CCOA Securing Assets Practice Test 4 — 15 Questions

Question 1

A CCOA analyst is configuring centralized logging for a fleet of Linux servers that host sensitive customer data. The organization must ensure that authentication events and privilege escalation attempts are captured for security monitoring and compliance. Which two log sources should the analyst prioritize to detect unauthorized access and privilege escalation attempts? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/var/log/auth.log or /var/log/secure. Detecting unauthorized access and privilege escalation on Linux requires visibility into authentication events and privileged command execution. The auth.log or secure file captures login and sudo activity, while auditd provides deep system call and file access auditing. Together they give the analyst the evidence needed to identify and investigate suspicious privilege use on sensitive servers.

Answer

Cron job output logs

Answer

Apache access logs

Answer

System performance metrics from sar

Question 2

You are the cybersecurity operations analyst for a hospital network. A workstation in the radiology department was compromised and used to pivot to the PACS image archive. During the post-incident review, the CISO asks which control would have most directly limited the attacker's ability to move laterally from the workstation to the archive server. Which of the following should you recommend?

Accepted Answer

Enforcing network segmentation with deny-by-default rules between clinical workstation VLANs and the PACS server VLAN. Lateral movement from a compromised clinical workstation to a PACS archive is an east-west traffic problem best solved by network segmentation. Deny-by-default rules between workstation and server VLANs, allowing only required DICOM flows, contain the attacker regardless of the initial access vector. Endpoint detection, password policy, and packet capture improve visibility or initial access resistance but do not block the pivot path itself.

Answer

Increasing the password complexity requirements for all radiology staff domain accounts

Answer

Enabling full packet capture on the core switch for later forensic analysis

Answer

Deploying endpoint detection and response agents on all radiology workstations

Question 3

A CCOA analyst is helping to classify assets for a new cybersecurity program. The organization wants to identify which assets are most critical so that protection and monitoring efforts can be prioritized. Which criterion is the MOST appropriate basis for classifying an asset as high criticality?

Accepted Answer

The asset processes or stores regulated customer data and supports a revenue-generating service.. Asset criticality classification should be driven by the business impact of compromise or failure. Assets that process regulated data and directly enable revenue are high criticality because their loss triggers legal, financial, and reputational consequences. This aligns protection and monitoring resources with the organization's most important dependencies and compliance obligations.

Answer

The asset has the highest purchase price in the inventory.

Answer

The asset is managed by the IT team with the largest headcount.

Answer

The asset is the newest model in its category.

Question 4

During an incident response engagement, an analyst must preserve volatile evidence from a compromised Windows workstation before containment. The system has been running for 36 hours and the analyst needs to capture the current state of active network connections and the processes that own them, in a form that can be used for later forensic review. Which built-in Windows utility should the analyst run first to capture this volatile data?

Accepted Answer

netstat -anob. Capturing volatile data before containment preserves evidence that disappears on shutdown or reboot. The netstat command with the -a, -n, -o, and -b switches returns the current TCP and UDP endpoints in numeric form, the owning process identifier, and the executable name, giving the analyst a defensible snapshot linking live sockets to processes. Other utilities listed report configuration or logs and cannot reconstruct the live connection-to-process relationship after the fact.

Answer

Get-WinEvent -LogName Security

Answer

sfc /scannow

Answer

ipconfig /all

Question 5

A financial services firm is inventorying its assets for a new risk assessment. The analyst must classify each asset by data sensitivity and business criticality. Which of the following best represents a 'Confidential' data classification for an asset in this environment?

Accepted Answer

A spreadsheet containing customer account numbers and Social Security numbers. Data classification should reflect the harm of unauthorized disclosure. Customer account numbers and Social Security numbers are regulated PII whose exposure causes identity theft, fraud, and legal liability, so they belong in the Confidential category. Public brochures, internal directories, and pre-publication press releases cause little or no harm if disclosed and therefore do not represent Confidential assets in a financial services risk assessment.

Answer

A public marketing brochure hosted on the corporate website

Answer

A press release draft scheduled for publication next week

Answer

An internal employee telephone directory available to all staff

Question 6

A CCOA analyst is reviewing endpoint hardening for a Windows 10 workstation used by a developer. The developer needs to run locally compiled binaries for testing but should not be able to bypass security controls. The analyst wants to prevent unauthorized executables from running while allowing approved development tools. Which Windows feature should the analyst configure to enforce application control based on code signing and reputation?

Accepted Answer

Windows Defender Application Control (WDAC). Application control on Windows is enforced through WDAC, which uses policies to allow only trusted, signed code. It can be tailored to permit approved development tools while blocking untrusted binaries, satisfying both the developer's needs and the security requirement. UAC, Windows Firewall, and BitLocker address different security concerns and do not provide execution control.

Answer

BitLocker Drive Encryption

Answer

Windows Firewall with Advanced Security

Answer

User Account Control (UAC)

Question 7

A security operations center (SOC) analyst is triaging an alert indicating that a user's workstation has been infected with malware that is attempting to communicate with a command-and-control (C2) server. The analyst wants to quickly identify the process responsible for the network connection. Which of the following tools is MOST appropriate for this task on a Windows system?

Accepted Answer

netstat -ano. netstat -ano is the correct tool because it lists active connections with the owning process ID, allowing the analyst to quickly identify the malicious process. The other tools provide DNS or routing information but do not correlate connections to processes, which is essential for rapid triage.

Answer

ipconfig /displaydns

Answer

route print

Answer

nslookup

Question 8

A security operations team is designing the asset inventory for a hybrid environment that includes on-premises servers, cloud workloads, and employee-owned mobile devices. The team wants to ensure the inventory supports both vulnerability management and incident response. Which data element is MOST important to include for every asset so that responders can quickly determine ownership and escalation paths during an incident?

Accepted Answer

The assigned business owner and technical custodian with contact details. An asset inventory serves both vulnerability management and incident response only when each record answers who owns the asset and whom to contact. Business owner and technical custodian fields with current contact information create the escalation chain that responders rely on to authorize containment and interpret business impact. Technical attributes such as patch level, location, or identifiers support analysis but do not establish accountability, which is the deciding factor in this scenario.

Answer

The asset's physical rack location and data center row

Answer

The asset's operating system build number and patch level

Answer

The asset's primary MAC address and hostname

Question 9

A manufacturing company is building a hardened baseline for its industrial control system (ICS) engineering workstations, which run Windows and connect to programmable logic controllers on the plant floor. The security team must reduce the attack surface without disrupting production. Which two controls are most appropriate to include in the baseline for these workstations? (Choose two.)

Accepted Answer

Disabling USB mass storage and restricting removable media to approved, scanned devices. ICS engineering workstations require compensating controls because patching is constrained by vendor certification and production uptime. Application allowlisting restricts execution to approved engineering and HMI software, and disabling USB mass storage with controlled, scanned media blocks a common infection path. Automatic untested updates, consumer antivirus, and unrestricted utility installation all introduce availability or integrity risk and do not belong in the baseline.

Answer

Enabling automatic operating system updates that install immediately without testing

Answer

Installing consumer antivirus software with aggressive heuristic scanning on all engineering hosts

Answer

Allowing engineers to install any utility from the internet to troubleshoot PLC connectivity

Question 10

A security operations analyst is reviewing the hardening posture of a fleet of Windows Server 2022 hosts that run a custom line-of-business application requiring the legacy SMBv1 dialect for backward compatibility with an old vendor appliance. Leadership has approved a time-boxed exception but wants compensating controls. Which action BEST reduces the attack surface while honoring the approved exception?

Accepted Answer

Keep SMBv1 enabled but restrict it to the specific vendor appliance IP addresses with Windows Firewall rules and enable SMB signing and auditing on the hosts.. The approved exception exists because the legacy appliance cannot speak a modern SMB dialect. A proper compensating control honors that constraint while minimizing exposure, so scoping SMBv1 traffic to the single trusted peer and adding signing plus auditing is the balanced answer. Removing the protocol or assuming automatic negotiation both break the approved business function instead of containing its risk.

Answer

Leave SMBv1 enabled on all hosts without restriction but add a weekly vulnerability scan to detect exploitation attempts.

Answer

Disable the SMBv1 server service entirely and require the vendor appliance to be upgraded before the next audit cycle.

Answer

Replace SMBv1 with SMBv2 on the servers and configure the legacy appliance to negotiate down automatically.

Question 11

A security operations center (SOC) analyst is reviewing firewall logs and notices that a workstation is making repeated connections to a known malicious IP address on port 443. The analyst wants to quickly identify the process responsible for these connections on the Windows workstation. Which of the following tools should the analyst use?

Accepted Answer

netstat -ano. netstat -ano is a built-in Windows command that lists all active connections with their associated process IDs. By matching the PID to a process using Task Manager or tasklist, the analyst can quickly identify the responsible application. This is a fundamental step in incident response to determine if the connection is from a legitimate process or malware.

Answer

tracert

Answer

nslookup

Answer

arp -a

Question 12

A retail company stores payment card data in a database on a Linux server. The security team must ensure that the database files themselves are protected if the underlying storage is physically stolen or a disk image is copied. Which control best addresses this specific threat?

Accepted Answer

Enabling full-disk encryption on the server's storage volumes. The threat is offline access to payment card data via stolen or copied storage, which only encryption at rest can counter. Full-disk encryption ensures that disk images and removed drives remain unreadable without key material. Strong passwords, host intrusion detection, and network access restrictions all operate at runtime or over the network and cannot protect data once the storage medium is in an attacker's hands.

Answer

Configuring the database to require strong passwords for all application accounts

Answer

Implementing a host-based intrusion detection system on the database server

Answer

Restricting database network access to the application server IP address only

Question 13

A security analyst is reviewing the configuration of a Windows file server that stores personnel records. The analyst wants to verify that only members of the HR group can read the payroll folder and that all other authenticated users are explicitly denied access. Which type of access control model is being applied when permissions are assigned directly to named users and groups on each file and folder?

Accepted Answer

Discretionary access control (DAC). When permissions are written directly onto each file and folder and granted to named users or groups, the object owner or administrator is exercising discretion over access, which defines discretionary access control. NTFS access control lists on a Windows file server are a standard implementation. Mandatory, role-based, and attribute-based models each centralize or abstract the decision differently and do not match the direct per-object assignment described.

Answer

Mandatory access control (MAC)

Answer

Role-based access control (RBAC)

Answer

Attribute-based access control (ABAC)

Question 14

During a control review, an analyst finds that a privileged service account used by a backup platform has a password that has not rotated in three years and is stored in a plaintext configuration file on a management server. The backup platform cannot support modern authentication methods. Which compensating control BEST addresses the credential risk without breaking the backup jobs?

Accepted Answer

Move the plaintext credential into a secrets vault and have the backup platform retrieve it at runtime through a privileged access management broker.. The problem is a static plaintext privileged secret that never rotates. Brokering retrieval through a vault and PAM layer removes the on-disk secret, enforces controlled access, and creates an audit trail while still letting the backup platform authenticate. Strengthening the password, rotating manually, or widening privileges all leave the fundamental exposure intact or make it worse.

Answer

Schedule a quarterly password rotation for the service account and update the configuration file manually each time.

Answer

Increase the service account password length to 25 characters and store the file with NTFS permissions restricted to administrators.

Answer

Grant the service account domain administrator rights so that any credential misuse can be traced more easily in the logs.

Question 15

A security operations center is establishing a baseline for privileged account management across its server estate. The team must reduce the risk that compromised administrative credentials lead to widespread lateral movement. Which TWO controls should the team implement to directly limit the blast radius of a compromised privileged account? (Choose two.)

Accepted Answer

Enforce just-in-time elevation so administrative rights are granted only for the duration of an approved task. Blast radius is bounded by how much authority a stolen credential carries and for how long. Just-in-time elevation compresses the window in which administrative rights exist, and separating administrative accounts from daily-use identities prevents routine credential theft from yielding privilege. Password length, disk encryption, and antivirus all improve general security posture but none of them restrict what a valid privileged credential can reach once it is in an attacker's hands.

Answer

Increase the minimum password length for all accounts to 20 characters

Answer

Deploy a signature-based antivirus agent on every server

Answer

Enable full-disk encryption on all administrator workstations