CCOA Technology Essentials — 15 Questions

Question 1

A SOC analyst observes excessive traffic on port 443 originating from an internal server to an unknown external IP. Which command should the analyst run on a Linux-based server to identify the specific process ID (PID) associated with this connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

lsof -i :443. The 'netstat -tulpn' or 'ss -tulpn' command is standard for mapping open ports to specific process IDs in Linux environments.

Answer

ps -ef | grep 443

Answer

route -n

Answer

tcpdump -i eth0 port 443

Question 2

A cloud-based application is suffering from slow database queries. You suspect a misconfigured connection pool. Which log type in the cloud provider's console should you examine first?

Accepted Answer

CloudWatch Application Insights. Performance logs or Application Performance Monitoring (APM) logs are the standard tools for identifying bottlenecks in database connectivity.

Answer

Audit logs

Answer

Flow logs

Answer

IAM logs

Question 3

You are managing a Linux server that has become unresponsive. You suspect a 'fork bomb'. How can you limit the number of processes a user can run to prevent this?

Accepted Answer

Modify /etc/security/limits.conf. The 'ulimit' command, specifically the 'u' flag, allows setting limits on the number of processes per user.

Answer

Change the root password

Answer

Disable the swap partition

Answer

Use iptables

Question 4

In an Active Directory environment, which tool is used to monitor for unauthorized modifications to Group Policy Objects (GPOs)?

Accepted Answer

Group Policy Management Console (GPMC) reports. Active Directory replication and audit logs are monitored to detect changes to GPOs, and the 'Advanced Audit Policy Configuration' can be set to log these events.

Answer

Active Directory Users and Computers

Answer

Registry Editor

Answer

DNS Manager

Question 5

When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?

Accepted Answer

The VM acts as a direct node on the physical network.. Bridged networking gives the VM its own IP on the physical network, exposing it directly to network-based attacks like the host machine.

Answer

The VM is isolated from the physical network.

Answer

The VM can only communicate with the host.

Answer

The VM uses the host's IP address.

Question 6

You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?

Accepted Answer

AIDE. AIDE (Advanced Intrusion Detection Environment) is a file integrity checker that monitors system files against a baseline hash database.

Answer

firewalld

Answer

systemctl status

Answer

yum check-update

Question 7

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Accepted Answer

Advanced Security Settings - Effective Access. The 'Effective Access' tab in Windows Advanced Security Settings is the standard method for auditing actual permissions for a specific security principal.

Answer

Task Manager - Details tab

Answer

Local Security Policy (secpol.msc)

Answer

Event Viewer - System Log

Question 8

In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?

Accepted Answer

Protocol: TCP, Port: 443, Source: 10.0.1.0/24. The principle of least privilege dictates specifying the exact port and source CIDR block rather than using broad '0.0.0.0/0' entries.

Answer

Protocol: UDP, Port: 443, Source: 10.0.1.0/24

Answer

Protocol: TCP, Port: 80, Source: 10.0.1.0/24

Answer

Protocol: All Traffic, Port: All, Source: 0.0.0.0/0

Question 9

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

Accepted Answer

Verify the digital signature of the referenced executable.. Checking the 'Image Path' and verifying the digital signature of the file are necessary to confirm if a startup entry is legitimate.

Answer

Delete the registry key.

Answer

Reboot the server.

Answer

Rename the file to .txt.

Question 10

Which protocol is most appropriate for secure remote management of network infrastructure devices?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted remote access, whereas Telnet, HTTP, and SNMPv1 are insecure.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 11

You are hardening a web server. Which directive in an Apache configuration file helps prevent Clickjacking attacks?

Accepted Answer

X-Frame-Options: SAMEORIGIN. The 'X-Frame-Options' header prevents the site from being embedded in iframes, which is the primary vector for clickjacking.

Answer

Strict-Transport-Security

Answer

Content-Security-Policy: default-src 'self'

Answer

X-XSS-Protection: 1

Question 12

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

Accepted Answer

DHCP Snooping. DHCP Snooping is the standard feature used to validate DHCP messages and prevent rogue server injection.

Answer

VLAN Tagging

Answer

Dynamic ARP Inspection

Answer

Port Security

Question 13

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API activity within an AWS account, including the identity and source of the request.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 14

A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?

Accepted Answer

Resource Monitor. Resource Monitor is the standard Windows utility for granular monitoring of per-process disk, CPU, and memory activity.

Answer

System Configuration (msconfig)

Answer

Event Viewer

Answer

Task Manager

Question 15

Which of the following best describes the function of a 'container runtime' in a virtualization environment?

Accepted Answer

It executes containerized applications.. The container runtime is responsible for executing containers and managing image layers and namespaces.

Answer

It encrypts network traffic between nodes.

Answer

It virtualizes the hardware layer.

Answer

It provides a web GUI for managing clusters.