CCOA Technology Essentials Practice Test 4 — 15 Questions

Question 1

A security administrator is configuring a Linux web server to run as a non-privileged user. The server needs to bind to TCP port 80. Which capability should be assigned to the web server binary to allow binding to a privileged port without running as root?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CAP_NET_BIND_SERVICE. In Linux, binding to TCP or UDP ports below 1024 traditionally requires root privileges. The CAP_NET_BIND_SERVICE capability allows a non-root process to bind to these privileged ports. By assigning this capability to the web server binary, the administrator can run the service as a non-privileged user while still allowing it to listen on port 80. This reduces the risk of a compromised web server gaining full root access. Other capabilities like CAP_NET_RAW or CAP_SYS_ADMIN are not required and would violate least privilege.

Answer

CAP_DAC_OVERRIDE

Answer

CAP_NET_RAW

Answer

CAP_SYS_ADMIN

Question 2

An analyst at a financial firm is reviewing network flow logs and notices a workstation repeatedly initiating SMB connections to multiple internal servers on TCP port 445, followed by large outbound data transfers to an external IP. The workstation's user reports no unusual activity. The analyst suspects lateral movement and data exfiltration. Which technology should the analyst use to correlate these network events with endpoint process and file activity to confirm the attack chain?

Accepted Answer

Security information and event management (SIEM) with endpoint detection and response (EDR) integration. Correlating network flows with endpoint telemetry requires a platform that ingests both network and host data. SIEM provides centralized correlation, and EDR supplies granular process and file activity. Together, they enable the analyst to reconstruct the sequence from initial SMB connections to data staging and outbound transfer, confirming lateral movement and exfiltration.

Answer

Network access control (NAC) with 802.1X authentication

Answer

Intrusion prevention system (IPS) with signature-based detection

Answer

Full packet capture (PCAP) with deep packet inspection (DPI)

Question 3

A security operations center (SOC) is implementing a new SIEM and needs to ensure that log data from various sources is normalized for effective correlation. Which TWO of the following are key considerations when normalizing log data? (Choose two.)

Accepted Answer

Ensuring that timestamps are converted to a consistent time zone and format.. Normalization involves transforming log data into a consistent format for analysis. Two critical aspects are adopting a common schema to map fields uniformly and standardizing timestamps to a single time zone and format. These steps enable the SIEM to correlate events across disparate sources by ensuring that similar data elements are comparable and that events can be sequenced accurately.

Answer

Encrypting all log data at rest to protect sensitive information.

Answer

Retaining raw logs in their original format for compliance purposes.

Answer

Parsing logs using regular expressions to extract relevant fields.

Question 4

A security operations center (SOC) analyst is reviewing logs from a Windows server and notices Event ID 4625 (An account failed to log on) occurring repeatedly for the same user account from a single source IP within a short time frame. Which type of attack does this pattern most likely indicate?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. A high volume of these events for the same user account from a single source IP in a short time frame is a hallmark of a brute-force password attack, where an attacker systematically tries many passwords. This pattern differs from other attacks like pass-the-hash or Kerberoasting, which typically involve different event IDs and success patterns. The SOC analyst should treat this as a potential brute-force attempt and consider mitigation such as account lockout and source IP blocking.

Answer

Kerberoasting attack

Answer

Pass-the-hash attack

Answer

Golden ticket attack

Question 5

A security analyst is reviewing firewall logs and sees that an internal web server is making DNS queries to an external IP address that is not a known DNS resolver. The queries are for random-looking subdomains of a domain with no reputation. The volume of queries is high and consistent. The analyst suspects DNS tunneling for command and control. Which technology would best detect this activity by analyzing DNS query patterns and payload characteristics?

Accepted Answer

Network-based DNS security monitoring with machine learning. DNS tunneling encodes data in DNS queries and responses, often using random subdomains and high query volumes. Network-based DNS security monitoring with machine learning analyzes these patterns and payload characteristics to detect covert channels. It baselines normal DNS behavior and flags anomalies, providing the best detection for the described activity.

Answer

Host-based antivirus with signature updates

Answer

Web application firewall (WAF) with OWASP rules

Answer

Endpoint detection and response (EDR) with process monitoring

Question 6

A security operations center (SOC) is implementing network segmentation to protect critical assets. Which TWO of the following are essential components of a secure segmented network design? (Choose two.)

Accepted Answer

Using VLANs to logically separate network traffic. Secure network segmentation requires both logical separation and enforcement of access controls. VLANs provide the logical separation, while firewalls between segments enforce policies to restrict traffic. Together, they limit lateral movement and protect critical assets. Flat topologies, endpoint-only protection, and promiscuous mode do not achieve segmentation and may introduce risks.

Answer

Enabling promiscuous mode on all switches to monitor traffic

Answer

Implementing a flat network topology to simplify management

Answer

Relying solely on endpoint antivirus for protection

Question 7

A security operations center is reviewing its endpoint detection and response (EDR) coverage. The team wants to ensure that the EDR solution can detect and respond to threats that use fileless techniques and living-off-the-land binaries (LOLBins). Which two capabilities are most critical for the EDR to provide this coverage? (Choose two.)

Accepted Answer

Script block logging and AMSI integration on Windows endpoints. Fileless attacks and LOLBin abuse rely on trusted system tools and in-memory execution, so EDR must monitor process behavior and command-line arguments, and leverage script block logging and AMSI to inspect script content. These capabilities provide the visibility needed to detect and respond to such threats, whereas encryption, vulnerability scanning, and segmentation do not address endpoint detection.

Answer

Periodic vulnerability scanning of installed applications

Answer

Network segmentation between user and server VLANs

Answer

Full disk encryption of endpoint storage

Question 8

A company is deploying a new web application and wants to ensure that it is protected against SQL injection attacks. The application uses a backend database. Which of the following is the MOST effective mitigation to prevent SQL injection?

Accepted Answer

Using parameterized queries (prepared statements) for all database interactions.. SQL injection occurs when user input is interpreted as SQL code. Parameterized queries, also known as prepared statements, ensure that input is bound to parameters and never executed as code. This approach is universally recommended by security standards such as OWASP. It effectively neutralizes SQL injection regardless of the input's content, making it the most reliable mitigation.

Answer

Escaping all user-supplied input using a blacklist of dangerous characters.

Answer

Implementing a web application firewall (WAF) with SQL injection rules.

Answer

Storing the database on a separate server with restricted network access.

Question 9

A security operations center (SOC) analyst is investigating a suspected breach. The attacker used PowerShell to download and execute a payload in memory, leaving minimal disk artifacts. The analyst needs to reconstruct the attack by examining Windows event logs. Which Windows event log source should the analyst prioritize to find PowerShell script block logging and module logging details?

Accepted Answer

Microsoft-Windows-PowerShell/Operational. PowerShell script block logging and module logging are written to the Microsoft-Windows-PowerShell/Operational log. Event ID 4104 captures script blocks, and 4103 captures module and pipeline execution. These events provide the actual code and commands, enabling reconstruction of in-memory attacks. Other logs lack this level of detail.

Answer

Application

Answer

Security

Answer

System

Question 10

A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts to various external IP addresses on port 445. The analyst suspects a compromised host is attempting to spread laterally or exfiltrate data. Which protocol is associated with port 445, and what is the primary security concern?

Accepted Answer

SMB; it can be used for file sharing and remote code execution, and outbound traffic may indicate data exfiltration or worm propagation.. Port 445 is the standard port for SMB, which is used for file sharing and can be exploited for remote code execution, data exfiltration, and worm propagation. Outbound SMB traffic to external IPs is a red flag and should be blocked at the perimeter to prevent data loss and lateral movement.

Answer

NetBIOS; it is used for legacy Windows networking and outbound traffic is normal.

Answer

LDAP; it is used for directory services and outbound traffic may indicate directory enumeration.

Answer

RDP; it allows remote desktop access and outbound traffic may indicate unauthorized remote control.

Question 11

A security analyst is examining a suspicious PowerShell script that was executed on a Windows endpoint. The script appears to download and execute a payload from a remote server. Which of the following PowerShell features is MOST likely being abused to obfuscate the malicious code?

Accepted Answer

Base64 encoding of the command using the -EncodedCommand parameter.. Base64 encoding with the -EncodedCommand parameter is a widely used obfuscation technique in malicious PowerShell scripts. It transforms the entire command into a single encoded string, which can be executed directly by PowerShell. This hides the script's logic from plain sight and can bypass simple string-based detection. Security analysts should decode such strings to understand the script's behavior.

Answer

Using the Invoke-Expression cmdlet to execute dynamically constructed strings.

Answer

Using the Start-Job cmdlet to run the payload in a background job.

Answer

Leveraging PowerShell profiles to automatically run scripts at startup.

Question 12

A company is migrating its on-premises workloads to a hybrid cloud environment. The security team must ensure that data stored in the cloud object storage service is encrypted at rest and that the encryption keys are managed by the organization, not the cloud provider. The team also needs the ability to revoke access to the keys immediately if a compromise is suspected. Which key management approach should the team implement?

Accepted Answer

Customer-managed keys (CMK) using a hardware security module (HSM) in the cloud. Customer-managed keys with an HSM give the organization full control over key lifecycle, including the ability to revoke access immediately by disabling the key. Provider-managed keys and SSE-S3 leave control with the cloud provider, while client-side encryption with local keys does not integrate with cloud at-rest encryption and complicates revocation.

Answer

Server-side encryption with provider-managed keys (SSE-S3)

Answer

Provider-managed keys with automatic rotation

Answer

Client-side encryption with locally stored keys

Question 13

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered two days ago. The analyst needs to perform dynamic analysis of the URL to determine if it leads to a malicious payload. Which two actions should the analyst take to safely analyze the URL and gather threat intelligence? (Choose two.)

Accepted Answer

Query threat intelligence platforms for the domain's reputation and associated indicators of compromise.. Submitting the URL to a sandbox allows safe dynamic analysis, recording network traffic and file downloads to identify malicious behavior. Querying threat intelligence platforms provides reputation and associated indicators without direct interaction. Together, these actions safely determine if the URL is malicious and gather actionable intelligence.

Answer

Use a web browser on the analyst's workstation to visit the URL and inspect the page content.

Answer

Perform a WHOIS lookup to obtain the registrar and registrant details of the domain.

Answer

Run a command-line tool like curl to download the URL's content to the analyst's workstation for inspection.

Question 14

During an investigation, a CCOA analyst observes that a Linux web server's /var/log/auth.log shows repeated successful sudo commands by the www-data account, which should never have interactive privileges. The analyst must preserve volatile evidence before remediation. Which action best follows accepted order of volatility while enabling later forensic reconstruction?

Accepted Answer

Capture volatile data with a script that records running processes, network sockets, and loaded kernel modules, then acquire the auth.log and relevant file metadata.. Order of volatility requires collecting the most transient artifacts first, which in this scenario means live process, network, and kernel state, before acquiring persistent files such as auth.log. Halting services, rebooting, or modifying accounts destroys volatile evidence and can alter timestamps. Capturing volatile data and then acquiring logs and metadata preserves both live and persistent evidence for reconstruction.

Answer

Change the www-data password and remove it from the sudoers group to contain the incident, then review auth.log for further unauthorized commands.

Answer

Reboot the server into a trusted rescue environment to ensure no attacker processes interfere, then image the disk and parse auth.log from the image.

Answer

Immediately run systemctl stop apache2 to halt the compromised service, then copy /var/log/auth.log to external media.

Question 15

A CCOA analyst is hardening a Kubernetes cluster and wants to prevent any container from running with root privileges or escalating to root inside the pod. Which Kubernetes security control directly enforces this at admission time?

Accepted Answer

Apply a Pod Security Admission policy with the restricted profile to the namespace, which enforces runAsNonRoot, disallows privilege escalation, and drops capabilities.. Pod Security Admission with the restricted profile enforces security context requirements at admission time, including runAsNonRoot and allowPrivilegeEscalation false, which directly blocks root containers and privilege escalation. NetworkPolicy, audit logging, and resource quotas address network, detection, and resource concerns respectively, none of which prevent a container from running with elevated privileges.

Answer

Enable audit logging on the API server and forward events to a SIEM for alerting on privileged pod creation.

Answer

Set resource quotas and limit ranges on the namespace to cap CPU and memory consumption per pod.

Answer

Configure a NetworkPolicy that denies all ingress and egress traffic to pods in the namespace.