CCOA Incident Detection And Response Practice Test 4 — 15 Questions

Question 1

During a forensic analysis, you find a suspicious file that was renamed to look like a system file. What is the most reliable way to identify its true nature?

Accepted Answer

Calculate the file hash. Calculating the file hash (e.g., SHA-256) and comparing it against known databases (like VirusTotal or an internal whitelist) reveals the file's identity regardless of its name.

Answer

Review the file's creation date

Answer

Check the file size

Answer

Check the file extension

Question 2

You are investigating a potential insider threat. Which log is most useful for tracking file deletion activity on a Windows file server?

Accepted Answer

Object Access auditing logs. Enabling Object Access auditing in the Windows Security policy allows you to track specific file actions, including deletion (Event ID 4660).

Answer

System event logs

Answer

DNS query logs

Answer

Security account management logs

Question 3

You are monitoring a network and detect a large number of ARP requests from a single host targeting the entire subnet. This is a sign of what?

Accepted Answer

ARP scanning. ARP scanning is a common technique used by attackers to map a network and identify active hosts.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

Network congestion

Question 4

You are analyzing an incident where a user's machine was compromised via a malicious document. Which Windows log indicates that a macro was executed?

Accepted Answer

Office application logs. Microsoft Office logs (or specific Windows Event logs, such as those related to Office applications) record macro execution if auditing is enabled.

Answer

Application log

Answer

System log

Answer

Security log

Question 5

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Accepted Answer

Revoke all active sessions/tokens. Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).

Answer

Upgrade the user's OS

Answer

Block the user's physical building access

Answer

Delete the user's home directory

Question 6

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

Accepted Answer

To preserve volatile evidence in RAM. Turning off the machine clears the RAM, which contains volatile evidence that is critical for incident analysis.

Answer

To allow the attacker to keep working

Answer

Because the OS might crash

Answer

To save electricity

Question 7

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

Accepted Answer

Firewall logs. SIEMs ingest data from various layers including identity providers, network infrastructure, and endpoint monitoring tools to provide comprehensive visibility.

Answer

Employee payroll spreadsheets

Answer

Kitchen appliance status reports

Question 8

Which TWO tools are commonly used for memory forensic analysis?

Accepted Answer

Rekall. Volatility and Rekall are the industry-standard frameworks used for analyzing memory dumps to detect malicious code and system artifacts.

Answer

Nmap

Answer

Hashcat

Answer

Wireshark

Question 9

Which THREE indicators should an analyst monitor to identify a potential web server compromise?

Accepted Answer

Changes to web server configuration files. Web server compromises are often identified by changes in file integrity, unusual outbound traffic, and unexpected server-side process activity.

Answer

User password changes

Answer

Increased server RAM capacity

Question 10

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

Accepted Answer

Clear roles and responsibilities. An IRP must clearly define roles (who does what) and include communication plans (who to notify) to be effective during a crisis.

Answer

The company's marketing strategy

Answer

Inventory of printer models

Answer

List of all employee home addresses

Question 11

Which THREE types of data are typically found in a full forensic disk image?

Accepted Answer

File system metadata. Forensic images capture all data on the physical drive, including hidden partition data, slack space, and deleted files that have not yet been overwritten.

Answer

Live memory contents

Answer

Remote cloud storage files

Question 12

Which TWO documents are essential to provide to a forensic investigator?

Accepted Answer

Chain of Custody form. A proper chain of custody form and the incident timeline are critical for legal and forensic proceedings.

Answer

Employee employment contracts

Answer

Company organizational chart

Answer

The company's logo file

Question 13

Which THREE behaviors are characteristic of a potential data exfiltration attempt?

Accepted Answer

Traffic over non-standard ports. Data exfiltration is often characterized by unusual spikes in outbound traffic, use of non-standard ports, or connections to unusual or high-risk geographic locations.

Answer

Frequent screen locking

Answer

Increased local printer usage

Question 14

Which THREE phases of the incident response lifecycle involve the most interaction with stakeholders?

Accepted Answer

Preparation. The Preparation, Communication, and Post-Incident phases require heavy interaction with management, users, and external parties.

Answer

Detection and Analysis

Answer

Containment and Eradication

Question 15

Which TWO of the following are true regarding the use of hashing in digital forensics?

Accepted Answer

Hashes ensure data integrity. Hashing ensures data integrity and can be used to identify known files (e.g., system files) to filter them out of an investigation.

Answer

Hashes allow for data decryption

Answer

Hashes are the same as encryption

Answer

Hashes compress the data