CCOA Incident Detection And Response Practice Test 3 — 15 Questions

Question 1

You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the '_GetWatchlist' KQL function. In Microsoft Sentinel, you use the 'in' operator combined with the _GetWatchlist function in your KQL query to compare incoming logs against the watchlist content.

Answer

Assign IPs to a 'Threat Intelligence' tag

Answer

Hardcode the IPs in the query

Answer

Automatically block them via Network Security Group

Question 2

Which type of log provides the most granular detail regarding local account creation on a Windows Server?

Accepted Answer

Security logs. Windows Security Event Logs (specifically Event ID 4720) record the creation of new user accounts, providing the most granular detail.

Answer

System logs

Answer

Application logs

Answer

DNS logs

Question 3

You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?

Accepted Answer

Sigcheck. 'sigcheck' from the Sysinternals suite is the standard command-line utility for verifying the digital signature of a file.

Answer

Task Manager

Answer

Process Explorer

Answer

Event Viewer

Question 4

A SIEM alert indicates a 'Golden Ticket' attack. What is the primary indicator of this attack in the logs?

Accepted Answer

Abnormally long TGT lifetime. A Golden Ticket attack involves Kerberos TGT (Ticket Granting Ticket) requests that appear abnormal because the ticket lifetime is extremely long, often years.

Answer

Frequent account lockout events

Answer

Unusual user agent strings

Answer

Excessive failed login attempts

Question 5

When drafting an incident report, what is the most important element to include for the executive summary?

Accepted Answer

Business impact and status. The executive summary must communicate the business impact and current status clearly to non-technical stakeholders.

Answer

Full raw packet captures

Answer

Detailed list of every command run

Answer

System architecture diagrams

Question 6

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

Accepted Answer

ICMP tunneling. ICMP tunneling uses the data payload of ICMP packets to encapsulate other protocol traffic, which is a common exfiltration or command-and-control technique.

Answer

DNS spoofing

Answer

Network congestion

Answer

A standard network ping

Question 7

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

Accepted Answer

Token-based sign-in with no MFA. 'Token-based' sign-ins that lack a corresponding MFA challenge or device registration are strong indicators of session theft or pass-the-token attacks.

Answer

Successful MFA challenge

Answer

Location change

Answer

Successful password-based sign-in

Question 8

You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?

Accepted Answer

Windows Registry keys. Fileless malware often lives in the Windows Registry, specifically under 'Run' or 'RunOnce' keys, to ensure execution without a physical file on disk.

Answer

AppData/Roaming

Answer

System32 directory

Answer

Temp folder

Question 9

While investigating a web server breach, you find malicious PHP web shells. What is the most effective way to identify the source of the upload?

Accepted Answer

Analyze web server access logs. Web server access logs record every HTTP POST request, including the URI and the time, allowing you to correlate file creation with specific web requests.

Answer

Check the file metadata (MACE)

Answer

Scan the server for viruses

Answer

Check system boot logs

Question 10

A phishing simulation resulted in a user clicking a link. What is the next logical step in the incident response process?

Accepted Answer

Review user activity logs for account compromise. Checking logs for successful logins or abnormal activity from that user account is critical to determine if the phishing attempt led to an account compromise.

Answer

Reimage the machine immediately

Answer

Block the domain of the link

Answer

Change the user's password

Question 11

What is a 'False Positive' in the context of SIEM alerting?

Accepted Answer

A legitimate action flagged as malicious. A false positive is an alert that indicates a security incident when in reality, the activity is legitimate.

Answer

A system error causing a crash

Answer

A successful attack that was blocked

Answer

An incident that went undetected

Question 12

You are investigating a potential credential harvesting site. Which tool is best suited to safely inspect the site without triggering a potential infection?

Accepted Answer

An isolated sandbox or VM. A sandbox or an isolated virtual machine (e.g., Cuckoo Sandbox) provides a safe, controlled environment to execute and inspect suspicious URLs.

Answer

A local web browser

Answer

A command-line curl request

Answer

The organization's proxy server

Question 13

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

Accepted Answer

Non-repudiation. Non-repudiation refers to the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity.

Answer

Data integrity

Answer

Availability

Answer

Confidentiality

Question 14

In a Linux system, which tool is used to identify open network connections and the specific process ID (PID) associated with them?

Accepted Answer

ss -p. The 'ss' (socket statistics) command or the older 'netstat' command with the '-p' flag is used to show sockets and their associated PIDs.

Answer

top

Answer

ps aux

Answer

ifconfig

Question 15

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

Remove the threat or root cause. The goal of eradication is to remove the root cause of the incident, such as deleting malware, removing accounts, or closing vulnerabilities.

Answer

Identify the attacker

Answer

Improve future security posture

Answer

Restore service to normal