CCOA Securing Assets — Timed 15 Questions

Question 1

You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?

Accepted Answer

Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. The standard path for local security policy settings in GPO is Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.

Answer

Computer Configuration > System Settings > Advanced > Security

Answer

User Configuration > Preferences > Control Panel Settings > Local Users and Groups

Answer

Computer Configuration > Administrative Templates > Windows Components > Password

Question 2

You are configuring Microsoft Defender for Endpoint (MDE) to restrict USB storage access on corporate-managed Windows endpoints. Which policy setting should you configure in the Microsoft Intune Endpoint Security portal to ensure only authorized hardware IDs are permitted while blocking all others?

Accepted Answer

Enable 'Removable Storage Access: Allow write access' and add the specific Hardware IDs to the 'Allow access to specific hardware IDs' setting.. In Intune, the 'Removable Storage Access' settings under 'Device Control' allow for granular control over USB access, specifically allowing the specification of Hardware IDs for allow-listing.

Answer

Modify the 'Administrative Templates' to set 'Prevent installation of removable devices'.

Answer

Set the 'USB Connection' state to 'Restricted' within the Defender for Endpoint configuration baseline.

Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy.

Question 3

You are performing a credentialed vulnerability scan using Nessus Professional on a Linux server. The scan reports that the 'Remote Windows SMB' service is missing patches, but the target is Linux. What is the most likely cause of this discrepancy?

Accepted Answer

The Nessus scanner has performed a fingerprinting mismatch due to an incorrect 'Credentialed Patch Audit' policy setting.. This is a common issue when the 'Safe Checks' are enabled or when the SSH service is configured to allow legacy protocols that trigger incorrect plugin attribution in the vulnerability database.

Answer

The scanner is configured to run 'Non-Credentialed' scans only, resulting in false positives.

Answer

The Linux server is hosting a Windows VM, and the scanner is reporting on the guest OS.

Answer

The Linux server has Samba installed, and the vulnerability scanner is correctly identifying a vulnerability in the SMB stack.

Question 4

You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?

Accepted Answer

Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.. IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.

Answer

Use an IAM Group and add the EC2 instance to the group.

Answer

Create an IAM user with access keys and embed them in the application configuration file.

Answer

Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.

Question 5

While monitoring security logs in Splunk for your critical database server, you observe a spike in '401 Unauthorized' errors followed by a '200 OK' success from a known administrative account. How should you investigate this to confirm a potential credential stuffing attack?

Accepted Answer

Check the 'web_access.log' for the source IP of the successful login and compare the User-Agent string to previous successful logins.. To distinguish between a user mistyping a password and an automated attack, you must correlate the timing, source IP distribution, and the subsequent behavior of the account.

Answer

Disable the administrative account immediately without further analysis.

Answer

Restart the database service to clear the connection pool.

Answer

Increase the logging level on the database to 'Debug' to capture the password hash being transmitted.

Question 6

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Accepted Answer

Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.. The Nessus Agent must communicate with the Tenable.io platform via a specific port. If the agent isn't showing up, checking the link status and connectivity to the cloud backend is the primary requirement.

Answer

Reinstall the Nessus Agent using the 'Force Install' flag.

Answer

Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.

Answer

Restart the Windows Management Instrumentation (WMI) service.

Question 7

You are implementing 'Just-in-Time' (JIT) access for Azure Virtual Machines using Microsoft Defender for Cloud. A developer complains they cannot request access to a VM. What is the most likely reason?

Accepted Answer

The developer lacks the required Azure RBAC permissions to modify the Network Security Group associated with the VM.. Defender for Cloud's JIT VM Access requires the user to have specific RBAC permissions (typically 'Microsoft.Compute/virtualMachines/write') on the resource group or subscription.

Answer

The VM is not joined to an Azure Active Directory domain.

Answer

The developer lacks the 'Security Reader' role, which is mandatory for requesting JIT access.

Answer

The developer has not enabled 'Multi-Factor Authentication' on their local machine.

Question 8

You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?

Accepted Answer

Use the 'Isolate Endpoint' feature in your EDR (e.g., CrowdStrike or Defender) to restrict network communication.. Isolating the endpoint via the EDR platform is the industry-standard 'containment' step to prevent lateral movement while maintaining a forensic connection.

Answer

Power off the laptop immediately to preserve volatile memory.

Answer

Delete the user account associated with the laptop in Active Directory.

Answer

Physically disconnect the ethernet cable from the building patch panel.

Question 9

You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?

Accepted Answer

iptables -A INPUT -s 192.168.10.0/24 -j DROP. The 'iptables -A INPUT -s [network] -j DROP' syntax correctly appends a rule to the INPUT chain to drop traffic from the specified source.

Answer

iptables -I OUTPUT -d 192.168.10.0/24 -j REJECT

Answer

iptables -A FORWARD -s 192.168.10.0/24 -j DROP

Answer

iptables -A INPUT -d 192.168.10.0/24 -j DROP

Question 10

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

Accepted Answer

A central database containing customer Personally Identifiable Information (PII) and credit card data.. Assets that hold PII, financial data, or are critical to core business functions are universally classified as 'High'.

Answer

A guest Wi-Fi access point used for public internet access.

Answer

A local printer used for departmental documents.

Answer

An internal employee breakroom display showing weather and news.

Question 11

When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?

Accepted Answer

The date when the asset was last patched.. Asset criticality is based on business value, regulatory impact, and data sensitivity; 'last patch date' is a hygiene metric, not a classification criterion.

Answer

The regulatory requirements associated with the asset (e.g., PCI-DSS/HIPAA).

Answer

The sensitivity of data residing on the asset.

Answer

The impact to business operations if the asset is offline.

Question 12

You are configuring AWS Security Groups for a web server. Which rule set follows the 'Principle of Least Privilege' best?

Accepted Answer

Inbound: TCP 80, 443 from 0.0.0.0/0; Outbound: TCP 443 to internal database subnet only.. Least privilege dictates allowing only the specific ports required (80/443) from the necessary source (anywhere or a load balancer) and nothing else.

Answer

Inbound: TCP 80, 443 from 0.0.0.0/0; Outbound: All traffic.

Answer

Inbound: All TCP from 0.0.0.0/0; Outbound: All traffic.

Answer

Inbound: TCP 22, 80, 443 from 0.0.0.0/0; Outbound: All traffic.

Question 13

You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?

Accepted Answer

CrowdStrike 'Host Management'.. The CrowdStrike 'Host Management' dashboard provides a real-time view of sensor status, version, and connectivity.

Answer

CrowdStrike 'Custom Detections'.

Answer

CrowdStrike 'Threat Graph'.

Answer

CrowdStrike 'Zero Trust Assessment'.

Question 14

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

Accepted Answer

Configure the service folder permissions to restrict write access to the 'Administrators' group only.. Hardening services that run as SYSTEM requires securing the directory permissions so only authorized users can write to the application folder, preventing the loading of malicious DLLs.

Answer

Change the service account to a local 'Guest' account.

Answer

Enable 'Service Isolation' in the Registry using the 'ServiceSidType' key.

Answer

Rename the service executable to a random string.

Question 15

You are troubleshooting a failure in a 'Certificate-Based Authentication' setup for a VPN. The logs show 'Handshake Failure'. What tool should you use to verify the server's certificate chain status?

Accepted Answer

'openssl s_client -connect <server>:443 -showcerts'.. OpenSSL is the industry standard CLI tool for diagnosing TLS handshake issues and verifying certificate chain validity.

Answer

Wireshark to analyze the encrypted traffic.

Answer

'certutil -verify -urlfetch' on the Linux server.

Answer

Nmap with the '--script ssl-enum-ciphers' flag.