CCOA Technology Essentials Practice Test 2 — 15 Questions

Question 1

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advanced Security Settings - Effective Access. The Effective Access tab in Advanced Security Settings calculates the cumulative permissions a specific user or group has on a file or folder, taking into account group memberships, inheritance, and explicit deny entries. This directly answers whether the service account has the required Execute or Read permissions on the executable.

Answer

Task Manager - Details tab

Answer

Local Security Policy (secpol.msc)

Answer

Event Viewer - System Log

Question 2

In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?

Accepted Answer

Protocol: TCP, Port: 443, Source: 10.0.1.0/24. A Security Group rule must match the protocol and port of the intended traffic and scope the source as narrowly as possible. HTTPS uses TCP port 443, and restricting the source to 10.0.1.0/24 limits inbound connections to that specific subnet, satisfying least privilege. This is the only option that combines the correct protocol, correct port, and a scoped source.

Answer

Protocol: UDP, Port: 443, Source: 10.0.1.0/24

Answer

Protocol: TCP, Port: 80, Source: 10.0.1.0/24

Answer

Protocol: All Traffic, Port: All, Source: 0.0.0.0/0

Question 3

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

Accepted Answer

Verify the digital signature of the referenced executable.. Run keys in the Windows Registry are a common persistence mechanism, and the most reliable way to determine whether an entry is malicious is to verify the digital signature of the referenced executable. A valid signature from a trusted publisher strongly suggests legitimacy, while an unsigned, invalid, or revoked signature is a red flag. This is a non-destructive, evidence-preserving step appropriate for forensic analysis.

Answer

Delete the registry key.

Answer

Reboot the server.

Answer

Rename the file to .txt.

Question 4

Which protocol is most appropriate for secure remote management of network infrastructure devices?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted remote access, whereas Telnet, HTTP, and SNMPv1 are insecure.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 5

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

Accepted Answer

DHCP Snooping. DHCP Snooping is a switch feature that filters untrusted DHCP messages and prevents rogue DHCP servers by allowing DHCP server responses only on trusted ports. Implementing DHCP Snooping will block rogue DHCP servers from assigning IP addresses on the network.

Answer

VLAN Tagging

Answer

Dynamic ARP Inspection

Answer

Port Security

Question 6

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. Reviewing CloudTrail logs allows you to see the history of API calls made by a specific IAM role, which is essential for investigating anomalous behavior.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 7

A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?

Accepted Answer

Resource Monitor. Resource Monitor (resmon.exe) provides per-process disk activity, including read/write bytes per second and which files each process is touching, making it the right tool to pinpoint the top writer. It breaks down disk usage by process, file, and response time, which is exactly what is needed for high disk I/O triage. Task Manager shows aggregate disk percentage but not the granular per-process write volume required here.

Answer

System Configuration (msconfig)

Answer

Event Viewer

Answer

Task Manager

Question 8

Which of the following best describes the function of a 'container runtime' in a virtualization environment?

Accepted Answer

It executes containerized applications.. A container runtime is the software layer that actually executes containers — it pulls images, creates namespaces and cgroups, and runs the containerized process. Examples include containerd, CRI-O, and Docker's runtime. It sits below the orchestrator (like Kubernetes) and above the OS kernel, translating container specs into running processes.

Answer

It encrypts network traffic between nodes.

Answer

It virtualizes the hardware layer.

Answer

It provides a web GUI for managing clusters.

Question 9

An analyst needs to verify the hash of a downloaded binary to ensure it has not been tampered with. Which command is used on Windows PowerShell?

Accepted Answer

Get-FileHash. Get-FileHash is the native PowerShell cmdlet that computes a cryptographic hash (default SHA256) of a file, which can be compared against a published hash to verify integrity. It is available in PowerShell 4.0 and later and supports algorithms like SHA1, SHA256, SHA384, SHA512, and MD5.

Answer

Hash-File

Answer

Verify-Binary

Answer

Check-Sum

Question 10

You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this typically signify?

Accepted Answer

An immediate termination of a connection.. In TCP, the RST (reset) flag is used to abruptly terminate a connection. It is sent when a segment arrives that does not match any existing connection, or when a party wants to abort a connection due to an error or policy. This is distinct from a normal connection close, which uses FIN flags.

Answer

A request for retransmission.

Answer

A request for a new connection.

Answer

A data acknowledgment.

Question 11

When reviewing cloud storage buckets, you find one is configured with 'public read access'. What is the risk?

Accepted Answer

Unauthorized data exfiltration.. A bucket configured with public read access allows anyone on the internet to list and download objects, which directly enables unauthorized data exfiltration of any sensitive content stored there. This is one of the most common cloud misconfigurations and a leading cause of data breaches. The risk is confidentiality loss, not availability or injection.

Answer

SQL injection.

Answer

Service denial.

Answer

Increased latency.

Question 12

You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?

Accepted Answer

TLS. TLS (Transport Layer Security) is the standard protocol for encrypting data in transit between a client and a database server, providing confidentiality, integrity, and server authentication via certificates. It operates at the transport layer and is natively supported by database engines (e.g., PostgreSQL sslmode, MySQL REQUIRE SSL, SQL Server Force Encryption). TLS negotiates ephemeral session keys so that even captured traffic cannot be decrypted without the session secret.

Answer

Hashing

Answer

VPN

Answer

AES-256

Question 13

A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?

Accepted Answer

An explicit Deny entry is present.. In Windows ACL evaluation, an explicit Deny entry always overrides any Allow entries, regardless of group membership or inheritance. If Effective Access shows Deny, the most direct explanation is that an explicit Deny ACE exists on the resource or a parent object. This is deterministic behavior in the Windows access check algorithm.

Answer

The server is offline.

Answer

The drive is full.

Answer

They are not in the correct group.

Question 14

You are auditing a web application server. You discover it is running with high privileges. What is the standard security practice to mitigate this risk?

Accepted Answer

Run as a non-privileged service account.. Running a web application server with high privileges means a compromise of the service yields administrative control over the host, so the standard mitigation is to run it under a dedicated non-privileged service account with only the permissions it needs. This enforces least privilege and limits blast radius if the service is exploited. It is a foundational hardening practice across CIS, NIST, and OWASP guidance.

Answer

Use a local administrator account.

Answer

Increase logging levels.

Answer

Disable the firewall.

Question 15

Which TWO of the following are essential components of a secure network design for a segmented corporate network?

Accepted Answer

Virtual Local Area Networks (VLANs). VLANs (B) are essential because they logically partition a physical network into separate broadcast domains, allowing traffic isolation between departments or trust zones and enforcing segmentation at Layer 2. Firewalls between segments (D) are essential because they inspect and control traffic flowing between those VLANs or subnets, enforcing access-control policies and preventing lateral movement across trust boundaries. Together, VLANs provide the segmentation structure and firewalls provide the policy enforcement between segments, which is the core of a secure segmented design. Shared administrative credentials (A) are wrong because they destroy accountability and enable lateral movement if one account is compromised. Hubs (C) are wrong because they broadcast all traffic to every port, eliminating isolation and enabling sniffing. Disabling all internal logging (E) is wrong because logs are required for detection, auditing, and incident response.

Answer

Shared administrative credentials

Answer

Hubs to connect all devices

Answer

Disabling all internal logging