CCOA Practice Test 9 — 10 Questions

Question 1

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Accepted Answer

Revoke all active sessions/tokens. Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).

Answer

Upgrade the user's OS

Answer

Block the user's physical building access

Answer

Delete the user's home directory

Question 2

What is a 'False Positive' in the context of SIEM alerting?

Accepted Answer

A legitimate action flagged as malicious. A false positive in SIEM alerting is a detection that fires on activity which is actually legitimate, such as an admin running a script that matches a suspicious command pattern. The alert is 'positive' (the SIEM flagged something) but 'false' because no real malicious event occurred. This is distinct from a false negative, which is a real attack that the SIEM failed to detect.

Answer

A system error causing a crash

Answer

A successful attack that was blocked

Answer

An incident that went undetected

Question 3

A security operations analyst is reviewing how a critical database server is protected. The server stores customer payment data and runs on a hardened host, but the analyst notices that the database service account can read its own data files directly from the file system, and that backup images of the volume are stored unencrypted on a shared network share. Which change MOST directly reduces the risk of bulk data exposure from a stolen backup image?

Accepted Answer

Encrypt the backup images before they leave the host and restrict the shared network share to the backup service identity.. The specific risk is that a copy of the database ends up readable outside the hardened host. Encrypting the backup image with keys kept separate from the image, plus restricting the share to the backup identity, ensures a stolen copy yields no usable data and limits who can take it. Controls aimed at the live host or network path leave the backup artifact itself exposed.

Answer

Remove the database service account's ability to read its own data files so it must query through the database engine.

Answer

Move the database to a more isolated network segment and add intrusion detection to the segment.

Answer

Enable transparent data encryption on the database so the data files are encrypted at rest on the server.

Question 4

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered two days ago. The analyst needs to perform dynamic analysis of the URL to determine if it leads to a malicious payload. Which two actions should the analyst take to safely analyze the URL and gather threat intelligence? (Choose two.)

Accepted Answer

Query threat intelligence platforms for the domain's reputation and associated indicators of compromise.. Submitting the URL to a sandbox allows safe dynamic analysis, recording network traffic and file downloads to identify malicious behavior. Querying threat intelligence platforms provides reputation and associated indicators without direct interaction. Together, these actions safely determine if the URL is malicious and gather actionable intelligence.

Answer

Use a web browser on the analyst's workstation to visit the URL and inspect the page content.

Answer

Perform a WHOIS lookup to obtain the registrar and registrant details of the domain.

Answer

Run a command-line tool like curl to download the URL's content to the analyst's workstation for inspection.

Question 5

A security operations center (SOC) analyst notices that an attacker has been using the 'at' command to schedule a job that runs a reverse shell every day at 9 AM on a compromised Linux server. Which MITRE ATT&CK tactic does this activity represent?

Accepted Answer

Persistence. The correct answer is Persistence because scheduling a recurring job with 'at' ensures the reverse shell runs regularly, maintaining the attacker's access. The other tactics—Execution, Command and Control, and Privilege Escalation—describe different aspects of the attack that are not the primary purpose of this scheduling action.

Answer

Privilege Escalation

Answer

Execution

Answer

Command and Control

Question 6

An analyst observes an endpoint resolving hundreds of unique subdomains under a single parent domain, each subdomain encoded as a long hexadecimal string, and the responses frequently return NXDOMAIN. The endpoint process generating these queries is a signed Office add-in. Which adversarial tactic is the endpoint most likely exhibiting?

Accepted Answer

Command and Control. Encoded subdomain labels under a single parent domain, repeated queries, and NXDOMAIN-heavy responses are the classic fingerprint of DNS-based command and control. Adversaries use this channel because DNS is widely permitted through perimeter controls and blends with normal name resolution. The signed Office add-in generating the queries indicates a trusted process has been co-opted to reach the C2 server, which places the behaviour firmly in the Command and Control tactic.

Answer

Exfiltration Over Alternative Protocol

Answer

Reconnaissance

Answer

Resource Development

Question 7

An analyst detects that an adversary used the PsExec utility to copy a service binary to a remote host and create a temporary Windows service that executed the binary as SYSTEM. The analyst must classify this behaviour. Which MITRE ATT&CK technique does this activity represent?

Accepted Answer

T1569.002 System Services: Service Execution. PsExec achieves remote execution by copying a binary to the target and installing a temporary Windows service that runs the binary as SYSTEM. That service-based execution matches the System Services: Service Execution sub-technique. The temporary nature of the service distinguishes it from persistence-oriented service creation, and the absence of Task Scheduler activity rules out scheduled task abuse, so the correct classification is service execution.

Answer

T1021.002 SMB/Windows Admin Shares

Answer

T1543.003 Create or Modify System Process: Windows Service

Answer

T1053.005 Scheduled Task/Job: Scheduled Task

Question 8

A financial services firm stores customer account data in a database. The security team is asked to ensure that even if the storage media is stolen, the data cannot be read without additional secret material. Which control best satisfies this requirement?

Accepted Answer

Full-disk encryption using AES-256 with keys managed by a hardware security module. The scenario requires that stolen storage media remain unreadable without additional secret material, which is the definition of encryption at rest. Full-disk encryption with AES-256 and HSM-protected keys provides that protection. Transit encryption, access control, and monitoring address different threat vectors and cannot prevent offline reading of stolen disks.

Answer

Role-based access control restricting database queries to authorized analysts

Answer

Database activity monitoring generating alerts on anomalous queries

Answer

TLS 1.3 for all client connections to the database

Question 9

A CCOA analyst is building a threat model for a new API gateway that exposes internal microservices to partner organizations. The analyst wants to prioritize threats using a methodology that combines adversary capability, intent, and opportunity against the organization's specific attack surface. Which approach best fits this requirement?

Accepted Answer

PASTA (Process for Attack Simulation and Threat Analysis) seven-stage methodology. PASTA was designed precisely to blend business impact with attacker behavior. Its stages move from business objectives through technical scope, application decomposition, threat analysis, vulnerability analysis, attack modeling, and risk impact analysis. Because it explicitly weighs adversary capability, intent, and opportunity against the exposed attack surface of the API gateway, it delivers prioritized, business-aligned threats rather than a flat enumeration.

Answer

MITRE ATT&CK Navigator mapping of relevant techniques to the gateway

Answer

STRIDE per element applied to each microservice data flow diagram

Answer

OCTAVE Allegro with information asset profiling workshops

Question 10

During an investigation, a CCOA analyst observes that a Linux web server's /var/log/auth.log shows repeated successful sudo commands by the www-data account, which should never have interactive privileges. The analyst must preserve volatile evidence before remediation. Which action best follows accepted order of volatility while enabling later forensic reconstruction?

Accepted Answer

Capture volatile data with a script that records running processes, network sockets, and loaded kernel modules, then acquire the auth.log and relevant file metadata.. Order of volatility requires collecting the most transient artifacts first, which in this scenario means live process, network, and kernel state, before acquiring persistent files such as auth.log. Halting services, rebooting, or modifying accounts destroys volatile evidence and can alter timestamps. Capturing volatile data and then acquiring logs and metadata preserves both live and persistent evidence for reconstruction.

Answer

Change the www-data password and remove it from the sudoers group to contain the incident, then review auth.log for further unauthorized commands.

Answer

Reboot the server into a trusted rescue environment to ensure no attacker processes interfere, then image the disk and parse auth.log from the image.

Answer

Immediately run systemctl stop apache2 to halt the compromised service, then copy /var/log/auth.log to external media.