CCOA Practice Test 2 — 30 Questions

Question 1

A security operations center analyst observes an endpoint where the process 'rundll32.exe' has loaded a DLL from the user's Downloads folder and is making outbound SMB connections to several internal hosts. Which MITRE ATT&CK tactic is most likely being exercised by this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lateral Movement. The outbound SMB connections from rundll32.exe loading a DLL from a user directory indicate lateral movement. Adversaries often use SMB to access administrative shares or execute remote services on other hosts. This behavior is distinct from execution alone, command and control, or persistence, as it focuses on moving from one system to another within the network.

Answer

Persistence

Answer

Command and Control

Answer

Execution

Question 2

A security analyst is reviewing a packet capture of an internal host that appears to be communicating with an external server. The analyst observes that the TCP three-way handshake completes successfully, but the session then becomes idle for approximately 30 seconds before a small application-layer message is sent. This pattern repeats consistently. Which type of malicious activity is most consistent with this behavior?

Accepted Answer

Command-and-control beaconing. The consistent idle periods followed by small periodic messages over established TCP connections strongly suggest command-and-control beaconing. Malware often uses such channels to receive instructions or exfiltrate small amounts of data while blending in with normal traffic. The other options do not match the observed pattern of established connections with low-volume periodic traffic.

Answer

Port scanning

Answer

TCP SYN flood attack

Answer

Data exfiltration via large file transfers

Question 3

A CCOA analyst is reviewing authentication logs for a Windows environment. The analyst observes a large number of successful logons using NTLMv2 for internal file share access, even though the domain is at a functional level that supports Kerberos. The analyst suspects that some clients are not using Kerberos due to misconfiguration. Which Windows command-line tool should the analyst use to verify the effective authentication protocol being used for a specific server?

Accepted Answer

klist. The klist tool shows the Kerberos ticket cache, so if a service ticket exists for the target server, Kerberos was used. If the access succeeds without a ticket, NTLM was likely used instead. This directly answers the analyst's need to verify the effective authentication protocol for a specific server connection. Other tools manage SPNs, test trusts, or query AD objects, but none reveal the protocol in use.

Answer

nltest

Answer

dsquery

Answer

setspn

Question 4

You are configuring a SIEM alert to trigger when a user account is locked out. Which Windows Event ID should your filter target?

Accepted Answer

Event ID 4740. Windows Event ID 4740 is logged when a user account is locked out due to too many failed logon attempts, making it the correct filter for a SIEM alert on account lockout. Event ID 4625 records individual failed logon attempts, which precede but do not equal a lockout. Event ID 4728 records a member being added to a security-enabled global group, and 4624 records a successful logon.

Answer

Event ID 4625

Answer

Event ID 4728

Answer

Event ID 4624

Question 5

Which THREE types of network logs are most effective for identifying a data breach?

Accepted Answer

Web proxy logs. Network logs (NetFlow, DNS, Proxy) provide visibility into communication patterns that reveal unauthorized data transfers.

Answer

DHCP lease logs

Answer

Printer queue logs

Question 6

You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?

Accepted Answer

Successful and failed login attempts.. Option A is correct because logging both successful and failed login attempts is essential for detecting brute-force attacks, credential stuffing, and unauthorized access, and it provides the audit trail required by standards such as PCI DSS, HIPAA, and SOX. Option B is correct because changes to user privileges or schema via commands like GRANT, REVOKE, ALTER, or DROP can indicate privilege escalation or tampering, and tracking them is a core compliance requirement for change auditing. Option E is correct because large-scale data exports or queries against sensitive tables can signal data exfiltration or insider threats, and monitoring them supports both breach detection and regulatory reporting. Option C does not belong because server hardware temperature is an infrastructure/availability metric, not a security or compliance event. Option D does not belong because the number of active sessions in a connection pool is a performance and capacity metric, not evidence of malicious activity or a compliance-relevant audit event.

Answer

The specific hardware temperature of the server.

Answer

The number of active user sessions in the connection pool.

Question 7

When reviewing cloud storage buckets, you find one is configured with 'public read access'. What is the risk?

Accepted Answer

Unauthorized data exfiltration.. A bucket configured with public read access allows anyone on the internet to list and download objects, which directly enables unauthorized data exfiltration of any sensitive content stored there. This is one of the most common cloud misconfigurations and a leading cause of data breaches. The risk is confidentiality loss, not availability or injection.

Answer

SQL injection.

Answer

Service denial.

Answer

Increased latency.

Question 8

You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?

Accepted Answer

Manual status update via Action menu. In Splunk Enterprise Security, notable events are updated through the Action menu on the incident review dashboard, where an analyst manually sets the status (e.g., In Progress, Resolved, Closed). No automated setting can force a notable to remain In Progress indefinitely — that state is maintained by the analyst's manual update and persists until another manual change occurs. This is the intended workflow for human-in-the-loop triage.

Answer

Retention policy override

Answer

Real-time notable event aggregation

Answer

Automated workflow action trigger

Question 9

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

Accepted Answer

windows.malfind. The 'windows.malfind' plugin in Volatility 3 is designed to locate injected code segments by scanning for memory regions with suspicious permissions (e.g., PAGE_EXECUTE_READWRITE).

Answer

windows.info

Answer

windows.netscan

Answer

windows.pstree

Question 10

When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?

Accepted Answer

Host isolation. Host isolation (network containment) in CrowdStrike Falcon severs the endpoint's network communication except for the Falcon sensor's own channel to the cloud, preventing lateral movement and C2 traffic while still allowing responders to issue commands such as memory dump collection. This preserves live forensic evidence and remote response capability, which is exactly what the scenario requires.

Answer

File Quarantine

Answer

Credential revocation

Answer

Sensor uninstallation

Question 11

A security operations center (SOC) is implementing network segmentation to protect critical assets. Which TWO of the following are essential components of a secure segmented network design? (Choose two.)

Accepted Answer

Using VLANs to logically separate network traffic. Secure network segmentation requires both logical separation and enforcement of access controls. VLANs provide the logical separation, while firewalls between segments enforce policies to restrict traffic. Together, they limit lateral movement and protect critical assets. Flat topologies, endpoint-only protection, and promiscuous mode do not achieve segmentation and may introduce risks.

Answer

Enabling promiscuous mode on all switches to monitor traffic

Answer

Implementing a flat network topology to simplify management

Answer

Relying solely on endpoint antivirus for protection

Question 12

A security analyst reviewing endpoint telemetry observes that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' was modified to point to a PowerShell script in a user's AppData folder. The task runs daily with SYSTEM privileges. Which adversarial tactic does this activity most directly represent?

Accepted Answer

Persistence. Modifying a scheduled task to run a malicious payload with high privileges is a well-known persistence technique. It ensures the adversary's code executes automatically on a schedule, surviving restarts and user logoffs. The other tactics may be incidental, but the defining characteristic is maintaining long-term access, which is the goal of Persistence.

Answer

Execution

Answer

Defense Evasion

Answer

Privilege Escalation

Question 13

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

Accepted Answer

Disabling unused modules (e.g., WebDAV, directory listing) in the web server configuration.. Option D is correct because endpoint hardening of a web service requires reducing the attack surface by disabling unnecessary features such as WebDAV, autoindex/directory listing, and other unused modules in the web server configuration (e.g., Apache's LoadModule directives or IIS role services), which eliminates known vectors for information disclosure and exploitation. Option E is correct because default welcome pages, sample scripts, and demo applications (e.g., IIS iisstart.htm or Apache's default index) are well-known fingerprints and often contain vulnerabilities, so removing them is a standard hardening step. Option A is incorrect because changing a wallpaper is cosmetic and has no security impact on the web service. Option B is incorrect because auto-restarting every 10 minutes does not harden the service and could actually cause availability problems. Option C is incorrect because adding RAM is a performance/capacity upgrade, not a security hardening measure.

Answer

Changing the administrator's wallpaper to the company logo.

Answer

Configuring the server to auto-restart every 10 minutes.

Answer

Replacing the server's RAM with larger capacity sticks.

Question 14

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

Accepted Answer

ICMP tunneling. ICMP tunneling uses the data payload of ICMP packets to encapsulate other protocol traffic, which is a common exfiltration or command-and-control technique.

Answer

DNS spoofing

Answer

Network congestion

Answer

A standard network ping

Question 15

A CCOA analyst is helping to classify assets for a new cybersecurity program. The organization wants to identify which assets are most critical so that protection and monitoring efforts can be prioritized. Which criterion is the MOST appropriate basis for classifying an asset as high criticality?

Accepted Answer

The asset processes or stores regulated customer data and supports a revenue-generating service.. Asset criticality classification should be driven by the business impact of compromise or failure. Assets that process regulated data and directly enable revenue are high criticality because their loss triggers legal, financial, and reputational consequences. This aligns protection and monitoring resources with the organization's most important dependencies and compliance obligations.

Answer

The asset has the highest purchase price in the inventory.

Answer

The asset is managed by the IT team with the largest headcount.

Answer

The asset is the newest model in its category.

Question 16

A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?

Accepted Answer

Perform a frequency analysis of connection time intervals. Beaconing is characterized by regular, periodic callbacks (e.g., every 60 seconds), so analyzing the distribution of inter-connection time intervals reveals the low-variance periodicity that distinguishes C2 traffic from normal user-driven traffic. Frequency analysis (e.g., via histograms, Fourier transforms, or standard deviation of intervals) surfaces this pattern even in high-volume PCAP/NetFlow data. Bandwidth, port entropy, and byte counts do not capture the temporal regularity that defines beaconing.

Answer

Identify top talkers by total bandwidth consumption

Answer

Filter connections by source port entropy

Answer

Calculate the mean of bytes transferred per session

Question 17

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

Accepted Answer

Configure the service folder permissions to restrict write access to the 'Administrators' group only.. Hardening services that run as SYSTEM requires securing the directory permissions so only authorized users can write to the application folder, preventing the loading of malicious DLLs.

Answer

Change the service account to a local 'Guest' account.

Answer

Enable 'Service Isolation' in the Registry using the 'ServiceSidType' key.

Answer

Rename the service executable to a random string.

Question 18

Which THREE of the following are common 'Exfiltration' techniques?

Accepted Answer

Exfiltration over alternative protocol. Exfiltration over alternative protocol (A) is correct because attackers commonly move stolen data out of a network using protocols other than the primary C2 channel, such as DNS, FTP, SMTP, or ICMP, to evade detection and blend with legitimate traffic. Exfiltration over C2 channel (C) is correct because the same command-and-control channel already established for remote access is frequently reused to transfer collected data out of the environment, often encoded or tunneled within the C2 traffic. Exfiltration to cloud storage (E) is correct because adversaries increasingly upload data to legitimate cloud services (e.g., Dropbox, Google Drive, OneDrive) using APIs or web protocols, which can bypass traditional perimeter controls and appear as normal user activity. Keylogging (B) is not an exfiltration technique but a collection technique, as it captures keystrokes for later theft rather than moving data off the system. File system enumeration (D) is also not exfiltration; it is a discovery technique used to identify files and directories of interest before collection or staging occurs.

Answer

Keylogging

Answer

File system enumeration

Question 19

A financial services firm wants to reduce the likelihood that a former employee can use still-valid credentials to access internal systems after termination. Which administrative control should the security team implement FIRST?

Accepted Answer

Establish a formal offboarding procedure that disables accounts immediately upon termination.. The most direct way to prevent a former employee from using valid credentials is to ensure those credentials are disabled as part of a formal offboarding process. Administrative controls such as documented procedures govern how and when accounts are revoked. Technical measures like PAM, MFA, and segmentation are useful but do not replace timely account deactivation.

Answer

Implement network segmentation to isolate internal systems from remote access.

Answer

Deploy a privileged access management (PAM) solution to vault administrator credentials.

Answer

Enable multi-factor authentication (MFA) for all internal system logins.

Question 20

Which type of log provides the most granular detail regarding local account creation on a Windows Server?

Accepted Answer

Security logs. Windows Security logs (recorded in the Security event log, viewable in Event Viewer under Windows Logs > Security) capture authentication, authorization, and account management events, including local account creation (Event ID 4720), password changes (4723/4724), and group membership changes (4728/4732). These events include the actor, target account, and timestamp, providing the granular audit trail needed for account-creation forensics.

Answer

System logs

Answer

Application logs

Answer

DNS logs