CCOA Securing Assets — 20 Questions

Question 1

You are configuring Microsoft Defender for Endpoint (MDE) to restrict USB storage access on corporate-managed Windows endpoints. Which policy setting should you configure in the Microsoft Intune Endpoint Security portal to ensure only authorized hardware IDs are permitted while blocking all others?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Removable Storage Access: Allow write access' and add the specific Hardware IDs to the 'Allow access to specific hardware IDs' setting.. In Intune, the 'Removable Storage Access' settings under 'Device Control' allow for granular control over USB access, specifically allowing the specification of Hardware IDs for allow-listing.

Answer

Modify the 'Administrative Templates' to set 'Prevent installation of removable devices'.

Answer

Set the 'USB Connection' state to 'Restricted' within the Defender for Endpoint configuration baseline.

Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy.

Question 2

You are performing a credentialed vulnerability scan using Nessus Professional on a Linux server. The scan reports that the 'Remote Windows SMB' service is missing patches, but the target is Linux. What is the most likely cause of this discrepancy?

Accepted Answer

The Nessus scanner has performed a fingerprinting mismatch due to an incorrect 'Credentialed Patch Audit' policy setting.. The most likely cause is a fingerprinting mismatch driven by an incorrect credentialed patch audit policy. Nessus may have misidentified the Linux host's Samba service as Windows SMB and then applied Windows-specific patch checks, producing false positives about missing Windows patches. This is a plugin/policy selection issue rather than an actual Windows service on the Linux box.

Answer

The scanner is configured to run 'Non-Credentialed' scans only, resulting in false positives.

Answer

The Linux server is hosting a Windows VM, and the scanner is reporting on the guest OS.

Answer

The Linux server has Samba installed, and the vulnerability scanner is correctly identifying a vulnerability in the SMB stack.

Question 3

While monitoring security logs in Splunk for your critical database server, you observe a spike in '401 Unauthorized' errors followed by a '200 OK' success from a known administrative account. How should you investigate this to confirm a potential credential stuffing attack?

Accepted Answer

Check the 'web_access.log' for the source IP of the successful login and compare the User-Agent string to previous successful logins.. The correct approach is to correlate the successful login with the preceding failed attempts by examining the source IP and User-Agent string in the web access logs. This confirms whether the 200 OK came from the same actor that generated the 401s, which is the hallmark of credential stuffing (many failed attempts followed by one success). Comparing the User-Agent to previous legitimate logins helps distinguish an attacker's tooling from the admin's normal browser.

Answer

Disable the administrative account immediately without further analysis.

Answer

Restart the database service to clear the connection pool.

Answer

Increase the logging level on the database to 'Debug' to capture the password hash being transmitted.

Question 4

You are implementing 'Just-in-Time' (JIT) access for Azure Virtual Machines using Microsoft Defender for Cloud. A developer complains they cannot request access to a VM. What is the most likely reason?

Accepted Answer

The developer lacks the required Azure RBAC permissions to modify the Network Security Group associated with the VM.. Just-in-Time VM access in Microsoft Defender for Cloud works by temporarily modifying the Network Security Group (NSG) rules to allow the requester's IP on specific management ports. To request access, the user needs Azure RBAC permissions that allow them to modify the NSG — typically the 'Virtual Machine Contributor' or a custom role with Microsoft.Network/networkSecurityGroups/write. Without that permission, the request fails even if all other prerequisites are met.

Answer

The VM is not joined to an Azure Active Directory domain.

Answer

The developer lacks the 'Security Reader' role, which is mandatory for requesting JIT access.

Answer

The developer has not enabled 'Multi-Factor Authentication' on their local machine.

Question 5

You are configuring AWS Security Groups for a web server. Which rule set follows the 'Principle of Least Privilege' best?

Accepted Answer

Inbound: TCP 80, 443 from 0.0.0.0/0; Outbound: TCP 443 to internal database subnet only.. Option A follows least privilege because inbound is limited to the web ports actually needed (80/443) from the internet, and outbound is restricted to only the internal database subnet on TCP 443 — nothing else is permitted. This minimizes both the attack surface and the blast radius if the server is compromised. It is the only option that constrains outbound traffic to a specific destination and port.

Answer

Inbound: TCP 80, 443 from 0.0.0.0/0; Outbound: All traffic.

Answer

Inbound: All TCP from 0.0.0.0/0; Outbound: All traffic.

Answer

Inbound: TCP 22, 80, 443 from 0.0.0.0/0; Outbound: All traffic.

Question 6

You are troubleshooting a failure in a 'Certificate-Based Authentication' setup for a VPN. The logs show 'Handshake Failure'. What tool should you use to verify the server's certificate chain status?

Accepted Answer

'openssl s_client -connect :443 -showcerts'.. 'openssl s_client -connect :443 -showcerts' initiates a TLS handshake and prints the full certificate chain presented by the server, letting you inspect each certificate's subject, issuer, validity dates, and whether the chain is complete and trusted. It is the standard command-line tool for diagnosing certificate-chain and handshake failures on Linux. The -showcerts flag ensures intermediate certificates are displayed, which is exactly what you need to spot a missing or expired intermediate.

Answer

Wireshark to analyze the encrypted traffic.

Answer

'certutil -verify -urlfetch' on the Linux server.

Answer

Nmap with the '--script ssl-enum-ciphers' flag.

Question 7

You are evaluating a third-party application's access requirements. Which THREE of the following are considered 'Least Privilege' implementations?

Accepted Answer

Using a dedicated service account instead of a personal user account for application processes.. Least privilege requires granting only the absolute minimum permissions needed for a task, using granular roles, and scoping access by resource.

Answer

Granting the application access to all internal databases 'just in case' it needs them later.

Answer

Granting the application service account 'Owner' role on the entire Azure Subscription.

Question 8

During an internal audit of a financial services firm, the security operations team must ensure that the cryptographic keys used to encrypt customer payment data at rest are properly secured. The keys are stored on a Hardware Security Module (HSM). Which of the following controls BEST ensures that the keys cannot be extracted or misused even if an attacker gains root access to the application server that uses the HSM?

Accepted Answer

Implement role-based access control on the HSM so that the application server's identity can only perform specific cryptographic operations.. The best control is to restrict what the application server can do with the HSM through role-based access control. This ensures that even if the server is compromised, the attacker cannot export keys or perform unauthorized operations. Other options either address only key export, network access, or data at rest, none of which prevent misuse of the HSM by a privileged attacker on the application server.

Answer

Enable full disk encryption on the application server to protect any cached key material.

Answer

Enforce strict network segmentation so that only the application server can communicate with the HSM.

Answer

Configure the HSM to require a quorum of smart cards for key export operations.

Question 9

A CCOA analyst is investigating an alert indicating that a domain controller's NTDS.dit file was accessed by a non-standard process. The analyst suspects an attempt to extract credential hashes. Which of the following techniques is most likely being used by the attacker?

Accepted Answer

DCSync. DCSync mimics domain controller replication to request password data from a DC. It abuses the DRS protocol and requires specific permissions, such as Replicating Directory Changes. Because it does not read NTDS.dit from disk, it can evade file access monitoring. However, in this scenario, the alert shows NTDS.dit access, which could be a precursor to DCSync if the attacker gained sufficient privileges. The technique is stealthy and often used in credential dumping.

Answer

Kerberoasting

Answer

Pass-the-Hash

Answer

Golden Ticket

Question 10

A security analyst is reviewing the configuration of a critical Windows server that hosts a database. The server is part of an Active Directory domain. The analyst notices that the local Administrator account is enabled and has a weak password. Which of the following actions BEST mitigates the risk of lateral movement using this account while maintaining operational requirements?

Accepted Answer

Implement Local Administrator Password Solution (LAPS) to manage the local Administrator password.. LAPS is the best mitigation because it ensures each machine has a unique, rotated local Administrator password, preventing credential reuse across systems. This stops lateral movement while allowing local administrative access when needed. The other options either introduce domain account risks, do not fully prevent credential reuse, or may disrupt operations.

Answer

Configure a Group Policy to deny log on locally for the local Administrator account.

Answer

Disable the local Administrator account and use a domain account with complex password for administration.

Answer

Rename the local Administrator account and set a strong, unique password.

Question 11

A security analyst is configuring a new endpoint detection and response (EDR) solution. The analyst needs to ensure that the EDR agent can detect malicious PowerShell scripts that are obfuscated. Which of the following capabilities is most critical for this requirement?

Accepted Answer

Script block logging. Script block logging is specifically designed to record PowerShell script blocks after they are parsed, which reveals obfuscated code in its de-obfuscated form. This enables EDR solutions to detect malicious scripts that use encoding or other evasion techniques. While AMSI can also help, script block logging provides a more comprehensive audit trail for detection and forensic analysis.

Answer

Transcription

Answer

AMSI integration

Answer

Module logging

Question 12

A company is migrating its on-premises file server to a cloud-based object storage service. The security team must ensure that data at rest is encrypted and that access is controlled based on user identity. Which of the following configurations BEST meets these requirements?

Accepted Answer

Enable server-side encryption with customer-provided keys and use IAM policies to control access.. The correct configuration is server-side encryption with customer-provided keys plus IAM policies. This ensures the company controls the encryption keys and that access is granted based on user identity through IAM. Other options either use shared keys, provider-managed keys, or network controls that do not satisfy identity-based access control and customer-controlled encryption.

Answer

Enable server-side encryption with provider-managed keys and use security groups to control access.

Answer

Use HTTPS for data in transit and enable versioning for data at rest.

Answer

Use client-side encryption with a shared symmetric key and rely on network ACLs for access control.

Question 13

A security analyst is implementing a privileged access management (PAM) solution to secure administrative accounts in an Active Directory environment. The analyst must ensure that the solution enforces the principle of least privilege and provides accountability. Which two of the following controls are most critical to achieve these goals? (Choose two.)

Accepted Answer

Session recording and keystroke logging for privileged sessions. Just-in-time privilege elevation with approval workflows enforces least privilege by granting rights only when needed and ensuring authorized requests. Session recording and keystroke logging provide accountability by creating an immutable record of privileged activities. Together, they directly address the requirements of least privilege and accountability, forming the core of a robust PAM strategy.

Answer

Network segmentation between administrative workstations and servers

Answer

Multi-factor authentication (MFA) for all administrative logins

Answer

Password vaulting with automatic rotation

Question 14

A cloud security engineer is reviewing the configuration of an object storage bucket that holds customer invoices. The bucket is intended to be private, but a recent assessment found that objects were reachable by anyone who knew the URL. The engineer confirms that no bucket policy or access control list grants public access and that all access goes through signed requests. Which configuration issue is the MOST likely cause of the unintended exposure?

Accepted Answer

The account-level block public access setting was disabled, overriding the private bucket configuration. Account-level block public access is a guardrail that supersedes bucket policies, access control lists, and object-level permissions. If that guardrail is disabled, a change elsewhere can silently make objects anonymously readable even while the engineer believes the bucket policy remains private. Versioning, encryption key choice, and region selection affect retention, confidentiality at rest, and residency respectively, but none of them enables unauthenticated retrieval of otherwise private objects.

Answer

The bucket was created in a region that does not enforce data residency restrictions

Answer

The objects were encrypted with a customer-managed key that the public cannot use

Answer

The bucket has versioning disabled, allowing older object versions to remain publicly readable

Question 15

A CCOA analyst is reviewing Group Policy settings for a Windows Server 2022 domain controller. The organization wants to ensure that all domain-joined workstations enforce a minimum password length of 14 characters and lock out accounts after 5 failed attempts. Which of the following is the MOST appropriate location to configure these settings to ensure they apply to all domain users?

Accepted Answer

Default Domain Policy. The Default Domain Policy is linked to the domain root and applies to all users and computers in the domain. Configuring password and account lockout settings there ensures they are enforced domain-wide. Other options either apply to a subset of objects or are not centrally managed, making them unsuitable for the requirement.

Answer

Local Security Policy on each workstation

Answer

Fine-Grained Password Policy

Answer

Default Domain Controllers Policy

Question 16

A security operations analyst is configuring a new Windows Server 2022 file server that will store financial records. The organization's policy requires that all file shares containing financial data be encrypted at rest and that access be restricted to authorized finance personnel only. The analyst needs to implement these controls using native Windows features. Which combination of technologies should the analyst use to meet these requirements?

Accepted Answer

BitLocker Drive Encryption for encryption at rest and NTFS permissions for access control.. BitLocker Drive Encryption encrypts the entire volume, ensuring all financial records are protected at rest, and NTFS permissions provide fine-grained access control to restrict access to authorized finance personnel. This combination is the standard native Windows solution for meeting both encryption and access control requirements.

Answer

BitLocker Drive Encryption for encryption at rest and share permissions for access control.

Answer

Encrypting File System (EFS) for encryption at rest and share permissions for access control.

Answer

EFS for encryption at rest and NTFS permissions for access control.

Question 17

A CCOA analyst is configuring access control for a critical database server. The organization requires that only members of the 'DB_Admins' group can log in interactively, while members of the 'App_Service' group can only connect via a specific application service account. Which of the following access control models BEST fits this requirement?

Accepted Answer

Role-Based Access Control (RBAC). RBAC is designed around roles and group memberships, making it the natural fit for distinguishing between DB_Admins and App_Service groups. It allows centralized management of permissions based on job functions. MAC, DAC, and ABAC are either too rigid, too decentralized, or too complex for this specific requirement.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 18

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

Accepted Answer

Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. Local Account Password Complexity is enforced through the Password Policy node under Account Policies in the Security Settings of a Group Policy Object. The correct path is Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy, where settings like 'Password must meet complexity requirements' reside. This is the standard CIS Benchmark location for password policy hardening.

Answer

Computer Configuration > System Settings > Advanced > Security

Answer

User Configuration > Preferences > Control Panel Settings > Local Users and Groups

Answer

Computer Configuration > Administrative Templates > Windows Components > Password

Question 19

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 20

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Accepted Answer

Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.. When a Nessus Agent is installed but the endpoint does not appear in Tenable.io's Asset Inventory, the first step is to verify the agent's link status and connectivity to the manager using 'nessuscli agent status' (or the equivalent on Windows). This command shows whether the agent is linked, the last connection time, and the manager it is linked to — quickly isolating whether the problem is agent-side linking/network versus a Tenable.io-side configuration issue.

Answer

Reinstall the Nessus Agent using the 'Force Install' flag.

Answer

Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.

Answer

Restart the Windows Management Instrumentation (WMI) service.