CCOA Securing Assets — 10 Questions

Question 1

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

Accepted Answer

Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. The standard path for local security policy settings in GPO is Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.

Answer

Computer Configuration > System Settings > Advanced > Security

Answer

User Configuration > Preferences > Control Panel Settings > Local Users and Groups

Answer

Computer Configuration > Administrative Templates > Windows Components > Password

Question 2

You are configuring Microsoft Defender for Endpoint (MDE) to restrict USB storage access on corporate-managed Windows endpoints. Which policy setting should you configure in the Microsoft Intune Endpoint Security portal to ensure only authorized hardware IDs are permitted while blocking all others?

Accepted Answer

Enable 'Removable Storage Access: Allow write access' and add the specific Hardware IDs to the 'Allow access to specific hardware IDs' setting.. In Intune, the 'Removable Storage Access' settings under 'Device Control' allow for granular control over USB access, specifically allowing the specification of Hardware IDs for allow-listing.

Answer

Modify the 'Administrative Templates' to set 'Prevent installation of removable devices'.

Answer

Set the 'USB Connection' state to 'Restricted' within the Defender for Endpoint configuration baseline.

Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy.

Question 3

You are performing a credentialed vulnerability scan using Nessus Professional on a Linux server. The scan reports that the 'Remote Windows SMB' service is missing patches, but the target is Linux. What is the most likely cause of this discrepancy?

Accepted Answer

The Nessus scanner has performed a fingerprinting mismatch due to an incorrect 'Credentialed Patch Audit' policy setting.. This is a common issue when the 'Safe Checks' are enabled or when the SSH service is configured to allow legacy protocols that trigger incorrect plugin attribution in the vulnerability database.

Answer

The scanner is configured to run 'Non-Credentialed' scans only, resulting in false positives.

Answer

The Linux server is hosting a Windows VM, and the scanner is reporting on the guest OS.

Answer

The Linux server has Samba installed, and the vulnerability scanner is correctly identifying a vulnerability in the SMB stack.

Question 4

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 5

While monitoring security logs in Splunk for your critical database server, you observe a spike in '401 Unauthorized' errors followed by a '200 OK' success from a known administrative account. How should you investigate this to confirm a potential credential stuffing attack?

Accepted Answer

Check the 'web_access.log' for the source IP of the successful login and compare the User-Agent string to previous successful logins.. To distinguish between a user mistyping a password and an automated attack, you must correlate the timing, source IP distribution, and the subsequent behavior of the account.

Answer

Disable the administrative account immediately without further analysis.

Answer

Restart the database service to clear the connection pool.

Answer

Increase the logging level on the database to 'Debug' to capture the password hash being transmitted.

Question 6

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Accepted Answer

Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.. The Nessus Agent must communicate with the Tenable.io platform via a specific port. If the agent isn't showing up, checking the link status and connectivity to the cloud backend is the primary requirement.

Answer

Reinstall the Nessus Agent using the 'Force Install' flag.

Answer

Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.

Answer

Restart the Windows Management Instrumentation (WMI) service.

Question 7

You are implementing 'Just-in-Time' (JIT) access for Azure Virtual Machines using Microsoft Defender for Cloud. A developer complains they cannot request access to a VM. What is the most likely reason?

Accepted Answer

The developer lacks the required Azure RBAC permissions to modify the Network Security Group associated with the VM.. Defender for Cloud's JIT VM Access requires the user to have specific RBAC permissions (typically 'Microsoft.Compute/virtualMachines/write') on the resource group or subscription.

Answer

The VM is not joined to an Azure Active Directory domain.

Answer

The developer lacks the 'Security Reader' role, which is mandatory for requesting JIT access.

Answer

The developer has not enabled 'Multi-Factor Authentication' on their local machine.

Question 8

You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?

Accepted Answer

Use the 'Isolate Endpoint' feature in your EDR (e.g., CrowdStrike or Defender) to restrict network communication.. Isolating the endpoint via the EDR platform is the industry-standard 'containment' step to prevent lateral movement while maintaining a forensic connection.

Answer

Power off the laptop immediately to preserve volatile memory.

Answer

Delete the user account associated with the laptop in Active Directory.

Answer

Physically disconnect the ethernet cable from the building patch panel.

Question 9

You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?

Accepted Answer

iptables -A INPUT -s 192.168.10.0/24 -j DROP. The 'iptables -A INPUT -s [network] -j DROP' syntax correctly appends a rule to the INPUT chain to drop traffic from the specified source.

Answer

iptables -I OUTPUT -d 192.168.10.0/24 -j REJECT

Answer

iptables -A FORWARD -s 192.168.10.0/24 -j DROP

Answer

iptables -A INPUT -d 192.168.10.0/24 -j DROP

Question 10

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

Accepted Answer

A central database containing customer Personally Identifiable Information (PII) and credit card data.. Assets that hold PII, financial data, or are critical to core business functions are universally classified as 'High'.

Answer

A guest Wi-Fi access point used for public internet access.

Answer

A local printer used for departmental documents.

Answer

An internal employee breakroom display showing weather and news.