CCOA Technology Essentials — Timed 20 Questions

Question 1

A SOC analyst observes excessive traffic on port 443 originating from an internal server to an unknown external IP. Which command should the analyst run on a Linux-based server to identify the specific process ID (PID) associated with this connection?

20 minute time limit — choose an answer to begin.

Accepted Answer

lsof -i :443. The 'netstat -tulpn' or 'ss -tulpn' command is standard for mapping open ports to specific process IDs in Linux environments.

Answer

ps -ef | grep 443

Answer

route -n

Answer

tcpdump -i eth0 port 443

Question 2

A cloud-based application is suffering from slow database queries. You suspect a misconfigured connection pool. Which log type in the cloud provider's console should you examine first?

Accepted Answer

CloudWatch Application Insights. Performance logs or Application Performance Monitoring (APM) logs are the standard tools for identifying bottlenecks in database connectivity.

Answer

Audit logs

Answer

Flow logs

Answer

IAM logs

Question 3

You are hardening a web server. Which directive in an Apache configuration file helps prevent Clickjacking attacks?

Accepted Answer

X-Frame-Options: SAMEORIGIN. The 'X-Frame-Options' header prevents the site from being embedded in iframes, which is the primary vector for clickjacking.

Answer

Strict-Transport-Security

Answer

Content-Security-Policy: default-src 'self'

Answer

X-XSS-Protection: 1

Question 4

You are managing a Linux server that has become unresponsive. You suspect a 'fork bomb'. How can you limit the number of processes a user can run to prevent this?

Accepted Answer

Modify /etc/security/limits.conf. The 'ulimit' command, specifically the 'u' flag, allows setting limits on the number of processes per user.

Answer

Change the root password

Answer

Disable the swap partition

Answer

Use iptables

Question 5

In an Active Directory environment, which tool is used to monitor for unauthorized modifications to Group Policy Objects (GPOs)?

Accepted Answer

Group Policy Management Console (GPMC) reports. Active Directory replication and audit logs are monitored to detect changes to GPOs, and the 'Advanced Audit Policy Configuration' can be set to log these events.

Answer

Active Directory Users and Computers

Answer

Registry Editor

Answer

DNS Manager

Question 6

A security analyst at a financial firm is reviewing a suspicious email that appears to come from a known vendor. The email contains a link to an external site that prompts the user to enter credentials. The analyst suspects a phishing attack. Which of the following should the analyst examine FIRST to determine the legitimacy of the email?

Accepted Answer

The email's SMTP headers, including Received and Return-Path fields.. SMTP headers are the primary source of truth for email origin and routing. They contain Received chains that show the path the message took, and Return-Path that indicates the envelope sender. Attackers often spoof the From header, but the Received headers are added by mail servers and are harder to fake. Analyzing these headers first allows the analyst to identify inconsistencies and potential spoofing.

Answer

The email's digital signature, if present, using the sender's public key.

Answer

The email's attachment file hash, comparing it to known malware databases.

Answer

The email's SPF, DKIM, and DMARC alignment by querying DNS records.

Question 7

A security analyst is reviewing network traffic and observes a high volume of DNS queries for randomly generated subdomains of a single domain, such as 'a1b2c3.example.com', 'd4e5f6.example.com'. The queries are of type TXT and the responses contain long strings of encoded data. Which technique is most likely being used?

Accepted Answer

DNS tunneling for data exfiltration. The use of randomly generated subdomains under a single domain, combined with TXT record queries and encoded responses, is a hallmark of DNS tunneling. Attackers use this to exfiltrate data or maintain command-and-control by hiding data in DNS traffic, which is often allowed through firewalls. Other techniques like DGA, cache poisoning, or fast flux do not match the observed pattern of encoded data in subdomains.

Answer

DNS cache poisoning attack

Answer

Domain generation algorithm (DGA) for malware command-and-control

Answer

Fast flux DNS for botnet resilience

Question 8

A security analyst is examining a Linux server that is suspected of being compromised. The analyst runs `ss -tulpn` and observes an unfamiliar process listening on TCP port 4444. To identify the process executable and its command line, which command should the analyst use next?

Accepted Answer

cat /proc//cmdline. The /proc filesystem exposes detailed process information. Reading /proc//cmdline yields the full command line, and /proc//exe resolves to the executable path. This is the most reliable method to identify exactly what binary is listening and with what arguments, which is essential for triage of a suspected compromise.

Answer

netstat -tulpn | grep 4444

Answer

lsof -i :4444

Answer

ps -p <PID> -o pid,cmd

Question 9

A security analyst is implementing TLS for a new web application. The analyst must select cipher suites that provide forward secrecy and strong encryption. Which two of the following cipher suites meet these requirements? (Choose two.)

Accepted Answer

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384. Forward secrecy requires an ephemeral key exchange such as ECDHE or DHE, ensuring that session keys are not derivable from the server's long-term private key. Strong encryption in modern TLS typically means using AEAD modes like GCM. The cipher suites TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 both use ECDHE for forward secrecy and AES-GCM for authenticated encryption. The other options either lack forward secrecy (RSA, PSK) or use CBC mode, which is not considered as strong due to padding oracle vulnerabilities.

Answer

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

Answer

TLS_PSK_WITH_AES_128_GCM_SHA256

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Question 10

A CCOA analyst is reviewing a capture from a mirrored switch port and needs to confirm whether a suspicious outbound session used TLS 1.3 with a valid server certificate chain. The analyst must determine the negotiated protocol version and the issuer of the leaf certificate without altering the traffic. Which Wireshark capability should the analyst rely on?

Accepted Answer

Display filter tls.handshake.type == 2, then inspect the Server Hello extensions and the Certificate message fields in the packet detail pane.. Confirming TLS 1.3 and the certificate issuer requires reading the Server Hello supported_versions extension plus the Certificate handshake message in the dissected packet details. Port-based inference and raw payload inspection fail because TLS 1.3 encrypts handshake material, while Client Hello filtering captures the wrong direction of the exchange. Only direct inspection of the server handshake fields yields accurate, defensible evidence.

Answer

Apply the filter ssl.handshake.type == 1 and export the associated objects to reconstruct the server certificate from the TLS record layer.

Answer

Use the protocol hierarchy statistics window to confirm TLS traffic exists, then infer the version from the port number and assume the issuer from the destination domain.

Answer

Display filter tcp.port == 443, then read the raw TCP payload bytes to locate the ASCII strings for the negotiated version and issuer name.

Question 11

A security analyst is examining a memory dump from a compromised Windows system. The analyst wants to identify injected code or reflective DLL loading that may not be visible in the process list. Which Volatility 3 plugin should the analyst use to detect hidden or unlinked processes and injected code?

Accepted Answer

windows.psscan. windows.psscan in Volatility 3 scans memory for process structures independently of the active process list, allowing detection of unlinked or hidden processes. It is the primary plugin for finding processes that rootkits may hide. While malfind can detect injected code, it does not find hidden processes, so psscan is the best fit for the described requirement.

Answer

windows.malfind

Answer

windows.pslist

Answer

windows.netscan

Question 12

A CCOA analyst is investigating a suspected malware infection on a Windows 10 endpoint. The analyst wants to examine the list of processes that are configured to start automatically at system boot, including those in the Run registry keys and Startup folders. Which built-in Windows tool should the analyst use to view and manage these startup items?

Accepted Answer

Autoruns. Autoruns is designed specifically to enumerate all autostart extensibility points on Windows, including Run registry keys, Startup folders, scheduled tasks, and services. It provides a one-stop view with rich metadata like digital signatures and paths. Task Manager, msconfig, and Event Viewer each show only partial information or logs, making them insufficient for a comprehensive startup item investigation.

Answer

System Configuration (msconfig)

Answer

Event Viewer

Answer

Task Manager

Question 13

A CCOA analyst is configuring a Snort IDS to detect a specific type of attack. The analyst wants to create a rule that alerts when an inbound TCP packet to the web server on port 80 contains the string 'cmd.exe' in the payload, and the packet is from any external IP. Which two Snort rule header components are required to match this traffic? (Choose two.)

Accepted Answer

content:"cmd.exe";. The required components are the rule header that specifies TCP, inbound direction, and port 80, and the content match for 'cmd.exe'. The header must use alert tcp with source $EXTERNAL_NET and destination $HTTP_SERVERS port 80. The content option must be present to detect the payload string. Other options either use the wrong protocol, wrong direction, or add unnecessary modifiers.

Answer

alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any

Answer

alert udp $EXTERNAL_NET any -> $HTTP_SERVERS 80

Answer

content:"cmd.exe"; nocase;

Question 14

When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?

Accepted Answer

The VM acts as a direct node on the physical network.. A bridged network adapter connects the VM's virtual NIC directly to the physical network segment, making the VM appear as an independent host with its own MAC and IP address. From the network's perspective, the VM is a peer of the physical host and other devices — it can send and receive broadcast traffic, obtain DHCP leases, and be reached directly by other nodes. This expands the attack surface because the VM is no longer shielded by the host's network stack.

Answer

The VM is isolated from the physical network.

Answer

The VM can only communicate with the host.

Answer

The VM uses the host's IP address.

Question 15

You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?

Accepted Answer

AIDE. AIDE (Advanced Intrusion Detection Environment) is a host-based file integrity monitoring tool that creates a cryptographic database of file attributes (hashes, permissions, inodes, timestamps) and compares the live filesystem against it to detect unauthorized changes. It is specifically designed to catch tampering with system binaries, configuration files, and other critical files on Linux hosts like RHEL. Running 'aide --check' against a known-good baseline reveals added, removed, or modified files.

Answer

firewalld

Answer

systemctl status

Answer

yum check-update

Question 16

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Accepted Answer

Advanced Security Settings - Effective Access. The Effective Access tab in Advanced Security Settings calculates the cumulative permissions a specific user or group has on a file or folder, taking into account group memberships, inheritance, and explicit deny entries. This directly answers whether the service account has the required Execute or Read permissions on the executable.

Answer

Task Manager - Details tab

Answer

Local Security Policy (secpol.msc)

Answer

Event Viewer - System Log

Question 17

In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?

Accepted Answer

Protocol: TCP, Port: 443, Source: 10.0.1.0/24. A Security Group rule must match the protocol and port of the intended traffic and scope the source as narrowly as possible. HTTPS uses TCP port 443, and restricting the source to 10.0.1.0/24 limits inbound connections to that specific subnet, satisfying least privilege. This is the only option that combines the correct protocol, correct port, and a scoped source.

Answer

Protocol: UDP, Port: 443, Source: 10.0.1.0/24

Answer

Protocol: TCP, Port: 80, Source: 10.0.1.0/24

Answer

Protocol: All Traffic, Port: All, Source: 0.0.0.0/0

Question 18

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

Accepted Answer

Verify the digital signature of the referenced executable.. Run keys in the Windows Registry are a common persistence mechanism, and the most reliable way to determine whether an entry is malicious is to verify the digital signature of the referenced executable. A valid signature from a trusted publisher strongly suggests legitimacy, while an unsigned, invalid, or revoked signature is a red flag. This is a non-destructive, evidence-preserving step appropriate for forensic analysis.

Answer

Delete the registry key.

Answer

Reboot the server.

Answer

Rename the file to .txt.

Question 19

Which protocol is most appropriate for secure remote management of network infrastructure devices?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted remote access, whereas Telnet, HTTP, and SNMPv1 are insecure.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 20

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

Accepted Answer

DHCP Snooping. DHCP Snooping is a switch feature that filters untrusted DHCP messages and prevents rogue DHCP servers by allowing DHCP server responses only on trusted ports. Implementing DHCP Snooping will block rogue DHCP servers from assigning IP addresses on the network.

Answer

VLAN Tagging

Answer

Dynamic ARP Inspection

Answer

Port Security