CCOA Practice Test 2 — 30 Questions

Question 1

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

Accepted Answer

Using stolen credentials obtained via phishing. Adversaries often use stolen credentials or social engineering to obtain legitimate user credentials to access systems as authorized users.

Answer

Exploiting a software vulnerability

Answer

Brute forcing a firewall

Answer

Installing a rootkit

Question 2

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

Accepted Answer

Searching for files with specific extensions like .docx or .xlsx. Data from Local System involves searching for and copying files from a user's machine.

Answer

Modifying a service

Answer

Creating a new user

Answer

Scanning the network

Question 3

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.

Answer

Probabilistic

Answer

Deterministic

Answer

Quantitative

Question 4

In a Palo Alto Networks environment, you need to identify if a specific internal host is beaconing to a command-and-control server. Which log type provides the necessary data?

Accepted Answer

Traffic logs. Traffic logs in Palo Alto Networks provide the session-level details required to perform frequency analysis and detect beaconing patterns.

Answer

Data filtering logs

Answer

Threat logs

Answer

URL filtering logs

Question 5

What is the purpose of 'T1027 Obfuscated Files or Information'?

Accepted Answer

To evade detection by signature-based tools. Obfuscation is used to hide code or scripts from static analysis and security tools, aiding Defense Evasion.

Answer

To escalate privileges

Answer

To increase execution speed

Answer

To facilitate lateral movement

Question 6

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Accepted Answer

SMB/Admin shares. Remote services like RDP and SMB/Admin shares are primary mechanisms for moving laterally.

Answer

DNS query analysis

Answer

Registry key editing

Answer

Keystroke logging

Question 7

Which THREE actions are essential to the 'Identify' function of the NIST CSF?

Accepted Answer

Risk management strategy. Identify covers inventory, risk management, and governance.

Answer

Malware scanning

Answer

Incident recovery time analysis

Question 8

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

Accepted Answer

Browser 'Login Data' SQLite databases. Password stores include browser data, local vaults, and credential managers.

Answer

Active Directory logs

Answer

Network packets

Answer

System logs

Question 9

Which THREE items are typically included in a formal Risk Register?

Accepted Answer

Mitigation status. A risk register tracks risks, including their probability, impact, and mitigation status.

Answer

Vendor contact list

Answer

Hardware serial number

Question 10

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?

Accepted Answer

Access control policy. Administrative controls are policies, procedures, and management tasks rather than technical or physical hardware.

Answer

Biometric locks

Answer

Encryption

Question 11

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

Accepted Answer

Perimeter network (DMZ). The perimeter network (DMZ) is the first line of defense that separates the internal network from untrusted public networks.

Answer

Data encryption

Answer

Host-based security

Answer

Application layer

Question 12

During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?

Accepted Answer

Risk acceptance. Risk acceptance is the decision to accept the risk because the cost of mitigation outweighs the potential impact or because business requirements forbid the change.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 13

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

Accepted Answer

Physical and Environmental Security. Physical and Environmental Security is the domain within ISO 27001 that covers physical site security.

Answer

Human Resource Security

Answer

Operations Security

Answer

Access Control

Question 14

A security analyst is triaging an alert about an unauthorized login from an unusual country. What is the first priority in the response workflow?

Accepted Answer

Verify the incident with the user or manager. Verifying the incident (confirming if it was a legitimate user traveling or an actual breach) is the vital first step to prevent unnecessary incident escalation.

Answer

Disable the user account immediately

Answer

Notify legal counsel

Answer

Reimage the user's laptop

Question 15

Which TWO of the following are considered 'Credential Access' techniques?

Accepted Answer

Brute force. Brute forcing passwords and dumping memory (LSASS) are standard credential access methods.

Answer

File deletion

Answer

Network mapping

Answer

Service creation

Question 16

Which TWO of the following are core components of the CIA Triad?

Accepted Answer

Confidentiality. The CIA Triad stands for Confidentiality, Integrity, and Availability.

Answer

Non-repudiation

Answer

Identification

Answer

Authorization

Question 17

Which TWO of the following are considered 'Technical' controls?

Accepted Answer

Firewall configuration. Technical controls (logical controls) are implemented via software, hardware, or firmware.

Answer

Background checks

Answer

Security policy documentation

Answer

Guard patrol

Question 18

You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?

Accepted Answer

Sigcheck. 'sigcheck' from the Sysinternals suite is the standard command-line utility for verifying the digital signature of a file.

Answer

Task Manager

Answer

Process Explorer

Answer

Event Viewer

Question 19

You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?

Accepted Answer

Incident Response (IR). Incident Response (IR) is the specific NIST 800-53 family governing the response to security incidents.

Answer

Access Control (AC)

Answer

Configuration Management (CM)

Answer

Risk Assessment (RA)

Question 20

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

Accepted Answer

$5,000. ALE = SLE * ARO. $10,000 * 0.5 = $5,000.

Answer

$10,000

Answer

$20,000

Answer

$2,500