CCOA Incident Detection And Response Practice Test 3 — 15 Questions

Question 1

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

Accepted Answer

windows.malfind. The 'windows.malfind' plugin in Volatility 3 is designed to locate injected code segments by scanning for memory regions with suspicious permissions (e.g., PAGE_EXECUTE_READWRITE).

Answer

windows.info

Answer

windows.netscan

Answer

windows.pstree

Question 2

A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?

Accepted Answer

Isolate the host from the network. Isolating the affected host from the network prevents the ransomware from spreading to other shares or command-and-control servers while preserving local evidence.

Answer

Reboot the server

Answer

Delete the suspicious files

Answer

Change all user passwords

Question 3

You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?

Accepted Answer

client.geographicalContext.proxyType. The 'client.geographicalContext.proxyType' or similar risk-based fields in Okta logs identify if the connecting IP is associated with known proxies or VPNs.

Answer

outcome.reason

Answer

target.alternateId

Answer

debugContext.debugData

Question 4

You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?

Accepted Answer

FTK Imager. FTK Imager is a widely accepted forensic tool that creates bit-stream (physical) images of storage media and generates MD5/SHA-1 hash values to verify that the image is an exact, unaltered copy of the original. It supports write-blocking awareness, E01 and raw formats, and hash verification, satisfying the integrity requirement for evidentiary purposes. This makes it the standard choice for imaging a SATA drive in a forensically sound manner.

Answer

Robocopy

Answer

Diskpart

Answer

Windows File Explorer

Question 5

A security analyst is triaging an alert about an unauthorized login from an unusual country. What is the first priority in the response workflow?

Accepted Answer

Verify the incident with the user or manager. Verifying the incident (confirming if it was a legitimate user traveling or an actual breach) is the vital first step to prevent unnecessary incident escalation.

Answer

Disable the user account immediately

Answer

Notify legal counsel

Answer

Reimage the user's laptop

Question 6

You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?

Accepted Answer

PutBucketPolicy. 'PutBucketPolicy' is the specific API call recorded in CloudTrail when an IAM identity modifies the bucket policy of an S3 bucket.

Answer

UpdatePolicy

Answer

ModifyBucketPolicy

Answer

DescribeBucketPolicy

Question 7

During an investigation, you discover a malicious cron job on a Linux server. Which directory is the primary location for user-specific cron tasks?

Accepted Answer

/var/spool/cron/crontabs/. In Linux, user-specific crontab files are stored in '/var/spool/cron/crontabs/' or '/var/spool/cron/tabs/'.

Answer

/etc/init.d

Answer

/etc/cron.d

Answer

/usr/bin/crontab

Question 8

You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?

Accepted Answer

~/.bashrc. ~/.bashrc is a per-user shell initialization file executed every time an interactive Bash shell starts, including on login for many configurations. Attackers commonly append reverse shells, aliases, or environment variable exports to it so malicious code runs silently each time the user opens a terminal. Because it lives in the user's home directory and is user-writable, it is a low-privilege, high-persistence target.

Answer

/bin/sh

Answer

/var/log/syslog

Answer

/etc/passwd

Question 9

A SIEM has triggered an alert for 'Excessive Failed Login Attempts' followed by a 'Successful Login'. Which technique is this most likely attempting to detect?

Accepted Answer

Brute force attack. A pattern of excessive failed login attempts immediately followed by a successful login is the classic signature of a brute force attack, where an attacker systematically guesses credentials until one works. The SIEM correlation rule is designed to surface this sequence because the successful login after many failures suggests the attacker eventually guessed the correct password. This is a well-known detection use case in SOC operations.

Answer

Data exfiltration

Answer

DNS tunneling

Answer

Privilege escalation

Question 10

After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?

Accepted Answer

RAM image first, then disk. Memory (RAM) should be captured before disk storage because memory content is lost as soon as the machine is powered off or rebooted.

Answer

Network traffic logs, then RAM

Answer

Disk image first, then RAM

Answer

Reboot the machine, then image

Question 11

While investigating an incident in Google Workspace, you notice suspicious file sharing. Which log type should be queried to see which files were shared externally by a specific user?

Accepted Answer

Drive audit logs. Drive audit logs in Google Workspace record file-level activity including sharing events, permission changes, and external sharing by specific users. To determine which files a user shared externally, the Drive audit log is the correct source because it captures the actor, target file, and visibility change. Admin audit logs cover admin actions, not user file sharing.

Answer

Admin audit logs

Answer

Login logs

Answer

OAuth token logs

Question 12

You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?

Accepted Answer

-EncodedCommand. The '-EncodedCommand' (or '-e', '-enc') switch in PowerShell is a common flag used to execute obfuscated or Base64 encoded scripts.

Answer

-WindowStyle Hidden

Answer

-NoProfile

Answer

-ExecutionPolicy Bypass

Question 13

You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?

Accepted Answer

Use the '_GetWatchlist' KQL function. In Microsoft Sentinel, you use the 'in' operator combined with the _GetWatchlist function in your KQL query to compare incoming logs against the watchlist content.

Answer

Assign IPs to a 'Threat Intelligence' tag

Answer

Hardcode the IPs in the query

Answer

Automatically block them via Network Security Group

Question 14

Which type of log provides the most granular detail regarding local account creation on a Windows Server?

Accepted Answer

Security logs. Windows Security logs (recorded in the Security event log, viewable in Event Viewer under Windows Logs > Security) capture authentication, authorization, and account management events, including local account creation (Event ID 4720), password changes (4723/4724), and group membership changes (4728/4732). These events include the actor, target account, and timestamp, providing the granular audit trail needed for account-creation forensics.

Answer

System logs

Answer

Application logs

Answer

DNS logs

Question 15

You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?

Accepted Answer

Sigcheck. 'sigcheck' from the Sysinternals suite is the standard command-line utility for verifying the digital signature of a file.

Answer

Task Manager

Answer

Process Explorer

Answer

Event Viewer