CCOA Multiple Select — 40 Questions

Question 1

Which THREE of the following are 'Command and Control' techniques?

Accepted Answer

Standard application layer protocol. Web service protocols, non-standard port traffic, and standard application layer protocols are all C2 channels.

Answer

Registry modification

Answer

Credential dumping

Question 2

Which TWO of the following are examples of 'Persistence' tactics?

Accepted Answer

Scheduled tasks. Creating scheduled tasks and adding items to the Startup folder are standard ways to ensure malware survives reboot.

Answer

Credential dumping

Answer

Port scanning

Answer

Data encryption

Question 3

Which THREE of the following are 'Privilege Escalation' techniques?

Accepted Answer

Exploitation for privilege escalation. Exploiting system software, abusing user accounts, and using local security exploits are common escalation vectors.

Answer

File discovery

Answer

Network exfiltration

Question 4

Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?

Accepted Answer

SIEM log analysis. Detection focus on identifying anomalies and security events continuously.

Answer

System hardening

Answer

Backups

Answer

Firewall blocking

Question 5

Which THREE of the following are considered 'Execution' techniques?

Accepted Answer

User Execution. Command scripting, binary execution, and scheduled task execution are all ways to start code.

Answer

Account discovery

Answer

Registry persistence

Question 6

Which THREE of the following are common 'Impact' techniques?

Accepted Answer

Data encrypted for impact. Data destruction, ransomware encryption, and service disruption are all forms of impact.

Answer

Credential access

Answer

Persistence setup

Question 7

Which TWO of the following are examples of 'Initial Access' tactics?

Accepted Answer

Phishing. Phishing and exploiting public-facing applications are two common ways to gain the first foothold in an environment.

Answer

Registry modification

Answer

Screen capture

Answer

Network scanning

Question 8

Which THREE of the following are considered 'Collection' techniques?

Accepted Answer

Screen capture. Screen capture, audio capture, and file collection are all ways to steal data.

Answer

File and directory discovery

Answer

Network scanning

Question 9

Which TWO of the following are examples of 'Discovery' techniques?

Accepted Answer

System owner/user discovery. Enumerating network shares and identifying current user context are discovery actions.

Answer

Data exfiltration

Answer

Process injection

Answer

System reboot

Question 10

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Accepted Answer

SMB/Admin shares. Remote services like RDP and SMB/Admin shares are primary mechanisms for moving laterally.

Answer

DNS query analysis

Answer

Registry key editing

Answer

Keystroke logging

Question 11

Which THREE actions are essential to the 'Identify' function of the NIST CSF?

Accepted Answer

Risk management strategy. Identify covers inventory, risk management, and governance.

Answer

Malware scanning

Answer

Incident recovery time analysis

Question 12

Which THREE items are typically included in a formal Risk Register?

Accepted Answer

Mitigation status. A risk register tracks risks, including their probability, impact, and mitigation status.

Answer

Vendor contact list

Answer

Hardware serial number

Question 13

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?

Accepted Answer

Access control policy. Administrative controls are policies, procedures, and management tasks rather than technical or physical hardware.

Answer

Biometric locks

Answer

Encryption

Question 14

Which TWO of the following are considered 'Credential Access' techniques?

Accepted Answer

Brute force. Brute forcing passwords and dumping memory (LSASS) are standard credential access methods.

Answer

File deletion

Answer

Network mapping

Answer

Service creation

Question 15

Which TWO of the following are core components of the CIA Triad?

Accepted Answer

Confidentiality. The CIA Triad stands for Confidentiality, Integrity, and Availability.

Answer

Non-repudiation

Answer

Identification

Answer

Authorization

Question 16

Which TWO of the following are considered 'Technical' controls?

Accepted Answer

Firewall configuration. Technical controls (logical controls) are implemented via software, hardware, or firmware.

Answer

Background checks

Answer

Security policy documentation

Answer

Guard patrol

Question 17

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

Accepted Answer

Clear roles and responsibilities. An IRP must clearly define roles (who does what) and include communication plans (who to notify) to be effective during a crisis.

Answer

The company's marketing strategy

Answer

Inventory of printer models

Answer

List of all employee home addresses

Question 18

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

Accepted Answer

Firewall logs. SIEMs ingest data from various layers including identity providers, network infrastructure, and endpoint monitoring tools to provide comprehensive visibility.

Answer

Employee payroll spreadsheets

Answer

Kitchen appliance status reports

Question 19

Which THREE techniques do attackers use to maintain persistence on a Windows host?

Accepted Answer

Installing a malicious system service. Persistence is maintained by registering code with startup processes (Registry), system services, or scheduled tasks.

Answer

Changing the desktop background

Answer

Updating the browser's homepage

Question 20

Which THREE factors should be considered when assessing the severity of a security incident?

Accepted Answer

Scope of the affected systems. Severity assessment depends on the impact to business operations, the sensitivity of the compromised data, and the scope of the affected systems.

Answer

The day of the week the incident occurred

Answer

The analyst's personal opinion