CCOA Practice Test 8 — 10 Questions

Question 1

You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?

Accepted Answer

PutBucketPolicy. 'PutBucketPolicy' is the specific API call recorded in CloudTrail when an IAM identity modifies the bucket policy of an S3 bucket.

Answer

UpdatePolicy

Answer

ModifyBucketPolicy

Answer

DescribeBucketPolicy

Question 2

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

Accepted Answer

Incident creation is toggled off in the rule configuration. If 'Incident creation' is disabled in the Microsoft Sentinel analytics rule settings, the rule will generate logs but will not group them into an incident for investigation.

Answer

The KQL query lacks a 'summarize' operator

Answer

Log Analytics workspace ingestion limit reached

Answer

The analytics rule is set to 'Disabled' instead of 'Enabled'

Question 3

When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?

Accepted Answer

Loaded DLLs and system handles. Fileless malware resides in memory and often leaves traces in process structures, injected code, and handles.

Answer

Browser history files

Answer

Unallocated space in the master file table

Question 4

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

Accepted Answer

ICMP tunneling. ICMP tunneling uses the data payload of ICMP packets to encapsulate other protocol traffic, which is a common exfiltration or command-and-control technique.

Answer

DNS spoofing

Answer

Network congestion

Answer

A standard network ping

Question 5

You are investigating a potential insider threat. Which log is most useful for tracking file deletion activity on a Windows file server?

Accepted Answer

Object Access auditing logs. Enabling Object Access auditing in the Windows Security policy allows you to track specific file actions, including deletion (Event ID 4660).

Answer

System event logs

Answer

DNS query logs

Answer

Security account management logs

Question 6

When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?

Accepted Answer

ssdt. ssdt and modules are critical for identifying hooking and unauthorized kernel objects.

Answer

pslist

Answer

hashdump

Answer

hivelist

Question 7

You are evaluating a third-party application's access requirements. Which THREE of the following are considered 'Least Privilege' implementations?

Accepted Answer

Using a dedicated service account instead of a personal user account for application processes.. Least privilege requires granting only the absolute minimum permissions needed for a task, using granular roles, and scoping access by resource.

Answer

Granting the application access to all internal databases 'just in case' it needs them later.

Answer

Granting the application service account 'Owner' role on the entire Azure Subscription.

Question 8

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

Accepted Answer

Post-incident activity. The Post-Incident Activity phase (or Lessons Learned) is dedicated to documenting what happened and how to improve future responses.

Answer

Detection and Analysis

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 9

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

Accepted Answer

To preserve volatile evidence in RAM. Turning off the machine clears the RAM, which contains volatile evidence that is critical for incident analysis.

Answer

To allow the attacker to keep working

Answer

Because the OS might crash

Answer

To save electricity

Question 10

Which TWO of the following Windows log types are most useful for detecting lateral movement?

Accepted Answer

System logs. Lateral movement is often detected by monitoring authentication logs (logons/logoffs) and process creation events (for remote execution tools like PsExec).

Answer

Power management logs

Answer

Windows Update logs

Answer

DNS client logs