CCOA Incident Detection And Response Practice Test 2 — 15 Questions

Question 1

During an incident response investigation, a CCOA analyst discovers that an attacker used a compromised service account to create a new domain admin account and then deleted the Security event log on the domain controller. The analyst needs to determine the account name that was created. Which of the following is the BEST source to recover this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The domain controller's Security event log backup stored on a separate log server.. Security event log forwarding to a central server or SIEM ensures that critical events like account creation are preserved even if the local log is deleted. The correct option leverages that external copy to recover the account name. Other sources either lack the event detail (ntds.dit, System log) or track unrelated file system changes (USN journal).

Answer

The NTFS USN journal on the domain controller's system volume, which tracks file and directory changes.

Answer

The Windows System event log on the domain controller, which records account management changes.

Answer

The Active Directory database file (ntds.dit) from a recent system state backup.

Question 2

A CCOA analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unknown IP address over port 443. The analyst suspects the use of a covert channel. Which technique should the analyst prioritize to confirm whether the traffic is malicious?

Accepted Answer

Inspect TLS certificate details and JA3 fingerprints. TLS certificate details and JA3 fingerprints are powerful indicators for detecting malicious encrypted traffic. They can reveal self-signed certificates, expired certificates, or known malware fingerprints. This method is effective without decrypting the traffic, making it suitable for confirming a covert channel over port 443.

Answer

Perform full packet capture and analyze payload entropy

Answer

Run a vulnerability scan against the destination IP

Answer

Check firewall logs for allowed outbound connections

Question 3

Which TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?

Accepted Answer

Isolate the infected network segment to prevent lateral movement. Option B is correct because isolating the infected network segment during Containment limits an attacker's ability to move laterally to other hosts, a core containment objective that preserves evidence while stopping the spread. Option E is correct because disabling compromised user accounts revokes the attacker's authenticated access and prevents further abuse of those credentials, which is a standard containment action. Option A is not a containment best practice since immediately re-imaging the server destroys volatile evidence and is properly a recovery/eradication step. Option C is wrong because shutting down the entire corporate firewall would disrupt all network traffic and remove a key defensive control rather than contain the incident. Option D is incorrect because notifying law enforcement is a coordination/communication activity, not a technical containment action, and is only done when warranted.

Answer

Re-image the compromised server immediately to restore service

Answer

Shut down the entire corporate firewall

Answer

Notify the local police department

Question 4

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

Accepted Answer

Time window. In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.

Answer

Throttle field

Answer

Notable event urgency

Answer

Risk score adjustment

Question 5

You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?

Accepted Answer

Use the 'Top values' aggregation on the source IP field in a Lens visualization. Using the 'Top values' aggregation on the source IP field in a Lens visualization is the most efficient way to get the top 10 unique source IPs for a specific destination over the last hour in Kibana. Lens allows you to create a chart that aggregates and ranks values, and you can filter by destination and time range.

Answer

Run an 'Update By Query' API call

Answer

Use a regex filter in the search bar

Answer

Export all logs to CSV and use Excel

Question 6

You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?

Accepted Answer

Process Tree view. Process tree visualization is a core feature of EDR platforms like Falcon or Defender for Endpoint, allowing analysts to trace execution lineage.

Answer

Host status dashboard

Answer

Network connections tab

Answer

Event search logs

Question 7

You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?

Accepted Answer

Process creation logs (e.g., Sysmon Event ID 1). LotL attacks use legitimate system tools like PowerShell or WMI; therefore, process execution logs with command-line arguments are essential.

Answer

Firewall denied logs

Answer

Physical access logs

Answer

SMTP gateway logs

Question 8

During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?

Accepted Answer

Modify the analytic rule logic using a 'where' clause to exclude the account entity from a Watchlist. Modifying the analytic rule logic to exclude the noisy service account using a 'where' clause with a Watchlist is the most effective approach because it allows granular exclusion without disabling the rule. Watchlists in Microsoft Sentinel provide a dynamic way to maintain lists of entities to exclude, and the rule continues to monitor other activities.

Answer

Delete the analytic rule and recreate it with a higher threshold

Answer

Disable the alert in the Data Connector settings

Answer

Set the incident severity to 'Informational'

Question 9

When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?

Accepted Answer

Loaded DLLs and system handles. Fileless malware resides in memory and often leaves traces in process structures, injected code, and handles.

Answer

Browser history files

Answer

Unallocated space in the master file table

Question 10

When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?

Accepted Answer

Host isolation. Host isolation (network containment) in CrowdStrike Falcon severs the endpoint's network communication except for the Falcon sensor's own channel to the cloud, preventing lateral movement and C2 traffic while still allowing responders to issue commands such as memory dump collection. This preserves live forensic evidence and remote response capability, which is exactly what the scenario requires.

Answer

File Quarantine

Answer

Credential revocation

Answer

Sensor uninstallation

Question 11

You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?

Accepted Answer

Manual status update via Action menu. In Splunk Enterprise Security, notable events are updated through the Action menu on the incident review dashboard, where an analyst manually sets the status (e.g., In Progress, Resolved, Closed). No automated setting can force a notable to remain In Progress indefinitely — that state is maintained by the analyst's manual update and persists until another manual change occurs. This is the intended workflow for human-in-the-loop triage.

Answer

Retention policy override

Answer

Real-time notable event aggregation

Answer

Automated workflow action trigger

Question 12

You are investigating a suspected data exfiltration incident. You need to analyze network traffic captured in a PCAP file. Which tool is the industry standard for performing deep packet inspection and protocol analysis during this investigation?

Accepted Answer

Wireshark. Wireshark is the industry-standard tool for deep packet inspection and protocol analysis, supporting hundreds of protocols, rich filtering (display and capture filters), and stream reconstruction. It is the go-to for analyzing PCAP files during incident response and forensic investigations. Its ability to decode, follow TCP/UDP streams, and export objects makes it ideal for exfiltration analysis.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 13

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

Accepted Answer

Event ID 1. Sysmon Event ID 1 tracks process creation, including command-line arguments and parent process information, which is essential for building a process tree.

Answer

Event ID 3

Answer

Event ID 11

Answer

Event ID 22

Question 14

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

Accepted Answer

Incident creation is toggled off in the rule configuration. If 'Incident creation' is disabled in the Microsoft Sentinel analytics rule settings, the rule will generate logs but will not group them into an incident for investigation.

Answer

The KQL query lacks a 'summarize' operator

Answer

Log Analytics workspace ingestion limit reached

Answer

The analytics rule is set to 'Disabled' instead of 'Enabled'

Question 15

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

Accepted Answer

Post-incident activity. The Post-Incident Activity phase (or Lessons Learned) is dedicated to documenting what happened and how to improve future responses.

Answer

Detection and Analysis

Answer

Preparation

Answer

Containment, Eradication, and Recovery