CCOA Incident Detection And Response Practice Test 6 — 15 Questions

Question 1

Which TWO sources are used to populate threat intelligence feeds for incident detection?

Accepted Answer

Honeypot monitoring data. Threat intelligence feeds are compiled from observed malicious activity (honeypots, sensor networks) and security research.

Answer

Building maintenance schedules

Answer

Internal employee social media posts

Answer

Public weather reports

Question 2

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

Accepted Answer

Detection and Analysis. In NIST SP 800-61, the Detection and Analysis phase is where precursors (early warning signs) and indicators of compromise (IoCs) are identified, validated, and used to determine whether an incident has occurred. This phase covers monitoring, alert triage, and incident declaration. The other phases handle readiness, response actions, and review, not attack-signal identification.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 3

A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?

Accepted Answer

Perform a frequency analysis of connection time intervals. Beaconing is characterized by regular, periodic callbacks (e.g., every 60 seconds), so analyzing the distribution of inter-connection time intervals reveals the low-variance periodicity that distinguishes C2 traffic from normal user-driven traffic. Frequency analysis (e.g., via histograms, Fourier transforms, or standard deviation of intervals) surfaces this pattern even in high-volume PCAP/NetFlow data. Bandwidth, port entropy, and byte counts do not capture the temporal regularity that defines beaconing.

Answer

Identify top talkers by total bandwidth consumption

Answer

Filter connections by source port entropy

Answer

Calculate the mean of bytes transferred per session

Question 4

During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?

Accepted Answer

The EDR applies a restrictive host-based firewall policy. EDR network isolation works by applying a restrictive host-based firewall policy on the endpoint that blocks all network traffic except the EDR agent's own management channel. This allows the SOC to continue communicating with and controlling the endpoint while severing its connections to the attacker, lateral movement targets, and C2 infrastructure. The network interface remains up so the agent can receive commands and push telemetry.

Answer

The EDR clears the local ARP cache

Answer

The EDR shuts down the network interface completely

Answer

The EDR triggers a BIOS-level shutdown of the NIC

Question 5

A CISO asks for a list of indicators that should be monitored in the SIEM to detect potential account takeover attempts. Which THREE indicators are most relevant?

Accepted Answer

High volume of failed login attempts followed by a successful login. Option A is correct because a burst of failed authentication attempts immediately followed by a success is the classic brute-force or password-spraying pattern that signals a likely account takeover. Option C is correct because impossible travel detects credential compromise by correlating geographically distant logins within a timeframe that no legitimate user could physically traverse, a strong indicator of stolen credentials. Option D is correct because logins outside a user's established work hours are anomalous behavioral indicators that often accompany unauthorized access, especially when combined with other anomalies. Option B is not a reliable indicator because concurrent sessions from different operating systems can occur legitimately (e.g., a user with a laptop and phone) and lacks the geographic or temporal correlation needed to indicate takeover. Option E is not relevant because access from a known, trusted VPN range is expected legitimate behavior rather than a suspicious indicator.

Answer

Concurrent logins from different operating systems

Answer

Accessing the account from a known VPN IP range

Question 6

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

Accepted Answer

Resetting compromised user credentials. Eradication involves removing the root cause, such as cleaning malware or removing unauthorized user accounts.

Answer

Updating documentation for the incident report

Answer

Restoring data from a known good backup

Answer

Identifying the initial attack vector

Question 7

When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?

Accepted Answer

ssdt. The ssdt plugin (B) is correct because it parses the System Service Descriptor Table and compares the in-memory handler addresses against expected kernel functions, exposing hooks that kernel-mode rootkits use to intercept system calls. The modules plugin (D) is correct because it walks the kernel's loaded module list (PsLoadedModuleList) to reveal loaded drivers and kernel modules, allowing detection of suspicious or unlinked drivers typical of rootkits. pslist (A) only enumerates active processes from the process list and does not inspect kernel structures, so it is ineffective for kernel-mode rootkit detection. hashdump (C) extracts password hashes from the SAM, which is unrelated to identifying kernel rootkits. hivelist (E) lists registry hives in memory and does not analyze kernel code or driver integrity.

Answer

pslist

Answer

hashdump

Answer

hivelist

Question 8

A security analyst is reviewing a packet capture of an internal host that appears to be communicating with an external server. The analyst observes that the TCP three-way handshake completes successfully, but the session then becomes idle for approximately 30 seconds before a small application-layer message is sent. This pattern repeats consistently. Which type of malicious activity is most consistent with this behavior?

Accepted Answer

Command-and-control beaconing. The consistent idle periods followed by small periodic messages over established TCP connections strongly suggest command-and-control beaconing. Malware often uses such channels to receive instructions or exfiltrate small amounts of data while blending in with normal traffic. The other options do not match the observed pattern of established connections with low-volume periodic traffic.

Answer

Port scanning

Answer

TCP SYN flood attack

Answer

Data exfiltration via large file transfers

Question 9

A CCOA analyst is reviewing a suspected credential-stuffing incident against the organization's customer portal. The web server logs show thousands of POST requests to /login with varying usernames but originating from a rotating set of source IPs. The analyst needs to determine whether the activity is a distributed brute-force attack or normal user behavior. Which data source would BEST provide the authoritative evidence of failed authentication attempts across all application instances?

Accepted Answer

Application authentication logs. Authentication outcomes are only reliably recorded by the authentication service itself. Application authentication logs capture each login attempt with its result, username, and source, which is exactly what is needed to distinguish a credential-stuffing campaign from normal traffic. Network and endpoint sources lack the application-layer context to prove failed authentication.

Answer

Firewall session logs

Answer

Endpoint detection and response telemetry

Answer

Web server access logs

Question 10

A security operations center (SOC) analyst is triaging a potential endpoint compromise. The EDR console shows a suspicious process created by a Microsoft Word document that spawned a child process of 'powershell.exe' with the arguments '-nop -w hidden -enc JABjAGwAaQBlAG4AdA...'. The parent process has since exited. Which detection technique would best confirm whether this activity represents a true positive?

Accepted Answer

Decoding the Base64 PowerShell argument and examining the resulting script for known malicious behaviors such as downloading a payload or establishing a reverse shell.. The encoded PowerShell command is the core artifact. Decoding it reveals the actual script, and if that script performs clearly malicious actions such as downloading a payload or creating a reverse shell, the activity is confirmed as a true positive. Other options provide supporting evidence but do not definitively prove malicious intent in this scenario.

Answer

Reviewing the Windows Security event log for Event ID 4688 to identify the full command line of the PowerShell process and its parent process ID.

Answer

Inspecting the Windows Registry for persistence mechanisms added by the PowerShell process, such as a Run key entry.

Answer

Checking the Microsoft Word document's file hash against VirusTotal to see if any antivirus engines flag it as malicious.

Question 11

During an incident investigation, an analyst discovers that an attacker used a compromised service account to move laterally across multiple systems. The analyst needs to determine the extent of the compromise by identifying all systems where the account was used to authenticate. Which data source would be most effective for this purpose?

Accepted Answer

Windows Security event logs on each domain controller. Domain controller security logs capture authentication events, including the account name, logon type, and source workstation. These logs are essential for tracing lateral movement because they record where and how an account was used. Other sources lack user context or do not cover authentication events across the domain, making them less effective for this specific investigation.

Answer

Antivirus logs on each endpoint

Answer

NetFlow data collected from network devices

Answer

Firewall logs showing outbound connections

Question 12

During a suspected data exfiltration incident, a CCOA analyst observes that a workstation is sending DNS queries for subdomains such as 'a1b2c3d4e5.exfil.example.com'. The queries are small and occur at irregular intervals. The analyst wants to confirm DNS tunneling rather than normal DNS resolution. Which characteristic of the DNS traffic would MOST reliably indicate tunneling?

Accepted Answer

The subdomain labels contain high-entropy, encoded strings. DNS tunneling hides data in the query name, so the leftmost labels become encoded, high-entropy strings. Legitimate hostnames are human-readable and low entropy. Observing random-looking subdomains under an external domain, especially in repeated queries, is the most reliable signal that DNS is being abused as a covert exfiltration channel.

Answer

The queries are sent to the organization's internal recursive resolver

Answer

The authoritative name server responds with a long TTL

Answer

The queries use the UDP protocol on port 53

Question 13

A healthcare organization's incident response team is investigating a breach involving a compromised web server that may have exposed patient data. The team must determine the scope of the data exposure. Which of the following actions should be performed FIRST to preserve evidence while enabling analysis?

Accepted Answer

Capture a forensic image of the server's memory and disk before making any changes.. The first step in forensic investigation is to preserve evidence, following the order of volatility. Capturing memory and disk images ensures that all potential evidence is retained without alteration. This allows the team to analyze the incident thoroughly and determine the scope of data exposure, which is necessary for accurate notification and remediation.

Answer

Review web server access logs to identify the initial attack vector.

Answer

Immediately power off the web server to prevent further data exfiltration.

Answer

Notify the affected patients and regulatory authorities as required by HIPAA.

Question 14

A security operations center (SOC) analyst is triaging an alert indicating a potential phishing email that was delivered to several users. The analyst needs to determine if any user interacted with the malicious link. Which two data sources would be most directly useful for this determination? (Choose two.)

Accepted Answer

Endpoint detection and response (EDR) telemetry. Web proxy logs and EDR telemetry both provide direct evidence of user interaction with a link. Proxy logs show the outbound request to the malicious URL, while EDR captures the browser process and network connection on the endpoint. Together, they can confirm if a user clicked the link. Other sources lack the necessary user or process context to make that determination.

Answer

Firewall logs

Answer

Domain Name System (DNS) logs

Answer

Email gateway logs

Question 15

A CCOA analyst is triaging an alert from the SIEM indicating that a user account was added to the Domain Admins group outside of a change window. The analyst needs to determine whether this is a malicious privilege escalation or an authorized administrative action. Which immediate step BEST supports this determination?

Accepted Answer

Correlate the change with the change management system and the actor's identity. Privilege changes outside a change window are suspicious but not automatically malicious. The fastest way to resolve the ambiguity is to compare the event with change management records and identify the actor. If the change is authorized and documented, the alert can be closed; if not, it becomes a confirmed incident warranting containment.

Answer

Escalate the alert to the legal department for prosecution

Answer

Block all traffic from the source IP address of the change

Answer

Disable the user account and reset its password