted Answer

-EncodedCommand. The '-EncodedCommand' (or '-e', '-enc') switch in PowerShell is a common flag used to execute obfuscated or Base64 encoded scripts.

Answer

-WindowStyle Hidden

Answer

-NoProfile

Answer

-ExecutionPolicy Bypass

Question 10

Which TWO sources are used to populate threat intelligence feeds for incident detection?

Accepted Answer

Honeypot monitoring data. Threat intelligence feeds are compiled from observed malicious activity (honeypots, sensor networks) and security research.

Answer

Building maintenance schedules

Answer

Internal employee social media posts

Answer

Public weather reports

Question 11

You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?

Accepted Answer

ss -tulpn. 'ss' (socket statistics) with the '-tulpn' flags is the modern, preferred tool over the deprecated 'netstat' for viewing listening sockets with process IDs.

Answer

lsof -i | grep LISTEN

Answer

ps aux | grep port

Answer

netstat -an | grep LISTEN

Question 12

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Accepted Answer

Revoke all active sessions/tokens. Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).

Answer

Upgrade the user's OS

Answer

Block the user's physical building access

Answer

Delete the user's home directory

Question 13

During an investigation, you discover a malicious cron job on a Linux server. Which directory is the primary location for user-specific cron tasks?

Accepted Answer

/var/spool/cron/crontabs/. In Linux, user-specific crontab files are stored in '/var/spool/cron/crontabs/' or '/var/spool/cron/tabs/'.

Answer

/etc/init.d

Answer

/etc/cron.d

Answer

/usr/bin/crontab

Question 14

Which THREE types of network logs are most effective for identifying a data breach?

Accepted Answer

Web proxy logs. Network logs (NetFlow, DNS, Proxy) provide visibility into communication patterns that reveal unauthorized data transfers.

Answer

DHCP lease logs

Answer

Printer queue logs

Question 15

Which THREE behaviors are characteristic of a potential data exfiltration attempt?

Accepted Answer

Traffic over non-standard ports. Data exfiltration is often characterized by unusual spikes in outbound traffic, use of non-standard ports, or connections to unusual or high-risk geographic locations.

Answer

Frequent screen locking

Answer

Increased local printer usage

Question 16

An incident response team is performing containment on a compromised Linux server that is part of a containerized environment. Given that the container is running in a Kubernetes cluster, which action is the most appropriate initial containment step to preserve the volatile memory for forensics while preventing further data exfiltration?

Accepted Answer

Pause the container process using container runtime tools. Pausing the container allows for the preservation of current memory states, whereas deletion or isolation via network policies might trigger cleanup scripts or lose memory artifacts.

Answer

Remove the container image from the registry

Answer

Update the Kubernetes NetworkPolicy to deny all ingress and egress

Answer

Delete the pod immediately to stop the communication

Question 17

A SIEM alert indicates a 'Golden Ticket' attack. What is the primary indicator of this attack in the logs?

Accepted Answer

Abnormally long TGT lifetime. A Golden Ticket attack involves Kerberos TGT (Ticket Granting Ticket) requests that appear abnormal because the ticket lifetime is extremely long, often years.

Answer

Frequent account lockout events

Answer

Unusual user agent strings

Answer

Excessive failed login attempts

Question 18

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

Remove the threat or root cause. The goal of eradication is to remove the root cause of the incident, such as deleting malware, removing accounts, or closing vulnerabilities.

Answer

Identify the attacker

Answer

Improve future security posture

Answer

Restore service to normal

Question 19

When drafting an incident report, what is the most important element to include for the executive summary?

Accepted Answer

Business impact and status. The executive summary must communicate the business impact and current status clearly to non-technical stakeholders.

Answer

Full raw packet captures

Answer

Detailed list of every command run

Answer

System architecture diagrams

Question 20

During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?

Accepted Answer

The EDR applies a restrictive host-based firewall policy. Network isolation in EDR typically uses a host-based firewall policy to block all traffic except for the management connection to the EDR controller.

Answer

The EDR clears the local ARP cache

Answer

The EDR shuts down the network interface completely

Answer

The EDR triggers a BIOS-level shutdown of the NIC