CCOA Hard Questions — 25 Difficult Questions

Question 1

A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Documenting a clear chain of custody for the forensic image from creation to presentation. Chain of custody is the most critical element for admissibility because it provides a chronological record of the evidence's handling, ensuring that it has not been altered or compromised. While encryption, write blockers, and hashing support integrity and confidentiality, they do not replace the need to document who accessed the evidence and under what circumstances. A complete chain of custody allows the court to trust the evidence's authenticity.

Answer

Generating a hash value of the forensic image and storing it separately from the image

Answer

Using a write blocker during imaging to prevent modification of the original disk

Answer

Encrypting the forensic image with a strong algorithm and storing the key in a secure vault

Question 2

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.

Answer

Increasing password complexity

Answer

VLAN isolation

Answer

Firewall rules

Question 3

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Accepted Answer

Exploiting an exposed VPN gateway. T1133 External Remote Services refers to adversaries leveraging legitimate, externally facing remote access services — most commonly VPN gateways, RDP, Citrix, or VDI — to gain initial access using valid or stolen credentials. Exploiting an exposed VPN gateway is the textbook example, as attackers frequently target unpatched VPN appliances (e.g., Pulse Secure, Fortinet, Citrix ADC) or use credential stuffing against VPN portals to establish a foothold.

Answer

Exploiting an internal web server

Answer

Phishing a user

Answer

Using a USB drive

Question 4

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. Reviewing CloudTrail logs allows you to see the history of API calls made by a specific IAM role, which is essential for investigating anomalous behavior.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 5

You are troubleshooting a failure in a 'Certificate-Based Authentication' setup for a VPN. The logs show 'Handshake Failure'. What tool should you use to verify the server's certificate chain status?

Accepted Answer

'openssl s_client -connect :443 -showcerts'.. 'openssl s_client -connect :443 -showcerts' initiates a TLS handshake and prints the full certificate chain presented by the server, letting you inspect each certificate's subject, issuer, validity dates, and whether the chain is complete and trusted. It is the standard command-line tool for diagnosing certificate-chain and handshake failures on Linux. The -showcerts flag ensures intermediate certificates are displayed, which is exactly what you need to spot a missing or expired intermediate.

Answer

Wireshark to analyze the encrypted traffic.

Answer

'certutil -verify -urlfetch' on the Linux server.

Answer

Nmap with the '--script ssl-enum-ciphers' flag.

Question 6

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

Accepted Answer

Token-based sign-in with no MFA. 'Token-based' sign-ins that lack a corresponding MFA challenge or device registration are strong indicators of session theft or pass-the-token attacks.

Answer

Successful MFA challenge

Answer

Location change

Answer

Successful password-based sign-in

Question 7

Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?

Accepted Answer

Activate the data breach response plan. Option B is correct because once an incident is confirmed to involve sensitive PII, the organization's data breach response plan must be activated to guide containment, investigation, notification, and remediation steps in a consistent, compliant manner. Option E is correct because legal counsel must be notified promptly so they can assess regulatory notification obligations (e.g., GDPR, HIPAA, state breach laws), preserve privilege, and advise on liability and disclosure requirements. The unmarked options do not belong: changing all company Wi-Fi passwords (A) is an unrelated blanket action that does not address the PII breach, posting an intranet message (C) is a communication step that could prematurely disclose information and is not a required response action, and deleting all user databases (D) would destroy evidence and potentially worsen the breach rather than contain it.

Answer

Change all company Wi-Fi passwords

Answer

Post a message on the company intranet

Answer

Delete all user databases

Question 8

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

Accepted Answer

Incident creation is toggled off in the rule configuration. If 'Incident creation' is disabled in the Microsoft Sentinel analytics rule settings, the rule will generate logs but will not group them into an incident for investigation.

Answer

The KQL query lacks a 'summarize' operator

Answer

Log Analytics workspace ingestion limit reached

Answer

The analytics rule is set to 'Disabled' instead of 'Enabled'

Question 9

While investigating a web server breach, you find malicious PHP web shells. What is the most effective way to identify the source of the upload?

Accepted Answer

Analyze web server access logs. Web server access logs record every HTTP request, including the method, URI, source IP, user agent, and response code, so they reveal exactly when and from where the web shell was uploaded or accessed. Analyzing these logs is the most effective way to trace the upload source and identify the attacker's entry point. This is the primary forensic artifact for web-based intrusions.

Answer

Check the file metadata (MACE)

Answer

Scan the server for viruses

Answer

Check system boot logs

Question 10

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

Accepted Answer

Verify the digital signature of the referenced executable.. Run keys in the Windows Registry are a common persistence mechanism, and the most reliable way to determine whether an entry is malicious is to verify the digital signature of the referenced executable. A valid signature from a trusted publisher strongly suggests legitimacy, while an unsigned, invalid, or revoked signature is a red flag. This is a non-destructive, evidence-preserving step appropriate for forensic analysis.

Answer

Delete the registry key.

Answer

Reboot the server.

Answer

Rename the file to .txt.

Question 11

A CCOA analyst is reviewing a vulnerability scan report for a web server that hosts a public-facing application. The scan identified several vulnerabilities, including a critical remote code execution (RCE) flaw in a web framework, a medium-severity cross-site scripting (XSS) issue, and a low-severity information disclosure in an HTTP header. The RCE vulnerability has a known exploit available in the wild, but the web framework is only used for an internal administrative interface that is not accessible from the internet. The XSS vulnerability is on a public login page. Which vulnerability should the analyst prioritize for immediate remediation based on risk?

Accepted Answer

The medium-severity XSS on the public login page, because it is accessible to unauthenticated users and could lead to credential theft.. The XSS on the public login page is the top priority because it is exploitable by unauthenticated attackers and can lead to credential theft, which could result in full compromise. Although the RCE is critical, its internal-only exposure reduces its immediate risk. Risk-based prioritization considers both severity and context, such as network accessibility and exploit availability.

Answer

All three vulnerabilities should be remediated simultaneously with equal priority, because any vulnerability could be exploited.

Answer

The critical RCE vulnerability, because it has a known exploit and critical severity rating, regardless of network accessibility.

Answer

The low-severity information disclosure, because it could reveal sensitive information about the server that aids further attacks.

Question 12

You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?

Accepted Answer

~/.bashrc. ~/.bashrc is a per-user shell initialization file executed every time an interactive Bash shell starts, including on login for many configurations. Attackers commonly append reverse shells, aliases, or environment variable exports to it so malicious code runs silently each time the user opens a terminal. Because it lives in the user's home directory and is user-writable, it is a low-privilege, high-persistence target.

Answer

/bin/sh

Answer

/var/log/syslog

Answer

/etc/passwd

Question 13

What is the primary difference between a Red Team and a Blue Team in a security simulation?

Accepted Answer

Red Team acts as the adversary, Blue Team performs incident response. In security simulations, the Red Team emulates adversary tactics, techniques, and procedures (TTPs) to test defenses, while the Blue Team defends, detects, and responds to those attacks. This adversarial/defensive split is the defining characteristic of red vs. blue teaming. Option C captures both roles accurately.

Answer

Red Team creates policy, Blue Team audits it

Answer

Red Team handles infrastructure, Blue Team handles software

Answer

Red Team identifies vulnerabilities, Blue Team remediates them

Question 14

A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?

Accepted Answer

An explicit Deny entry is present.. In Windows ACL evaluation, an explicit Deny entry always overrides any Allow entries, regardless of group membership or inheritance. If Effective Access shows Deny, the most direct explanation is that an explicit Deny ACE exists on the resource or a parent object. This is deterministic behavior in the Windows access check algorithm.

Answer

The server is offline.

Answer

The drive is full.

Answer

They are not in the correct group.

Question 15

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

Accepted Answer

windows.malfind. The 'windows.malfind' plugin in Volatility 3 is designed to locate injected code segments by scanning for memory regions with suspicious permissions (e.g., PAGE_EXECUTE_READWRITE).

Answer

windows.info

Answer

windows.netscan

Answer

windows.pstree

Question 16

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

Accepted Answer

Disabling unused modules (e.g., WebDAV, directory listing) in the web server configuration.. Option D is correct because endpoint hardening of a web service requires reducing the attack surface by disabling unnecessary features such as WebDAV, autoindex/directory listing, and other unused modules in the web server configuration (e.g., Apache's LoadModule directives or IIS role services), which eliminates known vectors for information disclosure and exploitation. Option E is correct because default welcome pages, sample scripts, and demo applications (e.g., IIS iisstart.htm or Apache's default index) are well-known fingerprints and often contain vulnerabilities, so removing them is a standard hardening step. Option A is incorrect because changing a wallpaper is cosmetic and has no security impact on the web service. Option B is incorrect because auto-restarting every 10 minutes does not harden the service and could actually cause availability problems. Option C is incorrect because adding RAM is a performance/capacity upgrade, not a security hardening measure.

Answer

Changing the administrator's wallpaper to the company logo.

Answer

Configuring the server to auto-restart every 10 minutes.

Answer

Replacing the server's RAM with larger capacity sticks.

Question 17

A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?

Accepted Answer

Perform a frequency analysis of connection time intervals. Beaconing is characterized by regular, periodic callbacks (e.g., every 60 seconds), so analyzing the distribution of inter-connection time intervals reveals the low-variance periodicity that distinguishes C2 traffic from normal user-driven traffic. Frequency analysis (e.g., via histograms, Fourier transforms, or standard deviation of intervals) surfaces this pattern even in high-volume PCAP/NetFlow data. Bandwidth, port entropy, and byte counts do not capture the temporal regularity that defines beaconing.

Answer

Identify top talkers by total bandwidth consumption

Answer

Filter connections by source port entropy

Answer

Calculate the mean of bytes transferred per session

Question 18

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

Accepted Answer

Configure the service folder permissions to restrict write access to the 'Administrators' group only.. Hardening services that run as SYSTEM requires securing the directory permissions so only authorized users can write to the application folder, preventing the loading of malicious DLLs.

Answer

Change the service account to a local 'Guest' account.

Answer

Enable 'Service Isolation' in the Registry using the 'ServiceSidType' key.

Answer

Rename the service executable to a random string.

Question 19

Which TWO of the following are considered 'Technical' controls?

Accepted Answer

Firewall configuration. Technical controls (logical controls) are implemented via software, hardware, or firmware.

Answer

Background checks

Answer

Security policy documentation

Answer

Guard patrol

Question 20

During incident response for a suspected data exfiltration, the team captures full packet data at the perimeter. The CCOA analyst needs to determine whether large outbound transfers occurred over an encrypted channel that cannot be inspected. Which network flow artifact should the analyst use to identify the volume and duration of the transfers while preserving the ability to correlate with other logs?

Accepted Answer

NetFlow records exported from the perimeter router. Flow records provide the metadata needed to quantify outbound transfer volume and duration without decrypting payloads. They are lightweight, widely retained, and easily correlated with other telemetry, making them the right artifact for this encrypted-traffic scenario. Full packet capture is less efficient for volume analysis, while DNS and proxy logs address different aspects.

Answer

DNS query logs from the internal resolver

Answer

Full packet capture analyzed with a protocol analyzer

Answer

Proxy access logs with HTTP status codes