CCOA Incident Detection And Response Practice Test 7 — 15 Questions

Question 1

A security operations center (SOC) analyst receives an alert from the SIEM indicating that a domain controller has generated a high volume of Kerberos ticket-granting service (TGS) requests using RC4 encryption, with service principal names (SPNs) that do not exist. The analyst suspects a Kerberoasting attack. Which artifact should the analyst collect first to confirm the attack and identify the targeted service accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Security event ID 4769 with encryption type 0x17 (RC4-HMAC) and failure code 0x0. Kerberoasting is confirmed by examining Kerberos service ticket requests. Event ID 4769 with RC4 encryption (0x17) and success code 0x0 reveals that a service ticket was issued using weak encryption, which attackers can crack offline. The SPNs in these events identify the targeted service accounts, allowing the analyst to scope the attack and remediate affected accounts. Other events do not provide this specific detail.

Answer

Windows Security event ID 4771 with failure code 0x18 and client address of the requesting host

Answer

Windows Security event ID 4768 with ticket options 0x40810010 and encryption type 0x12

Answer

Windows Security event ID 4624 with logon type 3 and authentication package Kerberos

Question 2

A security analyst notices that a user's workstation is repeatedly connecting to an external IP address every 60 seconds, sending small amounts of data. The traffic pattern is consistent and occurs even when the user is not actively working. Which type of malware behavior is most likely indicated?

Accepted Answer

A botnet command-and-control beacon.. The consistent, periodic connections to an external IP with small data payloads are a classic sign of malware beaconing to a command-and-control server. This behavior allows attackers to maintain control over the compromised system and receive instructions, often while evading detection by blending in with normal traffic.

Answer

A keylogger exfiltrating keystrokes in real time.

Answer

Ransomware encrypting files in the background.

Answer

A worm spreading to other systems on the network.

Question 3

A CCOA analyst is responding to an incident involving a compromised web server that is part of a load-balanced cluster. The analyst needs to preserve volatile evidence before the server is rebooted for remediation. Which TWO actions should the analyst perform to capture volatile data? (Choose two.)

Accepted Answer

Export the current network connection table and running process list. Volatile data such as memory contents, network connections, and running processes disappears when a system is powered off or rebooted. Capturing physical memory with a validated tool and exporting the live connection and process tables preserves the most perishable evidence. Disk imaging and log review are important but can occur after the system is taken down.

Answer

Create a full forensic image of the server's disk drives

Answer

Review the web server access logs stored on the server

Answer

Document the chain of custody for the server hardware

Question 4

An analyst is reviewing a security incident and needs to determine the order of events. The analyst has collected logs from various sources with different timestamp formats and time zones. Which action should the analyst take first to ensure an accurate timeline?

Accepted Answer

Normalize all timestamps to a common time zone and format. To build an accurate timeline, all timestamps must be converted to a common time zone and format, typically UTC. This allows events from different systems to be placed in the correct chronological order. Without normalization, the analyst might misinterpret the sequence, leading to incorrect root cause analysis. Other actions like sorting by severity or filtering are secondary to this essential step.

Answer

Sort the logs by the severity of the events

Answer

Filter out logs from untrusted sources

Answer

Correlate events based on the source IP address

Question 5

A CCOA analyst receives an alert that the account 'svc_backup' performed an interactive logon (Type 2) to a domain controller at 02:17. The account is normally used only for scheduled backup jobs. The analyst needs to determine whether this is a credential misuse incident. Which Windows event should the analyst examine first to confirm the logon type and source workstation?

Accepted Answer

Event ID 4624 in the Security log. The analyst needs to confirm an interactive logon by a service account and identify its source. Successful logon events in the Security log capture logon type and source network address, which directly supports this determination. Other events describe process, Kerberos, or share activity and would require additional correlation without answering the core question.

Answer

Event ID 4769 in the Security log

Answer

Event ID 5140 in the Security log

Answer

Event ID 4688 in the Security log

Question 6

A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?

Accepted Answer

Documenting a clear chain of custody for the forensic image from creation to presentation. Chain of custody is the most critical element for admissibility because it provides a chronological record of the evidence's handling, ensuring that it has not been altered or compromised. While encryption, write blockers, and hashing support integrity and confidentiality, they do not replace the need to document who accessed the evidence and under what circumstances. A complete chain of custody allows the court to trust the evidence's authenticity.

Answer

Generating a hash value of the forensic image and storing it separately from the image

Answer

Using a write blocker during imaging to prevent modification of the original disk

Answer

Encrypting the forensic image with a strong algorithm and storing the key in a secure vault

Question 7

A security analyst is investigating a suspected data breach and needs to determine if sensitive data was exfiltrated. The analyst has access to full packet capture (PCAP) data from the network perimeter. Which technique would be most effective for identifying large outbound data transfers?

Accepted Answer

Analyze the PCAP for TCP sessions with large data volumes from internal to external hosts. Full packet capture allows the analyst to reconstruct sessions and measure the volume of data sent from internal to external hosts. By analyzing outbound TCP sessions for large data volumes, the analyst can identify potential exfiltration. Other methods like DNS logs or firewall logs do not provide the necessary data volume context, and IDS alerts may not catch all exfiltration attempts.

Answer

Examine firewall logs for denied outbound connections

Answer

Check IDS alerts for known malware signatures

Answer

Review DNS query logs for unusual domain names

Question 8

During incident response for a suspected data exfiltration, the team captures full packet data at the perimeter. The CCOA analyst needs to determine whether large outbound transfers occurred over an encrypted channel that cannot be inspected. Which network flow artifact should the analyst use to identify the volume and duration of the transfers while preserving the ability to correlate with other logs?

Accepted Answer

NetFlow records exported from the perimeter router. Flow records provide the metadata needed to quantify outbound transfer volume and duration without decrypting payloads. They are lightweight, widely retained, and easily correlated with other telemetry, making them the right artifact for this encrypted-traffic scenario. Full packet capture is less efficient for volume analysis, while DNS and proxy logs address different aspects.

Answer

DNS query logs from the internal resolver

Answer

Full packet capture analyzed with a protocol analyzer

Answer

Proxy access logs with HTTP status codes

Question 9

A financial institution's SOC is investigating a suspected data exfiltration incident. The team has collected network flow data, proxy logs, and endpoint logs. Which two of the following indicators are MOST indicative of data exfiltration over a covert channel? (Choose two.)

Accepted Answer

Large outbound data transfers to an external IP address during non-business hours. Large outbound transfers during off-hours and frequent DNS queries with long random subdomains are both strong indicators of covert exfiltration. The former suggests bulk data movement, while the latter indicates DNS tunneling used to sneak data past perimeter defenses. Other options describe authentication attacks, inbound traffic, or C2 communication, which are not direct evidence of data leaving the network via a covert channel.

Answer

Multiple failed login attempts from an internal host to a domain controller

Answer

Repeated connections to a known command-and-control server on port 443

Answer

A sudden increase in inbound HTTPS traffic to a web server

Question 10

A CCOA analyst is triaging an alert about a workstation that repeatedly contacts a known malicious IP address. The analyst wants to quickly block further communication from that host while preserving volatile evidence for later analysis. Which action best meets both goals?

Accepted Answer

Isolate the endpoint using the EDR console and capture a memory image before remediation. The goal is to stop communication while preserving volatile evidence. EDR isolation achieves network containment without powering off the host, and memory capture retains critical artifacts before remediation. Powering off, disabling accounts, or blocking a single IP either destroys evidence or fails to contain the host comprehensively.

Answer

Immediately power off the workstation to prevent further malicious activity

Answer

Add the malicious IP to the firewall blocklist at the perimeter

Answer

Disable the user's Active Directory account and reset the password

Question 11

A security analyst is reviewing the Incident Response Plan (IRP) and notices that it lacks a defined communication protocol for notifying external stakeholders during a breach. Which phase of the incident response lifecycle does this gap primarily affect?

Accepted Answer

Preparation. The preparation phase encompasses all proactive measures, including developing communication plans for internal and external stakeholders. A missing protocol means the organization is unprepared to notify regulators, customers, or partners efficiently during a breach. This gap directly impacts the ability to meet legal and contractual obligations, which should be addressed before an incident occurs.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Detection and Analysis

Question 12

A security analyst is investigating a suspected insider threat. The analyst has collected volatile data from a suspect's workstation, including running processes, network connections, and logged-in users. Which of the following should the analyst do NEXT to maintain the integrity of the evidence for potential legal proceedings?

Accepted Answer

Create a forensic image of the workstation's hard drive and document the chain of custody.. After collecting volatile data, the analyst must preserve non-volatile evidence by creating a forensic image of the hard drive and documenting the chain of custody. This ensures that the evidence remains unaltered and admissible in legal proceedings. Other actions like interviewing the suspect or running scans could compromise the investigation.

Answer

Review the suspect's email and file access logs to determine motive.

Answer

Run antivirus scans on the workstation to check for malware that might explain the activity.

Answer

Immediately interview the suspect to obtain a confession.

Question 13

A CCOA analyst is investigating a suspected insider threat involving unauthorized access to a file server. The analyst needs to correlate user activity with file access events. Which two log sources should the analyst prioritize? (Choose two.)

Accepted Answer

Active Directory authentication logs from domain controllers. To correlate user activity with file access, the analyst needs object access auditing events that identify the user and the file, and authentication logs that confirm the user's logon to the server. Together they establish who accessed what and from where. System, proxy, and firewall logs lack the necessary user-to-file mapping for this investigation.

Answer

Web proxy logs showing internet browsing activity

Answer

Firewall logs showing allowed and denied connections between network segments

Answer

File server system logs showing disk errors and hardware faults

Question 14

A threat hunter is analyzing endpoint telemetry and notices a process that has established a network connection to an external IP address. The process is running from a temporary directory, has no digital signature, and its parent process is a known vulnerable service. Which of the following techniques is MOST consistent with this behavior?

Accepted Answer

Exploitation of a vulnerable service to drop and execute a payload. The combination of a vulnerable parent service, an unsigned child process in a temporary directory, and an external network connection strongly indicates exploitation followed by payload execution. Attackers often exploit services like web servers or SMB to drop tools in writable directories and establish command-and-control. This behavior is less consistent with LOLBin abuse, process injection, or legitimate scheduled tasks, which have different signatures.

Answer

Living-off-the-land binary (LOLBin) execution

Answer

Process injection into a trusted process

Answer

Scheduled task created by a legitimate application

Question 15

A CCOA analyst is leading the lessons learned review after a major incident. The team wants to improve future detection and response. Which output of the lessons learned phase is most directly used to update detection capabilities?

Accepted Answer

Revised detection rules and indicators based on observed attacker techniques. The lessons learned phase should produce actionable improvements, and detection enhancements are a primary output. Translating observed attacker techniques into revised rules and indicators directly strengthens future detection. Personnel lists, asset inventories, and executive summaries serve other purposes and do not update detection logic.

Answer

A list of all personnel who participated in the incident response

Answer

An updated asset inventory with hardware serial numbers

Answer

A summary of the incident timeline for executive reporting