CCOA Practice Questions 2 — 50 Questions

Question 1

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

Accepted Answer

Token-based sign-in with no MFA. 'Token-based' sign-ins that lack a corresponding MFA challenge or device registration are strong indicators of session theft or pass-the-token attacks.

Answer

Successful MFA challenge

Answer

Location change

Answer

Successful password-based sign-in

Question 2

An organization is updating its BCP plan. Which step in the risk assessment process should occur immediately after identifying the critical assets?

Accepted Answer

Threat identification. After identifying assets, the next logical step is to identify the threats that could impact those specific assets.

Answer

Vulnerability assessment

Answer

Acceptable risk levels

Answer

Risk mitigation strategy

Question 3

An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?

Accepted Answer

Default Deny. Default Deny (or Least Privilege) ensures that traffic not specifically allowed is prohibited by default.

Answer

Least Privilege

Answer

Separation of Duties

Answer

Defense-in-depth

Question 4

Which security framework is most commonly used by US federal agencies to manage security controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the mandatory security control catalog for US federal information systems.

Answer

ISO 27001

Answer

PCI-DSS

Answer

HIPAA

Question 5

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 6

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

Accepted Answer

Configure the service folder permissions to restrict write access to the 'Administrators' group only.. Hardening services that run as SYSTEM requires securing the directory permissions so only authorized users can write to the application folder, preventing the loading of malicious DLLs.

Answer

Change the service account to a local 'Guest' account.

Answer

Enable 'Service Isolation' in the Registry using the 'ServiceSidType' key.

Answer

Rename the service executable to a random string.

Question 7

Which protocol is most appropriate for secure remote management of network infrastructure devices?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted remote access, whereas Telnet, HTTP, and SNMPv1 are insecure.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 8

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

Accepted Answer

Event ID 1. Sysmon Event ID 1 tracks process creation, including command-line arguments and parent process information, which is essential for building a process tree.

Answer

Event ID 3

Answer

Event ID 11

Answer

Event ID 22

Question 9

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

Accepted Answer

Non-repudiation. Non-repudiation refers to the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity.

Answer

Data integrity

Answer

Availability

Answer

Confidentiality

Question 10

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

Accepted Answer

Clear roles and responsibilities. An IRP must clearly define roles (who does what) and include communication plans (who to notify) to be effective during a crisis.

Answer

The company's marketing strategy

Answer

Inventory of printer models

Answer

List of all employee home addresses

Question 11

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

Accepted Answer

Time window. In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.

Answer

Throttle field

Answer

Notable event urgency

Answer

Risk score adjustment

Question 12

You are investigating an alert in CrowdStrike Falcon. To determine if a file was moved laterally after its initial execution, which feature provides the most accurate visualization?

Accepted Answer

Process Tree view. The Process Tree visualization in CrowdStrike Falcon allows analysts to trace the execution history and lateral movement paths of malicious files across different endpoints.

Answer

Indicator of Compromise (IOC) search

Answer

Detection dashboard filter

Answer

Host search history

Question 13

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

Accepted Answer

Firewall logs. SIEMs ingest data from various layers including identity providers, network infrastructure, and endpoint monitoring tools to provide comprehensive visibility.

Answer

Employee payroll spreadsheets

Answer

Kitchen appliance status reports

Question 14

Which THREE techniques do attackers use to maintain persistence on a Windows host?

Accepted Answer

Installing a malicious system service. Persistence is maintained by registering code with startup processes (Registry), system services, or scheduled tasks.

Answer

Changing the desktop background

Answer

Updating the browser's homepage

Question 15

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.

Answer

Increasing password complexity

Answer

VLAN isolation

Answer

Firewall rules

Question 16

After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?

Accepted Answer

RAM image first, then disk. Memory (RAM) should be captured before disk storage because memory content is lost as soon as the machine is powered off or rebooted.

Answer

Network traffic logs, then RAM

Answer

Disk image first, then RAM

Answer

Reboot the machine, then image

Question 17

Which THREE factors should be considered when assessing the severity of a security incident?

Accepted Answer

Scope of the affected systems. Severity assessment depends on the impact to business operations, the sensitivity of the compromised data, and the scope of the affected systems.

Answer

The day of the week the incident occurred

Answer

The analyst's personal opinion

Question 18

In the context of the NIST Incident Response lifecycle, which phase involves the identification of the root cause?

Accepted Answer

Detection and Analysis. The Analysis phase involves determining the nature, scope, and magnitude of the incident, which leads to understanding the root cause.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 19

You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?

Accepted Answer

Windows Registry keys. Fileless malware often lives in the Windows Registry, specifically under 'Run' or 'RunOnce' keys, to ensure execution without a physical file on disk.

Answer

AppData/Roaming

Answer

System32 directory

Answer

Temp folder

Question 20

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

Accepted Answer

Resetting compromised user credentials. Eradication involves removing the root cause, such as cleaning malware or removing unauthorized user accounts.

Answer

Updating documentation for the incident report

Answer

Restoring data from a known good backup

Answer

Identifying the initial attack vector