CCOA Securing Assets Practice Test 3 — 15 Questions

Question 1

You are configuring an Endpoint Security policy to harden Windows 10 devices. Which TWO of the following settings are recommended as best practice to mitigate physical access risks?

Accepted Answer

Enable BitLocker Drive Encryption for all fixed drives.. Option A (Enable BitLocker Drive Encryption for all fixed drives) is correct because full-disk encryption protects data at rest, so if a device is lost or stolen an attacker with physical access cannot read the drive contents without the recovery key or TPM-based authentication. Option E (Disable 'AutoRun' for all removable media) is correct because AutoRun can automatically execute code from USB drives and other removable media, which is a classic physical-access attack vector; disabling it prevents automatic execution of malicious payloads when media is inserted. Options B, C, and D are not the best answers for physical access risks: disabling Windows Store apps and enabling SmartScreen are application/download controls that primarily address software and browsing threats, and a 12-character minimum password length is a general authentication hardening measure rather than a direct mitigation for physical access to the device.

Answer

Disable the 'Allow Windows Store apps' policy.

Answer

Enable 'Microsoft Defender SmartScreen'.

Answer

Set the 'Minimum Password Length' to 12 characters.

Question 2

You are setting up a secure baseline for a new server. You need to ensure the operating system logs are sent to a centralized logging server. Which service should you configure?

Accepted Answer

rsyslog. rsyslog is a service that can be configured to send operating system logs to a centralized logging server. It supports multiple protocols (UDP, TCP, TLS) and is commonly used on Linux systems for log forwarding.

Answer

NTP

Answer

DHCP

Answer

SNMP Trap

Question 3

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

Accepted Answer

To provide continuous monitoring and automated response to threats on endpoints.. EDR solutions continuously collect endpoint telemetry (process execution, file changes, registry modifications, network connections) and use behavioral analytics to detect threats, then automate responses such as isolating a host, killing a process, or quarantining a file. This continuous monitoring plus automated response is the defining purpose of EDR. It operates at the endpoint layer, not the network edge or application layer.

Answer

To block all incoming traffic at the network edge.

Answer

To scan for vulnerabilities in web applications.

Answer

To manage user passwords and enforce complexity.

Question 4

You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?

Accepted Answer

ss -tulpn. 'ss' (socket statistics) with the '-tulpn' flags is the modern, preferred tool over the deprecated 'netstat' for viewing listening sockets with process IDs.

Answer

lsof -i | grep LISTEN

Answer

ps aux | grep port

Answer

netstat -an | grep LISTEN

Question 5

You are auditing your cloud environment for 'Shadow IT'. Which TWO of the following methods are effective for identifying unauthorized assets?

Accepted Answer

Reviewing firewall logs for connections to known cloud service provider CIDR blocks.. Option C is correct because reviewing firewall logs for connections to known cloud service provider CIDR blocks reveals traffic to AWS, Azure, or GCP ranges that may indicate unauthorized cloud resources, since egress to those IP ranges is a strong signal of Shadow IT usage. Option D is correct because analyzing DNS query logs for domains associated with common SaaS platforms (e.g., slack.com, dropbox.com, salesforce.com) exposes which SaaS services are actually being accessed, even when users bypass IT procurement. Option A is not ideal because Nmap port scanning only discovers hosts and open ports on the corporate network and cannot detect external cloud assets or SaaS usage outside the perimeter. Option B is unreliable because employee interviews depend on self-reporting and memory, so they miss unacknowledged or forgotten Shadow IT. Option E is irrelevant because physical office layout has no bearing on identifying unauthorized cloud or SaaS assets.

Answer

Scanning the corporate network using Nmap for open ports.

Answer

Interviewing all employees about their work habits.

Answer

Checking the physical office layout.

Question 6

Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?

Accepted Answer

Exploit Code Maturity (e.g., is there a public exploit available?).. CVSS scoring includes base metrics like exploit code maturity, environmental impact, and temporal factors to prioritize remediation.

Answer

The number of employees in the department that owns the server.

Answer

The color of the server rack hardware.

Question 7

Which TWO of the following are examples of good asset inventory management practices?

Accepted Answer

Maintaining a Configuration Management Database (CMDB) that maps asset relationships.. Option A is correct because a Configuration Management Database (CMDB) is a recognized ITIL practice that records assets and, critically, the relationships and dependencies between configuration items, which supports impact analysis, change management, and accurate inventory control. Option B is correct because automated discovery tools such as Lansweeper or Tenable.io continuously scan the network to detect and reconcile assets, keeping the inventory current and reducing the human error and staleness inherent in manual tracking. Option C is wrong because inventory should cover all assets, not only those involved in incidents; incident-driven tracking leaves most of the estate unmanaged. Option D is wrong because decommissioned or powered-off assets must still be tracked through their lifecycle (and securely disposed of) rather than simply deleted, which would break audit and compliance records. Option E is wrong because an annual manual Excel update is infrequent, error-prone, and not a continuous or authoritative inventory practice.

Answer

Only tracking assets that have had a security incident.

Answer

Deleting assets from the inventory once they are turned off.

Answer

Manually updating an Excel spreadsheet every year.

Question 8

You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?

Accepted Answer

Successful and failed login attempts.. Option A is correct because logging both successful and failed login attempts is essential for detecting brute-force attacks, credential stuffing, and unauthorized access, and it provides the audit trail required by standards such as PCI DSS, HIPAA, and SOX. Option B is correct because changes to user privileges or schema via commands like GRANT, REVOKE, ALTER, or DROP can indicate privilege escalation or tampering, and tracking them is a core compliance requirement for change auditing. Option E is correct because large-scale data exports or queries against sensitive tables can signal data exfiltration or insider threats, and monitoring them supports both breach detection and regulatory reporting. Option C does not belong because server hardware temperature is an infrastructure/availability metric, not a security or compliance event. Option D does not belong because the number of active sessions in a connection pool is a performance and capacity metric, not evidence of malicious activity or a compliance-relevant audit event.

Answer

The specific hardware temperature of the server.

Answer

The number of active user sessions in the connection pool.

Question 9

You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?

Accepted Answer

Disabling unused modules (e.g., WebDAV, directory listing) in the web server configuration.. Option D is correct because endpoint hardening of a web service requires reducing the attack surface by disabling unnecessary features such as WebDAV, autoindex/directory listing, and other unused modules in the web server configuration (e.g., Apache's LoadModule directives or IIS role services), which eliminates known vectors for information disclosure and exploitation. Option E is correct because default welcome pages, sample scripts, and demo applications (e.g., IIS iisstart.htm or Apache's default index) are well-known fingerprints and often contain vulnerabilities, so removing them is a standard hardening step. Option A is incorrect because changing a wallpaper is cosmetic and has no security impact on the web service. Option B is incorrect because auto-restarting every 10 minutes does not harden the service and could actually cause availability problems. Option C is incorrect because adding RAM is a performance/capacity upgrade, not a security hardening measure.

Answer

Changing the administrator's wallpaper to the company logo.

Answer

Configuring the server to auto-restart every 10 minutes.

Answer

Replacing the server's RAM with larger capacity sticks.

Question 10

Which THREE of the following are examples of 'Access Control' implementations?

Accepted Answer

Setting file system permissions (e.g., Read/Write/Execute).. Access control is about determining who or what may access a resource and under what conditions, so option A is correct because setting file system permissions such as Read, Write, and Execute directly enforces which users or groups can perform specific operations on files and directories. Option B is correct because Role-Based Access Control (RBAC) on file shares assigns permissions through roles, so users inherit access rights based on their job function rather than individual identity, which is a classic access control model. Option E is correct because requiring Multi-Factor Authentication (MFA) for all remote logins strengthens authentication before access is granted, and authentication is a core component of access control that verifies identity prior to authorization. Option C is incorrect because cleaning the office floor is a physical maintenance task, not a mechanism for controlling access to information or systems. Option D is incorrect because using a high-quality monitor for security logs only improves visibility for monitoring or review and does not itself grant, deny, or constrain access to any resource.

Answer

Cleaning the office floor daily.

Answer

Using a high-quality monitor for security logs.

Question 11

You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?

Accepted Answer

The server hosts the primary company e-commerce database with customer credit card data.. Option B is correct because hosting the primary e-commerce database that stores customer credit card data makes the asset critical: it processes and holds regulated cardholder data (PCI DSS scope), so its compromise would cause severe financial, legal, and reputational damage. Option C is correct because the server is required for the core 'Order Processing' function to remain operational, meaning its failure directly halts a business-critical process, which is the defining characteristic of a Critical asset in a vulnerability assessment. Options A and E describe low-impact, non-essential assets (internal UI prototype testing and a lobby printer connection) that would typically be rated low or medium, not Critical. Option D does not indicate criticality at all; an outdated Java version is a vulnerability finding that raises risk on whatever asset it resides, but it says nothing about the asset's business importance or data sensitivity.

Answer

The server is used for testing internal UI prototypes.

Answer

The server has an outdated version of Java installed.

Answer

The server is connected to a printer in the lobby.

Question 12

You are analyzing logs to detect a 'Lateral Movement' attack. Which THREE of the following behaviors are common indicators?

Accepted Answer

A user logging into 20 different workstations in 5 minutes.. Option A is correct because a single user authenticating to 20 different workstations within 5 minutes is a classic lateral-movement pattern, indicating credential reuse or automated spreading across hosts (e.g., via PsExec or SMB) rather than normal interactive work. Option D is correct because a sudden spike in RPC/WMI traffic between two internal servers often reflects remote execution and service control used by tools like Impacket's wmiexec or CrackMapExec to pivot between systems. Option E is correct because multiple successful logins with the same credential set from one internal source IP indicates an attacker using harvested credentials to authenticate to many targets from a compromised foothold, a hallmark of lateral movement. Option B does not belong because a single, expected 9:00 AM domain-controller logon by an administrator is routine administrative activity, not anomalous. Option C does not belong because changing a desktop background is a benign user action with no bearing on authentication, remote execution, or host-to-host pivoting.

Answer

An administrator logging into the domain controller once at 9:00 AM.

Answer

The user changing their desktop background image.

Question 13

A security operations analyst is reviewing the configuration of a newly deployed Windows Server 2022 file server that stores PII. The server has SMB signing disabled. Which of the following best describes the primary risk of leaving SMB signing disabled in this environment?

Accepted Answer

An attacker on the same network segment can perform a man-in-the-middle attack to modify SMB traffic between the client and server.. SMB signing ensures that SMB packets are not altered in transit and that they originate from a trusted source. Without it, an attacker positioned on the network can perform man-in-the-middle attacks, modifying file contents or injecting malicious commands. This is especially critical for a server storing PII, where data integrity and authenticity are paramount.

Answer

Unauthenticated users can mount the file share without providing credentials, leading to unauthorized data access.

Answer

SMB traffic will be sent in clear text, exposing sensitive PII to network sniffing attacks.

Answer

The server will be unable to negotiate SMB 3.0 connections, forcing fallback to the insecure SMB 1.0 protocol.

Question 14

A security analyst is reviewing the configuration of a Windows Server 2022 file server that stores HR records. The server is a member of an Active Directory domain. The analyst finds that the local Administrators group contains the domain group 'Helpdesk_Tier1'. Helpdesk technicians need to reset user passwords and unlock accounts, but they should not have full control over the HR file server. Which action should the analyst take to enforce least privilege while preserving the technicians' ability to perform their duties?

Accepted Answer

Remove Helpdesk_Tier1 from the local Administrators group and delegate the 'Reset Password' and 'Unlock Account' permissions on the relevant Organizational Units.. The helpdesk team needs only two specific Active Directory actions: resetting passwords and unlocking accounts. Delegating those exact permissions at the Organizational Unit level removes their broad local administrative rights on the HR file server while still allowing them to do their job. This is the textbook application of least privilege for administrative delegation in Active Directory.

Answer

Remove Helpdesk_Tier1 from the local Administrators group and add it to the 'Account Operators' group in Active Directory.

Answer

Keep Helpdesk_Tier1 in the local Administrators group but enable the 'Protected Users' security group for all helpdesk accounts.

Answer

Remove Helpdesk_Tier1 from the local Administrators group and configure a Group Policy Object that denies logon to the HR file server for that group.

Question 15

A CCOA analyst is investigating suspicious activity on a Linux web server running Apache. The analyst runs 'ss -tulpn' and sees that the server is listening on port 8443, but the organization's asset inventory lists this server as only providing HTTP on port 80 and HTTPS on port 443. The analyst needs to determine which process is bound to port 8443 and whether it is authorized. Which command should the analyst use next to identify the process name and PID associated with port 8443?

Accepted Answer

lsof -i :8443. Mapping an unexpected listening port to its owning process is a core incident response step. The 'lsof -i :8443' command lists open Internet sockets on that port and includes the process name, PID, and user. This gives the analyst the exact information needed to determine whether the process is authorized and to take further action such as terminating or investigating it.

Answer

nmap -sV -p 8443 localhost

Answer

tcpdump -i any port 8443

Answer

netstat -anp | grep 8443