CCOA Practice Test 8 — 10 Questions

Question 1

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

Accepted Answer

The attacker targeted a software vulnerability in an application. This technique involves exploiting a client-side application (like a browser or PDF reader) to execute code.

Answer

The user clicked a link

Answer

The attacker used social engineering

Answer

The user was logged in via RDP

Question 2

During incident response, an analyst observes that an attacker used 'reg save HKLM\SAM C:	emp\sam.hiv' and 'reg save HKLM\SYSTEM C:	emp\system.hiv' on a compromised host. The analyst then sees the files being exfiltrated. Which MITRE ATT&CK tactic is the attacker primarily performing with the 'reg save' commands?

Accepted Answer

Credential Access. The correct answer is Credential Access because the attacker uses 'reg save' to dump the SAM and SYSTEM hives, which store password hashes. This is a direct credential dumping technique. The other tactics—Collection, Exfiltration, and Discovery—describe different phases of the attack lifecycle that are not the primary purpose of these commands.

Answer

Exfiltration

Answer

Collection

Answer

Discovery

Question 3

Which of these is a 'Defense Evasion' technique?

Accepted Answer

Masquerading as a system process. Using masquerading (renaming files to look like system files) is a common way to hide malicious processes.

Answer

Creating a scheduled task

Answer

Stealing a hash

Answer

Scanning ports

Question 4

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.

Answer

Probabilistic

Answer

Deterministic

Answer

Quantitative

Question 5

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

Accepted Answer

$5,000. ALE = SLE * ARO. $10,000 * 0.5 = $5,000.

Answer

$10,000

Answer

$20,000

Answer

$2,500

Question 6

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 7

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

Accepted Answer

Non-repudiation. Non-repudiation refers to the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity.

Answer

Data integrity

Answer

Availability

Answer

Confidentiality

Question 8

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

Accepted Answer

Resetting compromised user credentials. Eradication involves removing the root cause, such as cleaning malware or removing unauthorized user accounts.

Answer

Updating documentation for the incident report

Answer

Restoring data from a known good backup

Answer

Identifying the initial attack vector

Question 9

A security operations analyst is building a data classification and handling standard for a new document management platform that stores contracts, HR records, and public marketing collateral. The analyst must define controls that apply to the highest sensitivity tier. Which TWO actions are appropriate for assets classified at the highest sensitivity level? (Choose two.)

Accepted Answer

Enforce least privilege with role-based access and log all access to the sensitive repositories for monitoring.. The highest sensitivity tier demands controls that both protect and monitor the data. Encrypting at rest and in transit with governed keys protects confidentiality, while least-privilege role-based access plus comprehensive logging limits and detects misuse. Reusing public access rules, allowing unmanaged local copies, or relying on documentation alone all fail to contain the risk that top-tier classification implies.

Answer

Apply the same access control policy used for public marketing collateral to simplify administration.

Answer

Allow users to store local copies on unmanaged endpoints to improve productivity during contract negotiations.

Answer

Publish the classification labels in a public wiki so all staff understand how data is tagged.

Question 10

An analyst reviewing endpoint telemetry sees rundll32.exe executing a DLL from a user's Downloads folder with an export named 'Start'. The DLL was downloaded from an external site minutes earlier. Which MITRE ATT&CK tactic is most directly represented by this activity?

Accepted Answer

Execution. Using rundll32.exe to call an exported function from a downloaded DLL is a straightforward execution technique. The adversary has already delivered the file and is now causing it to run. The tactic that most directly describes this step is execution, regardless of any secondary evasion benefit from abusing a signed binary.

Answer

Defense Evasion

Answer

Command and Control

Answer

Persistence