CCOA Incident Detection And Response Practice Test 2 — 15 Questions

Question 1

A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?

Accepted Answer

Isolate the host from the network. Isolating the affected host from the network prevents the ransomware from spreading to other shares or command-and-control servers while preserving local evidence.

Answer

Reboot the server

Answer

Delete the suspicious files

Answer

Change all user passwords

Question 2

In a Palo Alto Networks environment, you need to identify if a specific internal host is beaconing to a command-and-control server. Which log type provides the necessary data?

Accepted Answer

Traffic logs. Traffic logs in Palo Alto Networks provide the session-level details required to perform frequency analysis and detect beaconing patterns.

Answer

Data filtering logs

Answer

Threat logs

Answer

URL filtering logs

Question 3

When using Wireshark to investigate a data exfiltration incident, you want to filter for TCP streams involving a specific internal IP that are larger than 1MB. How is this achieved?

Accepted Answer

Use 'Statistics > Conversations > TCP' and sort by bytes. Wireshark provides flow-level statistics via 'Statistics > Conversations > TCP', which allows for filtering and viewing stream sizes.

Answer

Apply a filter: 'data.len > 1MB'

Answer

Apply a display filter: 'ip.addr == 10.0.0.5 && tcp.len > 1048576'

Answer

Use 'Analyze > Expert Info'

Question 4

You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?

Accepted Answer

client.geographicalContext.proxyType. The 'client.geographicalContext.proxyType' or similar risk-based fields in Okta logs identify if the connecting IP is associated with known proxies or VPNs.

Answer

outcome.reason

Answer

target.alternateId

Answer

debugContext.debugData

Question 5

You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?

Accepted Answer

FTK Imager. FTK Imager is a widely recognized industry tool for creating forensic bit-stream images and verifying the integrity of the data using MD5 or SHA-1 hashes.

Answer

Robocopy

Answer

Diskpart

Answer

Windows File Explorer

Question 6

A security analyst is triaging an alert about an unauthorized login from an unusual country. What is the first priority in the response workflow?

Accepted Answer

Verify the incident with the user or manager. Verifying the incident (confirming if it was a legitimate user traveling or an actual breach) is the vital first step to prevent unnecessary incident escalation.

Answer

Disable the user account immediately

Answer

Notify legal counsel

Answer

Reimage the user's laptop

Question 7

You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?

Accepted Answer

PutBucketPolicy. 'PutBucketPolicy' is the specific API call recorded in CloudTrail when an IAM identity modifies the bucket policy of an S3 bucket.

Answer

UpdatePolicy

Answer

ModifyBucketPolicy

Answer

DescribeBucketPolicy

Question 8

During an investigation, you discover a malicious cron job on a Linux server. Which directory is the primary location for user-specific cron tasks?

Accepted Answer

/var/spool/cron/crontabs/. In Linux, user-specific crontab files are stored in '/var/spool/cron/crontabs/' or '/var/spool/cron/tabs/'.

Answer

/etc/init.d

Answer

/etc/cron.d

Answer

/usr/bin/crontab

Question 9

You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?

Accepted Answer

~/.bashrc. The '.bashrc' file in a user's home directory is a standard location for executing code at login, making it a common persistence vector for attackers.

Answer

/bin/sh

Answer

/var/log/syslog

Answer

/etc/passwd

Question 10

A SIEM has triggered an alert for 'Excessive Failed Login Attempts' followed by a 'Successful Login'. Which technique is this most likely attempting to detect?

Accepted Answer

Brute force attack. This pattern is characteristic of a password spraying or brute force attack, where the attacker tries many passwords until one is successful.

Answer

Data exfiltration

Answer

DNS tunneling

Answer

Privilege escalation

Question 11

In the context of the NIST Incident Response lifecycle, which phase involves the identification of the root cause?

Accepted Answer

Detection and Analysis. The Analysis phase involves determining the nature, scope, and magnitude of the incident, which leads to understanding the root cause.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 12

A security appliance flags a high volume of traffic from a single internal host to a series of random external IP addresses. This is a classic indicator of which activity?

Accepted Answer

Network scanning. Scanning or discovery phases often manifest as a single host attempting to connect to numerous external destinations in a short window.

Answer

Normal web browsing

Answer

VPN connection

Answer

Data exfiltration

Question 13

After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?

Accepted Answer

RAM image first, then disk. Memory (RAM) should be captured before disk storage because memory content is lost as soon as the machine is powered off or rebooted.

Answer

Network traffic logs, then RAM

Answer

Disk image first, then RAM

Answer

Reboot the machine, then image

Question 14

While investigating an incident in Google Workspace, you notice suspicious file sharing. Which log type should be queried to see which files were shared externally by a specific user?

Accepted Answer

Drive audit logs. The 'Drive' audit logs in Google Workspace capture events like file creation, viewing, and changing sharing permissions (e.g., 'change_user_access').

Answer

Admin audit logs

Answer

Login logs

Answer

OAuth token logs

Question 15

You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?

Accepted Answer

-EncodedCommand. The '-EncodedCommand' (or '-e', '-enc') switch in PowerShell is a common flag used to execute obfuscated or Base64 encoded scripts.

Answer

-WindowStyle Hidden

Answer

-NoProfile

Answer

-ExecutionPolicy Bypass