CCOA Incident Detection And Response Practice Test 5 — 15 Questions

Question 1

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Accepted Answer

Revoke all active sessions/tokens. Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).

Answer

Upgrade the user's OS

Answer

Block the user's physical building access

Answer

Delete the user's home directory

Question 2

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

Accepted Answer

To preserve volatile evidence in RAM. Turning off the machine clears the RAM, which contains volatile evidence that is critical for incident analysis.

Answer

To allow the attacker to keep working

Answer

Because the OS might crash

Answer

To save electricity

Question 3

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

Accepted Answer

Firewall logs. SIEMs ingest data from various layers including identity providers, network infrastructure, and endpoint monitoring tools to provide comprehensive visibility.

Answer

Employee payroll spreadsheets

Answer

Kitchen appliance status reports

Question 4

Which TWO tools are commonly used for memory forensic analysis?

Accepted Answer

Rekall. Rekall (A) is a memory forensics framework derived from Volatility that analyzes RAM captures (e.g., raw, crash dump, hibernation files) to extract processes, network connections, and injected code, making it a standard memory-analysis tool. Volatility (D) is the most widely used open-source memory forensics framework, supporting plugins like pslist, netscan, and malfind against memory images to reconstruct system state. Nmap (B) is a network port scanner used for host discovery and service enumeration, not memory analysis. Hashcat (C) is a password-recovery tool that performs GPU-accelerated hash cracking, unrelated to parsing memory images. Wireshark (E) is a packet analyzer for capturing and inspecting network traffic (pcap), not volatile memory contents.

Answer

Nmap

Answer

Hashcat

Answer

Wireshark

Question 5

Which THREE indicators should an analyst monitor to identify a potential web server compromise?

Accepted Answer

Changes to web server configuration files. Option A is correct because unauthorized modifications to web server configuration files (e.g., httpd.conf, nginx.conf, .htaccess) often indicate an attacker altering server behavior, adding malicious redirects, or enabling backdoors. Option B is correct because unauthorized outbound network connections from a web server can signal command-and-control (C2) traffic, data exfiltration, or reverse shells established by an attacker after compromise. Option D is correct because new files appearing in web root directories (e.g., /var/www/html) frequently represent web shells, defacement pages, or uploaded malware used to maintain persistence or execute arbitrary code. Option C is not a reliable web server compromise indicator because user password changes typically relate to identity or account management events rather than server-level intrusion activity. Option E is not a valid indicator because increased RAM capacity refers to a hardware upgrade, not a security event; memory utilization anomalies, not capacity, might be relevant.

Answer

User password changes

Answer

Increased server RAM capacity

Question 6

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

Accepted Answer

Clear roles and responsibilities. An IRP must clearly define roles (who does what) and include communication plans (who to notify) to be effective during a crisis.

Answer

The company's marketing strategy

Answer

Inventory of printer models

Answer

List of all employee home addresses

Question 7

Which THREE types of data are typically found in a full forensic disk image?

Accepted Answer

File system metadata. A full forensic disk image captures the entire contents of a storage device bit-for-bit, so it includes file system metadata such as the MFT on NTFS, inodes on ext4, directory entries, timestamps, and allocation bitmaps (Option A). Because the image is a bit-level copy of all sectors, it also preserves deleted files whose data clusters and metadata entries have not yet been overwritten, which is essential for forensic recovery (Option B). The same bit-for-bit capture extends across the whole physical disk, including hidden or non-standard partitions, unallocated space, slack space, and partition tables, so hidden partitions are included (Option D). Live memory contents (Option C) reside in RAM and are acquired through memory forensics tools like Volatility or LiME, not from a disk image. Remote cloud storage files (Option E) exist on external providers' servers and are not present on the local disk unless cached or synced, so they are not part of a disk image.

Answer

Live memory contents

Answer

Remote cloud storage files

Question 8

Which TWO documents are essential to provide to a forensic investigator?

Accepted Answer

Chain of Custody form. The Chain of Custody form (C) is essential because it documents who collected, handled, transferred, and accessed each piece of evidence, along with timestamps and signatures, which preserves the evidence's integrity and admissibility in legal or disciplinary proceedings. The Incident timeline (D) is essential because it establishes the chronological sequence of events—detection, containment, eradication, and recovery—allowing the investigator to correlate system logs, user activity, and forensic artifacts to reconstruct exactly what happened and when. Together these two documents give the investigator both the evidentiary provenance and the temporal context needed for a defensible forensic report. The remaining options do not belong: employee employment contracts (A) and the company organizational chart (B) are HR/administrative records that may help identify personnel but are not core forensic artifacts, and the company's logo file (E) is irrelevant branding material with no investigative value.

Answer

Employee employment contracts

Answer

Company organizational chart

Answer

The company's logo file

Question 9

Which THREE behaviors are characteristic of a potential data exfiltration attempt?

Accepted Answer

Traffic over non-standard ports. Option C is correct because data exfiltration often uses non-standard ports (e.g., TCP 4444, 8080, or 53 tunneling) to bypass firewall rules that typically only monitor well-known ports like 80 and 443. Option D is correct because connections to high-risk geographic regions (e.g., IPs geolocated in countries with weak cybercrime laws) are a common indicator of compromise, as attackers frequently route stolen data through infrastructure in those areas. Option E is correct because large data transfers to external IPs — especially volumetric spikes in outbound traffic to unfamiliar public addresses — directly signal bulk data being moved outside the organization. Option A is not correct because frequent screen locking is a physical security/endpoint policy behavior, not a network exfiltration indicator. Option B is not correct because increased local printer usage is an insider-threat or document-handling concern, not a characteristic of network-based data exfiltration.

Answer

Frequent screen locking

Answer

Increased local printer usage

Question 10

Which TWO of the following are true regarding the use of hashing in digital forensics?

Accepted Answer

Hashes ensure data integrity. Option B is correct because cryptographic hash functions such as SHA-256 or MD5 produce a fixed-length digest that changes if even a single bit of the evidence changes, so comparing pre- and post-acquisition hashes verifies that the data has not been altered, which is the core of forensic data integrity. Option C is correct because a hash value acts as a unique fingerprint of file content, allowing investigators to match hashes against reference sets like the NSRL RDS to quickly identify known files (e.g., known-good system files or known-bad malware) without examining each file manually. Option A is incorrect because hashing is a one-way function and cannot be reversed to recover plaintext; decryption requires the appropriate key and cipher. Option D is incorrect because hashing is not encryption: encryption is reversible with a key, whereas hashing is irreversible and used for integrity and identification, not confidentiality. Option E is incorrect because hash functions do not compress data; they map arbitrary-length input to a fixed-length digest and the original data cannot be reconstructed from the hash.

Answer

Hashes allow for data decryption

Answer

Hashes are the same as encryption

Answer

Hashes compress the data

Question 11

Which THREE types of network logs are most effective for identifying a data breach?

Accepted Answer

Web proxy logs. Network logs (NetFlow, DNS, Proxy) provide visibility into communication patterns that reveal unauthorized data transfers.

Answer

DHCP lease logs

Answer

Printer queue logs

Question 12

Which THREE techniques do attackers use to maintain persistence on a Windows host?

Accepted Answer

Installing a malicious system service. Persistence is maintained by registering code with startup processes (Registry), system services, or scheduled tasks.

Answer

Changing the desktop background

Answer

Updating the browser's homepage

Question 13

Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?

Accepted Answer

Activate the data breach response plan. Option B is correct because once an incident is confirmed to involve sensitive PII, the organization's data breach response plan must be activated to guide containment, investigation, notification, and remediation steps in a consistent, compliant manner. Option E is correct because legal counsel must be notified promptly so they can assess regulatory notification obligations (e.g., GDPR, HIPAA, state breach laws), preserve privilege, and advise on liability and disclosure requirements. The unmarked options do not belong: changing all company Wi-Fi passwords (A) is an unrelated blanket action that does not address the PII breach, posting an intranet message (C) is a communication step that could prematurely disclose information and is not a required response action, and deleting all user databases (D) would destroy evidence and potentially worsen the breach rather than contain it.

Answer

Change all company Wi-Fi passwords

Answer

Post a message on the company intranet

Answer

Delete all user databases

Question 14

Which THREE factors should be considered when assessing the severity of a security incident?

Accepted Answer

Scope of the affected systems. Option A (Scope of the affected systems) is correct because severity scales with how many hosts, accounts, or network segments are involved—a single workstation compromise is far less severe than domain-wide or multi-site impact. Option C (Sensitivity of compromised data) is correct because the classification of the data (e.g., PII, PHI, credentials, trade secrets) drives regulatory, legal, and privacy consequences under frameworks like GDPR, HIPAA, or PCI DSS. Option D (Business impact) is correct because severity must reflect the effect on critical services, revenue, safety, and operations, which is why incident response frameworks such as NIST SP 800-61 assess functional and informational impact. Option B (day of the week) does not belong because timing may influence response logistics but is not a severity criterion, and Option E (analyst's personal opinion) is invalid because severity must be determined by objective, repeatable criteria rather than subjective judgment.

Answer

The day of the week the incident occurred

Answer

The analyst's personal opinion

Question 15

Which THREE steps are part of the 'Preparation' phase of incident response?

Accepted Answer

Defining security policies. Option A (Defining security policies) is correct because the Preparation phase establishes the governance foundation—policies, procedures, and playbooks—that dictate how incidents will be detected, escalated, and handled before any event occurs. Option D (Training the incident response team) is correct because personnel readiness through regular training and exercises is a core Preparation activity that ensures the team can execute the plan effectively. Option E (Acquiring necessary forensic tools) is correct because provisioning and maintaining tools such as disk imagers, memory capture utilities, and network analysis software must be done ahead of time so responders are equipped when an incident strikes. Option B (Recovering from the incident) belongs to the Containment, Eradication, and Recovery phase, and Option C (Analyzing the log files) is part of the Detection and Analysis phase, so neither is a Preparation step.

Answer

Recovering from the incident

Answer

Analyzing the log files