CCOA Securing Assets Practice Test 2 — 15 Questions

Question 1

A security operations analyst is configuring a new Windows Server 2022 file server that will store financial records. The organization's policy requires that all file shares containing financial data be encrypted at rest and that access be restricted to authorized finance personnel only. The analyst needs to implement these controls using native Windows features. Which combination of technologies should the analyst use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BitLocker Drive Encryption for encryption at rest and NTFS permissions for access control.. BitLocker Drive Encryption encrypts the entire volume, ensuring all financial records are protected at rest, and NTFS permissions provide fine-grained access control to restrict access to authorized finance personnel. This combination is the standard native Windows solution for meeting both encryption and access control requirements.

Answer

BitLocker Drive Encryption for encryption at rest and share permissions for access control.

Answer

Encrypting File System (EFS) for encryption at rest and share permissions for access control.

Answer

EFS for encryption at rest and NTFS permissions for access control.

Question 2

A CCOA analyst is configuring access control for a critical database server. The organization requires that only members of the 'DB_Admins' group can log in interactively, while members of the 'App_Service' group can only connect via a specific application service account. Which of the following access control models BEST fits this requirement?

Accepted Answer

Role-Based Access Control (RBAC). RBAC is designed around roles and group memberships, making it the natural fit for distinguishing between DB_Admins and App_Service groups. It allows centralized management of permissions based on job functions. MAC, DAC, and ABAC are either too rigid, too decentralized, or too complex for this specific requirement.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 3

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

Accepted Answer

Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. Local Account Password Complexity is enforced through the Password Policy node under Account Policies in the Security Settings of a Group Policy Object. The correct path is Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy, where settings like 'Password must meet complexity requirements' reside. This is the standard CIS Benchmark location for password policy hardening.

Answer

Computer Configuration > System Settings > Advanced > Security

Answer

User Configuration > Preferences > Control Panel Settings > Local Users and Groups

Answer

Computer Configuration > Administrative Templates > Windows Components > Password

Question 4

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 5

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Accepted Answer

Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.. When a Nessus Agent is installed but the endpoint does not appear in Tenable.io's Asset Inventory, the first step is to verify the agent's link status and connectivity to the manager using 'nessuscli agent status' (or the equivalent on Windows). This command shows whether the agent is linked, the last connection time, and the manager it is linked to — quickly isolating whether the problem is agent-side linking/network versus a Tenable.io-side configuration issue.

Answer

Reinstall the Nessus Agent using the 'Force Install' flag.

Answer

Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.

Answer

Restart the Windows Management Instrumentation (WMI) service.

Question 6

You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?

Accepted Answer

Use the 'Isolate Endpoint' feature in your EDR (e.g., CrowdStrike or Defender) to restrict network communication.. Using the EDR 'Isolate Endpoint' feature immediately cuts the laptop's network communication while preserving the agent's management channel, allowing the security team to investigate, collect forensic artifacts, and remediate remotely. This is the fastest, most effective containment action because it stops command-and-control and lateral movement without destroying evidence. It is the standard incident response containment step for a compromised endpoint.

Answer

Power off the laptop immediately to preserve volatile memory.

Answer

Delete the user account associated with the laptop in Active Directory.

Answer

Physically disconnect the ethernet cable from the building patch panel.

Question 7

You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?

Accepted Answer

iptables -A INPUT -s 192.168.10.0/24 -j DROP. The correct syntax is 'iptables -A INPUT -s 192.168.10.0/24 -j DROP' because it appends a rule to the INPUT chain, matches packets with source address in the 192.168.10.0/24 subnet, and drops them. Blocking incoming traffic requires the INPUT chain and the -s (source) flag to match the originating subnet.

Answer

iptables -I OUTPUT -d 192.168.10.0/24 -j REJECT

Answer

iptables -A FORWARD -s 192.168.10.0/24 -j DROP

Answer

iptables -A INPUT -d 192.168.10.0/24 -j DROP

Question 8

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

Accepted Answer

A central database containing customer Personally Identifiable Information (PII) and credit card data.. A central database containing PII and credit card data represents the highest business impact if compromised, triggering regulatory penalties (GDPR, PCI DSS), financial loss, and reputational damage. This combination of sensitive data types and centralization makes it a textbook 'High' criticality asset. The other options have minimal confidentiality, integrity, or availability impact.

Answer

A guest Wi-Fi access point used for public internet access.

Answer

A local printer used for departmental documents.

Answer

An internal employee breakroom display showing weather and news.

Question 9

When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?

Accepted Answer

The date when the asset was last patched.. The date an asset was last patched is a vulnerability-management metric, not a criterion for determining business criticality. Criticality should reflect the asset's importance to the organization based on data sensitivity, regulatory scope, and operational impact—not its maintenance history. Patch recency tells you about hygiene, not about how much damage a compromise would cause.

Answer

The regulatory requirements associated with the asset (e.g., PCI-DSS/HIPAA).

Answer

The sensitivity of data residing on the asset.

Answer

The impact to business operations if the asset is offline.

Question 10

You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?

Accepted Answer

CrowdStrike 'Host Management'.. The CrowdStrike Falcon 'Host Management' dashboard provides a consolidated view of all endpoints with the Falcon sensor installed, showing sensor status, last check-in time, and version information. It is the designated interface for verifying agent health and coverage across the organization. Administrators use it to identify endpoints that are missing the sensor or have stopped reporting.

Answer

CrowdStrike 'Custom Detections'.

Answer

CrowdStrike 'Threat Graph'.

Answer

CrowdStrike 'Zero Trust Assessment'.

Question 11

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

Accepted Answer

Configure the service folder permissions to restrict write access to the 'Administrators' group only.. Hardening services that run as SYSTEM requires securing the directory permissions so only authorized users can write to the application folder, preventing the loading of malicious DLLs.

Answer

Change the service account to a local 'Guest' account.

Answer

Enable 'Service Isolation' in the Registry using the 'ServiceSidType' key.

Answer

Rename the service executable to a random string.

Question 12

A vulnerability report shows that your web application is susceptible to 'Clickjacking'. Which HTTP header should you implement to mitigate this?

Accepted Answer

X-Frame-Options: DENY. X-Frame-Options: DENY prevents the browser from rendering the page inside a frame or iframe, which is the core mechanism clickjacking exploits. By refusing to be framed, the application blocks attackers from overlaying invisible UI elements that trick users into clicking unintended actions. DENY is the strictest setting, disallowing framing by any origin, including the same site.

Answer

Access-Control-Allow-Origin: *

Answer

Strict-Transport-Security: max-age=31536000

Answer

X-Content-Type-Options: nosniff

Question 13

You are configuring a SIEM alert to trigger when a user account is locked out. Which Windows Event ID should your filter target?

Accepted Answer

Event ID 4740. Windows Event ID 4740 is logged when a user account is locked out due to too many failed logon attempts, making it the correct filter for a SIEM alert on account lockout. Event ID 4625 records individual failed logon attempts, which precede but do not equal a lockout. Event ID 4728 records a member being added to a security-enabled global group, and 4624 records a successful logon.

Answer

Event ID 4625

Answer

Event ID 4728

Answer

Event ID 4624

Question 14

You are reviewing a list of vulnerabilities found by an automated scanner. Which type of vulnerability would be considered the most critical to remediate first?

Accepted Answer

Remote Code Execution (RCE) on an internet-facing application.. Remote Code Execution on an internet-facing application is the most critical because it allows an unauthenticated attacker to execute arbitrary code on the server, potentially leading to full system compromise, data exfiltration, and lateral movement. Internet exposure removes the need for internal access, and RCE typically yields the highest impact with the lowest attacker effort. This combination of high exploitability and high impact places it at the top of any remediation priority list.

Answer

Unsupported software version that has no known exploits.

Answer

Information Disclosure of internal server paths.

Answer

Insecure cookie attributes (missing HttpOnly).

Question 15

You notice a surge in outbound traffic from a workstation to a series of random external IP addresses. This suggests a potential botnet infection. What is the most appropriate forensic data to collect first?

Accepted Answer

NetFlow logs from the network perimeter device.. NetFlow logs from the perimeter device provide a high-level summary of network connections, including source/destination IPs, ports, and byte counts, which can quickly confirm the botnet infection and identify the command-and-control (C2) servers. This data is lightweight, often retained for weeks, and can be queried without disrupting the workstation. It directly addresses the surge in outbound traffic to random external IPs, making it the most appropriate first forensic data to collect.

Answer

Full packet capture (pcap) for the last 30 days.

Answer

The browser history of the user.

Answer

A full disk image of the workstation.