CCOA Practice Test 9 — 10 Questions

Question 1

Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?

Accepted Answer

Exploit Code Maturity (e.g., is there a public exploit available?).. CVSS scoring includes base metrics like exploit code maturity, environmental impact, and temporal factors to prioritize remediation.

Answer

The number of employees in the department that owns the server.

Answer

The color of the server rack hardware.

Question 2

You are hardening a web server. Which directive in an Apache configuration file helps prevent Clickjacking attacks?

Accepted Answer

X-Frame-Options: SAMEORIGIN. The 'X-Frame-Options' header prevents the site from being embedded in iframes, which is the primary vector for clickjacking.

Answer

Strict-Transport-Security

Answer

Content-Security-Policy: default-src 'self'

Answer

X-XSS-Protection: 1

Question 3

When using Wireshark to investigate a data exfiltration incident, you want to filter for TCP streams involving a specific internal IP that are larger than 1MB. How is this achieved?

Accepted Answer

Use 'Statistics > Conversations > TCP' and sort by bytes. Wireshark provides flow-level statistics via 'Statistics > Conversations > TCP', which allows for filtering and viewing stream sizes.

Answer

Apply a filter: 'data.len > 1MB'

Answer

Apply a display filter: 'ip.addr == 10.0.0.5 && tcp.len > 1048576'

Answer

Use 'Analyze > Expert Info'

Question 4

You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?

Accepted Answer

-EncodedCommand. The '-EncodedCommand' (or '-e', '-enc') switch in PowerShell is a common flag used to execute obfuscated or Base64 encoded scripts.

Answer

-WindowStyle Hidden

Answer

-NoProfile

Answer

-ExecutionPolicy Bypass

Question 5

Which TWO sources are used to populate threat intelligence feeds for incident detection?

Accepted Answer

Honeypot monitoring data. Threat intelligence feeds are compiled from observed malicious activity (honeypots, sensor networks) and security research.

Answer

Building maintenance schedules

Answer

Internal employee social media posts

Answer

Public weather reports

Question 6

You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?

Accepted Answer

ss -tulpn. 'ss' (socket statistics) with the '-tulpn' flags is the modern, preferred tool over the deprecated 'netstat' for viewing listening sockets with process IDs.

Answer

lsof -i | grep LISTEN

Answer

ps aux | grep port

Answer

netstat -an | grep LISTEN

Question 7

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Accepted Answer

Revoke all active sessions/tokens. Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).

Answer

Upgrade the user's OS

Answer

Block the user's physical building access

Answer

Delete the user's home directory

Question 8

During an investigation, you discover a malicious cron job on a Linux server. Which directory is the primary location for user-specific cron tasks?

Accepted Answer

/var/spool/cron/crontabs/. In Linux, user-specific crontab files are stored in '/var/spool/cron/crontabs/' or '/var/spool/cron/tabs/'.

Answer

/etc/init.d

Answer

/etc/cron.d

Answer

/usr/bin/crontab

Question 9

Which THREE types of network logs are most effective for identifying a data breach?

Accepted Answer

Web proxy logs. Network logs (NetFlow, DNS, Proxy) provide visibility into communication patterns that reveal unauthorized data transfers.

Answer

DHCP lease logs

Answer

Printer queue logs

Question 10

Which THREE behaviors are characteristic of a potential data exfiltration attempt?

Accepted Answer

Traffic over non-standard ports. Data exfiltration is often characterized by unusual spikes in outbound traffic, use of non-standard ports, or connections to unusual or high-risk geographic locations.

Answer

Frequent screen locking

Answer

Increased local printer usage