CCOA Practice Test 5 — 25 Questions

Question 1

You are investigating a potential credential harvesting site. Which tool is best suited to safely inspect the site without triggering a potential infection?

Accepted Answer

An isolated sandbox or VM. A sandbox or an isolated virtual machine (e.g., Cuckoo Sandbox) provides a safe, controlled environment to execute and inspect suspicious URLs.

Answer

A local web browser

Answer

A command-line curl request

Answer

The organization's proxy server

Question 2

Which THREE indicators should an analyst monitor to identify a potential web server compromise?

Accepted Answer

Changes to web server configuration files. Web server compromises are often identified by changes in file integrity, unusual outbound traffic, and unexpected server-side process activity.

Answer

User password changes

Answer

Increased server RAM capacity

Question 3

Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?

Accepted Answer

Activate the data breach response plan. Confirmed PII incidents require legal notification and the activation of the data breach response procedure.

Answer

Change all company Wi-Fi passwords

Answer

Post a message on the company intranet

Answer

Delete all user databases

Question 4

In a Linux system, which tool is used to identify open network connections and the specific process ID (PID) associated with them?

Accepted Answer

ss -p. The 'ss' (socket statistics) command or the older 'netstat' command with the '-p' flag is used to show sockets and their associated PIDs.

Answer

top

Answer

ps aux

Answer

ifconfig

Question 5

Which THREE types of data are typically found in a full forensic disk image?

Accepted Answer

File system metadata. Forensic images capture all data on the physical drive, including hidden partition data, slack space, and deleted files that have not yet been overwritten.

Answer

Live memory contents

Answer

Remote cloud storage files

Question 6

Which THREE of the following are common steps in performing a security audit of a Linux system?

Accepted Answer

Verify user account permissions. Checking running processes, user account permissions, and listening ports are key to finding unauthorized activity.

Answer

Delete all system logs

Answer

Disable all disk encryption

Question 7

You are monitoring a network and detect a large number of ARP requests from a single host targeting the entire subnet. This is a sign of what?

Accepted Answer

ARP scanning. ARP scanning is a common technique used by attackers to map a network and identify active hosts.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

Network congestion

Question 8

A CISO asks for a list of indicators that should be monitored in the SIEM to detect potential account takeover attempts. Which THREE indicators are most relevant?

Accepted Answer

High volume of failed login attempts followed by a successful login. Impossible travel, unusual login times, and failed login spikes are key indicators of credential compromise.

Answer

Concurrent logins from different operating systems

Answer

Accessing the account from a known VPN IP range

Question 9

Which TWO of the following are examples of good asset inventory management practices?

Accepted Answer

Maintaining a Configuration Management Database (CMDB) that maps asset relationships.. Automated discovery tools and maintaining a comprehensive CMDB are foundational elements of effective asset inventory.

Answer

Only tracking assets that have had a security incident.

Answer

Deleting assets from the inventory once they are turned off.

Answer

Manually updating an Excel spreadsheet every year.

Question 10

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

Accepted Answer

DHCP Snooping. DHCP Snooping is the standard feature used to validate DHCP messages and prevent rogue server injection.

Answer

VLAN Tagging

Answer

Dynamic ARP Inspection

Answer

Port Security

Question 11

Which TWO documents are essential to provide to a forensic investigator?

Accepted Answer

Chain of Custody form. A proper chain of custody form and the incident timeline are critical for legal and forensic proceedings.

Answer

Employee employment contracts

Answer

Company organizational chart

Answer

The company's logo file

Question 12

A security analyst is configuring an alert in Splunk Enterprise Security to detect potential brute force attacks. The analyst must identify the specific notable event aggregate field that prevents the creation of duplicate alerts for the same source IP over a defined time window. Which field should be utilized?

Accepted Answer

groupby. The 'drilldown_earliest_offset' or similar mechanisms are auxiliary, but 'dedup_field' or 'groupby' fields in the correlation search configuration determine how Splunk aggregates events to prevent alert fatigue.

Answer

notable_event_id

Answer

drilldown_search

Answer

suppression_period

Question 13

You are setting up a secure baseline for a new server. You need to ensure the operating system logs are sent to a centralized logging server. Which service should you configure?

Accepted Answer

rsyslog. Syslog (or Syslog-ng/rsyslog) is the standard protocol and service for forwarding logs from a Linux server to a central collection point.

Answer

NTP

Answer

DHCP

Answer

SNMP Trap

Question 14

Which THREE of the following are examples of 'Access Control' implementations?

Accepted Answer

Setting file system permissions (e.g., Read/Write/Execute).. Access control is achieved through authentication, authorization, and accounting (AAA) mechanisms like MFA, RBAC, and file permissions.

Answer

Cleaning the office floor daily.

Answer

Using a high-quality monitor for security logs.

Question 15

In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?

Accepted Answer

Protocol: TCP, Port: 443, Source: 10.0.1.0/24. The principle of least privilege dictates specifying the exact port and source CIDR block rather than using broad '0.0.0.0/0' entries.

Answer

Protocol: UDP, Port: 443, Source: 10.0.1.0/24

Answer

Protocol: TCP, Port: 80, Source: 10.0.1.0/24

Answer

Protocol: All Traffic, Port: All, Source: 0.0.0.0/0

Question 16

A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?

Accepted Answer

Resource Monitor. Resource Monitor is the standard Windows utility for granular monitoring of per-process disk, CPU, and memory activity.

Answer

System Configuration (msconfig)

Answer

Event Viewer

Answer

Task Manager

Question 17

Which THREE phases of the incident response lifecycle involve the most interaction with stakeholders?

Accepted Answer

Preparation. The Preparation, Communication, and Post-Incident phases require heavy interaction with management, users, and external parties.

Answer

Detection and Analysis

Answer

Containment and Eradication

Question 18

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

Accepted Answer

Detection and Analysis. The Detection and Analysis phase is where the team processes logs and alerts to identify if an event constitutes an incident.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 19

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

Accepted Answer

To provide continuous monitoring and automated response to threats on endpoints.. EDR tools are designed specifically to detect, investigate, and remediate advanced threats on endpoint devices.

Answer

To block all incoming traffic at the network edge.

Answer

To scan for vulnerabilities in web applications.

Answer

To manage user passwords and enforce complexity.

Question 20

You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?

Accepted Answer

The server hosts the primary company e-commerce database with customer credit card data.. Assets that hold PII or are required for business continuity are by definition critical.

Answer

The server is used for testing internal UI prototypes.

Answer

The server has an outdated version of Java installed.

Answer

The server is connected to a printer in the lobby.