CCOA Practice Test 6 — 10 Questions

Question 1

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

Accepted Answer

Token-based sign-in with no MFA. 'Token-based' sign-ins that lack a corresponding MFA challenge or device registration are strong indicators of session theft or pass-the-token attacks.

Answer

Successful MFA challenge

Answer

Location change

Answer

Successful password-based sign-in

Question 2

An organization is updating its BCP plan. Which step in the risk assessment process should occur immediately after identifying the critical assets?

Accepted Answer

Threat identification. After identifying assets, the next logical step is to identify the threats that could impact those specific assets.

Answer

Vulnerability assessment

Answer

Acceptable risk levels

Answer

Risk mitigation strategy

Question 3

An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?

Accepted Answer

Default Deny. Default Deny (or Least Privilege) ensures that traffic not specifically allowed is prohibited by default.

Answer

Least Privilege

Answer

Separation of Duties

Answer

Defense-in-depth

Question 4

Which security framework is most commonly used by US federal agencies to manage security controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the mandatory security control catalog for US federal information systems.

Answer

ISO 27001

Answer

PCI-DSS

Answer

HIPAA

Question 5

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 6

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

Accepted Answer

Configure the service folder permissions to restrict write access to the 'Administrators' group only.. Hardening services that run as SYSTEM requires securing the directory permissions so only authorized users can write to the application folder, preventing the loading of malicious DLLs.

Answer

Change the service account to a local 'Guest' account.

Answer

Enable 'Service Isolation' in the Registry using the 'ServiceSidType' key.

Answer

Rename the service executable to a random string.

Question 7

Which protocol is most appropriate for secure remote management of network infrastructure devices?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted remote access, whereas Telnet, HTTP, and SNMPv1 are insecure.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 8

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

Accepted Answer

Event ID 1. Sysmon Event ID 1 tracks process creation, including command-line arguments and parent process information, which is essential for building a process tree.

Answer

Event ID 3

Answer

Event ID 11

Answer

Event ID 22

Question 9

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

Accepted Answer

Non-repudiation. Non-repudiation refers to the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity.

Answer

Data integrity

Answer

Availability

Answer

Confidentiality

Question 10

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

Accepted Answer

Clear roles and responsibilities. An IRP must clearly define roles (who does what) and include communication plans (who to notify) to be effective during a crisis.

Answer

The company's marketing strategy

Answer

Inventory of printer models

Answer

List of all employee home addresses