CCOA Multiple Select — 30 Questions

Question 1

Which TWO of the following are primary functions of an Information Security Governance program?

Accepted Answer

Strategic alignment. Strategic alignment (A) is a primary function of Information Security Governance because governance ensures that security initiatives, investments, and controls are aligned with the organization's business objectives, strategy, and regulatory obligations. Risk management (D) is also a core governance function, as governance establishes the frameworks, policies, and oversight processes for identifying, assessing, treating, and monitoring information security risks at an enterprise level. Writing code (B) is a software development or engineering activity, not a governance function. Wiring network cables (C) is a physical infrastructure implementation task. Patching server OS (E) is an operational/technical vulnerability management activity, not a governance-level responsibility.

Answer

Writing code

Answer

Wiring network cables

Answer

Patching server OS

Question 2

A CCOA analyst is investigating a suspected insider threat involving unauthorized access to a file server. The analyst needs to correlate user activity with file access events. Which two log sources should the analyst prioritize? (Choose two.)

Accepted Answer

Active Directory authentication logs from domain controllers. To correlate user activity with file access, the analyst needs object access auditing events that identify the user and the file, and authentication logs that confirm the user's logon to the server. Together they establish who accessed what and from where. System, proxy, and firewall logs lack the necessary user-to-file mapping for this investigation.

Answer

Web proxy logs showing internet browsing activity

Answer

Firewall logs showing allowed and denied connections between network segments

Answer

File server system logs showing disk errors and hardware faults

Question 3

Which TWO of the following are examples of 'Initial Access' tactics?

Accepted Answer

Phishing. In the MITRE ATT&CK framework, Initial Access consists of techniques that adversaries use to gain an entry point into a network, and Phishing (B) is a canonical example because it delivers malicious content via email, links, or attachments to compromise a user's credentials or execute code. Exploiting public-facing applications (D) is also an Initial Access technique (T1190), since it leverages vulnerabilities in internet-exposed services such as web servers or VPN gateways to establish a foothold. Registry modification (A) is a Defense Evasion/Persistence technique, not Initial Access, because it occurs after the adversary already has access. Screen capture (C) is a Collection technique used to gather data from an already-compromised host. Network scanning (E) is Discovery (or Reconnaissance), used to enumerate targets rather than to gain initial entry.

Answer

Registry modification

Answer

Screen capture

Answer

Network scanning

Question 4

Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?

Accepted Answer

Activate the data breach response plan. Option B is correct because once an incident is confirmed to involve sensitive PII, the organization's data breach response plan must be activated to guide containment, investigation, notification, and remediation steps in a consistent, compliant manner. Option E is correct because legal counsel must be notified promptly so they can assess regulatory notification obligations (e.g., GDPR, HIPAA, state breach laws), preserve privilege, and advise on liability and disclosure requirements. The unmarked options do not belong: changing all company Wi-Fi passwords (A) is an unrelated blanket action that does not address the PII breach, posting an intranet message (C) is a communication step that could prematurely disclose information and is not a required response action, and deleting all user databases (D) would destroy evidence and potentially worsen the breach rather than contain it.

Answer

Change all company Wi-Fi passwords

Answer

Post a message on the company intranet

Answer

Delete all user databases

Question 5

A threat hunter is reviewing logs for signs of adversary reconnaissance. Which TWO of the following activities are considered Discovery techniques in the MITRE ATT&CK framework? (Choose two.)

Accepted Answer

Running 'net user /domain' to list domain users. The correct answers are running 'net user /domain' and using 'netstat -ano' because both are Discovery techniques that gather information about users and network connections. The other options are Persistence, Credential Access, and Defense Evasion, which serve different purposes in the attack lifecycle.

Answer

Creating a scheduled task to run a payload at logon

Answer

Using 'wevtutil cl' to clear Windows event logs

Answer

Dumping LSASS memory to extract credentials

Question 6

Which THREE types of network logs are most effective for identifying a data breach?

Accepted Answer

Web proxy logs. Network logs (NetFlow, DNS, Proxy) provide visibility into communication patterns that reveal unauthorized data transfers.

Answer

DHCP lease logs

Answer

Printer queue logs

Question 7

You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?

Accepted Answer

Successful and failed login attempts.. Option A is correct because logging both successful and failed login attempts is essential for detecting brute-force attacks, credential stuffing, and unauthorized access, and it provides the audit trail required by standards such as PCI DSS, HIPAA, and SOX. Option B is correct because changes to user privileges or schema via commands like GRANT, REVOKE, ALTER, or DROP can indicate privilege escalation or tampering, and tracking them is a core compliance requirement for change auditing. Option E is correct because large-scale data exports or queries against sensitive tables can signal data exfiltration or insider threats, and monitoring them supports both breach detection and regulatory reporting. Option C does not belong because server hardware temperature is an infrastructure/availability metric, not a security or compliance event. Option D does not belong because the number of active sessions in a connection pool is a performance and capacity metric, not evidence of malicious activity or a compliance-relevant audit event.

Answer

The specific hardware temperature of the server.

Answer

The number of active user sessions in the connection pool.

Question 8

A security operations center (SOC) is implementing network segmentation to protect critical assets. Which TWO of the following are essential components of a secure segmented network design? (Choose two.)

Accepted Answer

Using VLANs to logically separate network traffic. Secure network segmentation requires both logical separation and enforcement of access controls. VLANs provide the logical separation, while firewalls between segments enforce policies to restrict traffic. Together, they limit lateral movement and protect critical assets. Flat topologies, endpoint-only protection, and promiscuous mode do not achieve segmentation and may introduce risks.

Answer

Enabling promiscuous mode on all switches to monitor traffic

Answer

Implementing a flat network topology to simplify management

Answer

Relying solely on endpoint antivirus for protection

Question 9

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

Accepted Answer

Disabling unused modules (e.g., WebDAV, directory listing) in the web server configuration.. Option D is correct because endpoint hardening of a web service requires reducing the attack surface by disabling unnecessary features such as WebDAV, autoindex/directory listing, and other unused modules in the web server configuration (e.g., Apache's LoadModule directives or IIS role services), which eliminates known vectors for information disclosure and exploitation. Option E is correct because default welcome pages, sample scripts, and demo applications (e.g., IIS iisstart.htm or Apache's default index) are well-known fingerprints and often contain vulnerabilities, so removing them is a standard hardening step. Option A is incorrect because changing a wallpaper is cosmetic and has no security impact on the web service. Option B is incorrect because auto-restarting every 10 minutes does not harden the service and could actually cause availability problems. Option C is incorrect because adding RAM is a performance/capacity upgrade, not a security hardening measure.

Answer

Changing the administrator's wallpaper to the company logo.

Answer

Configuring the server to auto-restart every 10 minutes.

Answer

Replacing the server's RAM with larger capacity sticks.

Question 10

Which THREE of the following are common 'Exfiltration' techniques?

Accepted Answer

Exfiltration over alternative protocol. Exfiltration over alternative protocol (A) is correct because attackers commonly move stolen data out of a network using protocols other than the primary C2 channel, such as DNS, FTP, SMTP, or ICMP, to evade detection and blend with legitimate traffic. Exfiltration over C2 channel (C) is correct because the same command-and-control channel already established for remote access is frequently reused to transfer collected data out of the environment, often encoded or tunneled within the C2 traffic. Exfiltration to cloud storage (E) is correct because adversaries increasingly upload data to legitimate cloud services (e.g., Dropbox, Google Drive, OneDrive) using APIs or web protocols, which can bypass traditional perimeter controls and appear as normal user activity. Keylogging (B) is not an exfiltration technique but a collection technique, as it captures keystrokes for later theft rather than moving data off the system. File system enumeration (D) is also not exfiltration; it is a discovery technique used to identify files and directories of interest before collection or staging occurs.

Answer

Keylogging

Answer

File system enumeration

Question 11

A security operations center is establishing a baseline for privileged account management across its server estate. The team must reduce the risk that compromised administrative credentials lead to widespread lateral movement. Which TWO controls should the team implement to directly limit the blast radius of a compromised privileged account? (Choose two.)

Accepted Answer

Enforce just-in-time elevation so administrative rights are granted only for the duration of an approved task. Blast radius is bounded by how much authority a stolen credential carries and for how long. Just-in-time elevation compresses the window in which administrative rights exist, and separating administrative accounts from daily-use identities prevents routine credential theft from yielding privilege. Password length, disk encryption, and antivirus all improve general security posture but none of them restrict what a valid privileged credential can reach once it is in an attacker's hands.

Answer

Increase the minimum password length for all accounts to 20 characters

Answer

Deploy a signature-based antivirus agent on every server

Answer

Enable full-disk encryption on all administrator workstations

Question 12

Which TWO of the following are considered 'Technical' controls?

Accepted Answer

Firewall configuration. Technical controls (logical controls) are implemented via software, hardware, or firmware.

Answer

Background checks

Answer

Security policy documentation

Answer

Guard patrol

Question 13

A security operations center (SOC) analyst is triaging an alert indicating a potential phishing email that was delivered to several users. The analyst needs to determine if any user interacted with the malicious link. Which two data sources would be most directly useful for this determination? (Choose two.)

Accepted Answer

Endpoint detection and response (EDR) telemetry. Web proxy logs and EDR telemetry both provide direct evidence of user interaction with a link. Proxy logs show the outbound request to the malicious URL, while EDR captures the browser process and network connection on the endpoint. Together, they can confirm if a user clicked the link. Other sources lack the necessary user or process context to make that determination.

Answer

Firewall logs

Answer

Domain Name System (DNS) logs

Answer

Email gateway logs

Question 14

A security analyst is conducting a qualitative risk assessment for a new cloud-based customer relationship management (CRM) system. The team wants to prioritize risks without assigning monetary values. Which TWO factors are most relevant when using a qualitative risk matrix? (Choose two.)

Accepted Answer

Impact or severity to business operations if the risk materializes. Qualitative risk matrices rank risks by combining likelihood and impact using descriptive scales. These two factors allow prioritization without monetary calculations. ALE, NPV, and ROSI are quantitative or financial metrics that require monetary inputs, so they fall outside the scope of a qualitative assessment focused on relative ranking.

Answer

Net present value (NPV) of the CRM investment

Answer

Return on security investment (ROSI) percentage

Answer

Annualized loss expectancy (ALE) in monetary terms

Question 15

A CCOA analyst is establishing a risk appetite statement for a hospital network that must balance patient safety, regulatory obligations under HIPAA, and operational availability of clinical systems. Which TWO characteristics must the risk appetite statement exhibit to be considered effective by ISACA risk governance principles? (Choose two.)

Accepted Answer

It is expressed in qualitative and quantitative terms tied to measurable thresholds. Effective risk appetite statements are measurable and executive-owned. Measurable thresholds let decision-makers judge whether a specific exposure sits inside or outside tolerance, while executive and board ownership ensures appetite reflects strategy and regulatory duty. For a hospital, that combination properly weights patient safety and HIPAA obligations against availability and cost trade-offs.

Answer

It is kept confidential and shared only with the security operations team

Answer

It eliminates all residual risk across clinical and administrative systems

Answer

It is revised annually regardless of changes in business strategy

Question 16

A manufacturing company is building a hardened baseline for its industrial control system (ICS) engineering workstations, which run Windows and connect to programmable logic controllers on the plant floor. The security team must reduce the attack surface without disrupting production. Which two controls are most appropriate to include in the baseline for these workstations? (Choose two.)

Accepted Answer

Disabling USB mass storage and restricting removable media to approved, scanned devices. ICS engineering workstations require compensating controls because patching is constrained by vendor certification and production uptime. Application allowlisting restricts execution to approved engineering and HMI software, and disabling USB mass storage with controlled, scanned media blocks a common infection path. Automatic untested updates, consumer antivirus, and unrestricted utility installation all introduce availability or integrity risk and do not belong in the baseline.

Answer

Enabling automatic operating system updates that install immediately without testing

Answer

Installing consumer antivirus software with aggressive heuristic scanning on all engineering hosts

Answer

Allowing engineers to install any utility from the internet to troubleshoot PLC connectivity

Question 17

A security operations analyst is building a data classification and handling standard for a new document management platform that stores contracts, HR records, and public marketing collateral. The analyst must define controls that apply to the highest sensitivity tier. Which TWO actions are appropriate for assets classified at the highest sensitivity level? (Choose two.)

Accepted Answer

Enforce least privilege with role-based access and log all access to the sensitive repositories for monitoring.. The highest sensitivity tier demands controls that both protect and monitor the data. Encrypting at rest and in transit with governed keys protects confidentiality, while least-privilege role-based access plus comprehensive logging limits and detects misuse. Reusing public access rules, allowing unmanaged local copies, or relying on documentation alone all fail to contain the risk that top-tier classification implies.

Answer

Apply the same access control policy used for public marketing collateral to simplify administration.

Answer

Allow users to store local copies on unmanaged endpoints to improve productivity during contract negotiations.

Answer

Publish the classification labels in a public wiki so all staff understand how data is tagged.

Question 18

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

Accepted Answer

Revoke all active sessions/tokens. Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).

Answer

Upgrade the user's OS

Answer

Block the user's physical building access

Answer

Delete the user's home directory

Question 19

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered two days ago. The analyst needs to perform dynamic analysis of the URL to determine if it leads to a malicious payload. Which two actions should the analyst take to safely analyze the URL and gather threat intelligence? (Choose two.)

Accepted Answer

Query threat intelligence platforms for the domain's reputation and associated indicators of compromise.. Submitting the URL to a sandbox allows safe dynamic analysis, recording network traffic and file downloads to identify malicious behavior. Querying threat intelligence platforms provides reputation and associated indicators without direct interaction. Together, these actions safely determine if the URL is malicious and gather actionable intelligence.

Answer

Use a web browser on the analyst's workstation to visit the URL and inspect the page content.

Answer

Perform a WHOIS lookup to obtain the registrar and registrant details of the domain.

Answer

Run a command-line tool like curl to download the URL's content to the analyst's workstation for inspection.

Question 20

Which TWO sources are used to populate threat intelligence feeds for incident detection?

Accepted Answer

Honeypot monitoring data. Threat intelligence feeds are compiled from observed malicious activity (honeypots, sensor networks) and security research.

Answer

Building maintenance schedules

Answer

Internal employee social media posts

Answer

Public weather reports