CCOA Technology Essentials Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are primary security controls for securing virtual machines in a production environment?

Accepted Answer

Hypervisor patching. Hypervisor patching (A) is a primary security control because the hypervisor is the trusted computing base that isolates and mediates access between VMs; unpatched hypervisor vulnerabilities (e.g., escape flaws) can let a guest compromise the host and other VMs, so keeping it current is essential. Guest OS patch management (D) is also a primary control because each VM runs its own operating system whose unpatched services, kernels, and libraries are directly exploitable from the network, making OS-level patching necessary to harden the VM itself. Providing full physical access to the VM (B) is not a control but a risk, since physical access enables console tampering, data theft, and bypass of logical protections. Using only physical cabling (C) is irrelevant to VM security, as virtualization relies on virtual switches and logical networking rather than physical cabling alone. Disabling VM encryption (E) weakens security by removing protection for data at rest and in transit, so it is the opposite of a control.

Answer

Providing full physical access to the VM

Answer

Using only physical cabling

Answer

Disabling VM encryption

Question 2

Which TWO of the following are common indicators of a compromised system found during host-based log analysis?

Accepted Answer

Unexpected outbound connections to high-numbered ports. Option B is correct because unexpected outbound connections to high-numbered ports (e.g., 4444, 8080, 31337) often indicate command-and-control (C2) beaconing, reverse shells, or data exfiltration, since legitimate services rarely initiate such traffic from a host. Option D is correct because the creation of new accounts with administrative rights is a classic persistence and privilege-escalation technique attackers use, and it is readily visible in Security event logs (e.g., Windows Event ID 4720 for account creation followed by 4732 for adding to Administrators). Option A is incorrect because stable CPU usage is a sign of normal operation, whereas compromises typically produce spikes, sustained high utilization, or unusual process behavior. Option C is incorrect because standard system update logs reflect routine patching activity and are expected, not an indicator of compromise. Option E is incorrect because successful logins from standard user accounts are normal activity; suspicious indicators would instead be failed login bursts, logins at odd hours, or logins from unusual locations.

Answer

Stable CPU usage patterns

Answer

Standard system update logs

Answer

Successful logins from standard user accounts

Question 3

Which THREE of the following are standard best practices for securing cloud infrastructure?

Accepted Answer

Enable comprehensive audit logging. Option A (Enable comprehensive audit logging) is correct because capturing API activity, authentication events, and resource changes via services like AWS CloudTrail, Azure Monitor/Activity Log, or GCP Cloud Audit Logs provides the traceability needed for detection, incident response, and compliance. Option B (Enable Multi-Factor Authentication) is correct because MFA adds a second authentication factor beyond a password, mitigating credential theft, phishing, and brute-force attacks on privileged cloud accounts. Option D (Implement Principle of Least Privilege) is correct because granting identities only the minimum permissions required (scoped IAM policies, roles, and just-in-time access) reduces the blast radius of compromised credentials or misconfigured services. Option C is wrong because sharing account passwords destroys individual accountability and non-repudiation, and violates standard identity practices; unique named accounts with federation or role assumption should be used instead. Option E is wrong because exposing resources only via public IP addresses increases the attack surface and ignores private networking constructs such as VPCs, private subnets, security groups, and private endpoints.

Answer

Share account passwords between team members

Answer

Use only public IP addresses

Question 4

Which THREE of the following represent critical areas to inspect when a web application has been suspected of an injection attack?

Accepted Answer

Application and database logs. Option A (Application and database logs) is correct because logs are the primary forensic evidence for an injection attack — web server access logs, application error logs, and database audit/SQL logs can reveal malicious payloads such as ' OR '1'='1, UNION SELECT statements, or unexpected error messages that indicate injected queries. Option B (Input validation routines) is correct because injection flaws typically stem from missing or improper validation/sanitization of user-supplied input, so reviewing how the application validates, filters, and escapes input (e.g., whitelisting, parameterization, encoding) directly identifies the vulnerability that allowed the attack. Option D (Database query construction) is correct because the way queries are built determines exploitability — inspecting for string concatenation of user input into SQL/NoSQL/LDAP queries versus the use of parameterized queries or prepared statements reveals the root cause of the injection. Option C (Screen resolution settings) is irrelevant because display configuration has no bearing on how input is processed or how queries are executed. Option E (Network cable integrity) is irrelevant because physical cabling issues relate to connectivity, not to application-layer injection vulnerabilities or their evidence.

Answer

Screen resolution settings

Answer

Network cable integrity

Question 5

Which THREE of the following are common steps in performing a security audit of a Linux system?

Accepted Answer

Verify user account permissions. Option A (Verify user account permissions) is correct because a security audit must check for excessive privileges, weak file/directory permissions, and misconfigured accounts (e.g., via commands like ls -l, find / -perm -4000, or reviewing /etc/passwd and /etc/shadow) to ensure least privilege and detect unauthorized access. Option C (Examine open network ports) is correct because auditors use tools such as ss, netstat, or nmap to identify listening services and exposed ports, then compare them against expected services to find unnecessary or malicious listeners. Option E (Review active processes) is correct because inspecting running processes with ps, top, or systemd-analyze helps detect suspicious, unauthorized, or resource-abusing programs and verify that only approved services are running. Option B (Delete all system logs) is not a valid audit step because logs are critical evidence for detecting and investigating security events; deleting them destroys audit trails and violates forensic integrity. Option D (Disable all disk encryption) is not a valid audit step because encryption protects data at rest, and disabling it would weaken security rather than assess it.

Answer

Delete all system logs

Answer

Disable all disk encryption

Question 6

You are hardening a virtual machine's security. Which action is the most effective way to prevent VM escape attacks?

Accepted Answer

Keep hypervisor and guest tools updated.. VM escape attacks exploit vulnerabilities in the hypervisor or its guest tools to break out of the virtual machine and access the host. Keeping both the hypervisor and guest tools (e.g., VMware Tools, VirtualBox Guest Additions) updated ensures that known vulnerabilities are patched, directly reducing the attack surface for escape techniques. This is the most effective preventive measure because it addresses the root cause—unpatched software—rather than unrelated configuration changes.

Answer

Run the VM as a local administrator.

Answer

Disable the disk.

Answer

Remove the network adapter.

Question 7

What is the function of the 'netstat' command in a Windows environment?

Accepted Answer

To view active network connections.. The netstat command displays active network connections, listening ports, routing tables, and protocol statistics on a Windows system. It is used to identify which processes are communicating over the network and on which ports, making it a fundamental tool for troubleshooting and security analysis.

Answer

To update the system time.

Answer

To flush the DNS cache.

Answer

To change the IP address.

Question 8

In the context of the principle of least privilege, why should you avoid using a root or administrator account for daily system administration?

Accepted Answer

To prevent accidental system-wide changes.. The principle of least privilege dictates that users should be granted only the minimum access rights necessary to perform their job functions. Using a root or administrator account for daily tasks grants unrestricted access to the entire system, so a single typo or malicious command can irreversibly alter or destroy critical files, services, or configurations. By operating under a standard user account and elevating privileges only when required, the blast radius of accidental or malicious actions is dramatically reduced.

Answer

To improve performance.

Answer

To hide administrative activity.

Answer

To comply with hardware requirements.

Question 9

A SOC analyst is investigating suspicious outbound traffic from an internal host to a known command-and-control server. The analyst needs to capture full packet payloads for deep inspection and later forensic analysis. Which tool should the analyst use to capture the traffic on the Linux-based sensor?

Accepted Answer

tcpdump -i eth0 -w capture.pcap host 203.0.113.50. Capturing full packet payloads requires a tool that writes raw packets to a file. tcpdump with the -w option and a host filter accomplishes this, preserving the complete data stream for later forensic examination. Other listed tools either show only connection metadata, generate new traffic, or map network paths, none of which provide the packet contents needed.

Answer

traceroute 203.0.113.50

Answer

nmap -sS -p 1-65535 203.0.113.50

Answer

netstat -an | grep 203.0.113.50

Question 10

A security analyst is examining a Windows event log and notices Event ID 4625 followed by Event ID 4624 with Logon Type 3 from the same source IP within a few seconds. The account used is a local administrator. What is the most likely explanation for this sequence?

Accepted Answer

A successful network logon after a failed attempt, indicating a possible brute-force attack that succeeded.. The combination of a failed logon (4625) immediately followed by a successful network logon (4624, Type 3) using a local administrator account from the same remote IP strongly suggests a brute-force attack that succeeded. Legitimate user error or service account issues would not typically produce this exact pattern with a privileged account and network logon type. This warrants immediate investigation and potential containment.

Answer

A user mistyped their password and then logged in correctly, which is normal user behavior.

Answer

The account was locked out due to multiple failed attempts, then unlocked by an administrator.

Answer

A service account password was updated, causing a failed logon until the service restarted.

Question 11

A SOC analyst is investigating a suspected data exfiltration event on a Windows 10 endpoint. The analyst needs to enumerate all active network connections along with the owning process IDs to identify which process is communicating with an external IP. Which built-in Windows command should the analyst use?

Accepted Answer

netstat -ano. The netstat command with -ano flags provides a comprehensive view of all active TCP connections and listening ports, including the numeric addresses and the owning process identifier. This allows the analyst to correlate a suspicious external connection with a specific process, which is essential for determining whether the traffic is legitimate or indicative of exfiltration.

Answer

route print

Answer

nslookup -type=ANY

Answer

ipconfig /all

Question 12

A company is deploying a new web application in a public cloud. The security team must ensure that the application's data at rest is encrypted and that the encryption keys are managed by the cloud provider while still allowing the company to control key rotation. Which cloud key management service should they use?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. AWS KMS customer managed keys allow the customer to define and rotate keys while AWS manages the underlying HSMs. This provides the desired balance: the cloud provider handles the infrastructure, but the customer retains control over key rotation policies. Other services either focus on secrets, in-transit encryption, or require full customer key management, which does not meet the stated requirements.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 13

A network engineer is designing a demilitarized zone (DMZ) for a company's public-facing web servers. The requirement is to ensure that if a web server is compromised, the attacker cannot directly reach internal database servers. Which control best achieves this segmentation?

Accepted Answer

A firewall rule set that denies all traffic from the DMZ to the internal database subnet. Segmenting the DMZ from the internal network requires an enforcement point that controls traffic between zones. A firewall with a default-deny rule set between the DMZ and the internal database subnet ensures that a compromised web server cannot directly access sensitive data stores. This aligns with defense-in-depth and least privilege, limiting lateral movement. Other controls address different layers and do not provide the required inter-zone restriction.

Answer

Host-based intrusion prevention system (HIPS) on each web server

Answer

VLAN hopping prevention using private VLANs

Answer

Network address translation (NAT) for outbound DMZ traffic

Question 14

A security analyst is investigating a suspected breach and needs to determine whether an attacker moved laterally within the network. The analyst has access to NetFlow records from core switches. Which analysis technique is most effective for identifying lateral movement?

Accepted Answer

Examining NetFlow records for repeated connections from a single internal host to multiple internal hosts on administrative ports. Lateral movement involves an attacker moving from one internal system to another, often using administrative protocols. NetFlow records provide a summary of network conversations, including source and destination IPs and ports. Detecting a single internal host connecting to many internal hosts on administrative ports is a strong indicator of lateral movement, such as scanning or exploitation. This method focuses on east-west traffic and is more effective than examining external connections or high-bandwidth transfers.

Answer

Reviewing NetFlow records for outbound connections to known malicious IP addresses

Answer

Correlating NetFlow records with DNS query logs for internal hosts

Answer

Analyzing NetFlow records for high-bandwidth transfers from internal hosts to external destinations

Question 15

A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large volume of outbound traffic from an internal server to an external IP address over port 53. The analyst suspects DNS tunneling. Which of the following techniques would BEST confirm this suspicion?

Accepted Answer

Analyze the size and entropy of DNS query names and responses.. DNS tunneling encapsulates data within DNS queries and responses, often using subdomains to carry encoded payloads. These encoded strings tend to be long and have high entropy, resembling random characters. By analyzing the size and entropy of DNS query names and responses, an analyst can detect anomalies that deviate from normal DNS traffic. This method directly examines the content, making it the most reliable confirmation technique.

Answer

Check if the external IP is a known DNS server using a reverse DNS lookup.

Answer

Monitor for an increase in the number of DNS queries from the internal server.

Answer

Capture packets and inspect the DNS query types (e.g., A, AAAA, TXT).