CCOA Timed Practice Test 1 — 10 Questions

Question 1

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

10 minute time limit — choose an answer to begin.

Accepted Answer

Time window. In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.

Answer

Throttle field

Answer

Notable event urgency

Answer

Risk score adjustment

Question 2

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Accepted Answer

Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.. When a Nessus Agent is installed but the endpoint does not appear in Tenable.io's Asset Inventory, the first step is to verify the agent's link status and connectivity to the manager using 'nessuscli agent status' (or the equivalent on Windows). This command shows whether the agent is linked, the last connection time, and the manager it is linked to — quickly isolating whether the problem is agent-side linking/network versus a Tenable.io-side configuration issue.

Answer

Reinstall the Nessus Agent using the 'Force Install' flag.

Answer

Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.

Answer

Restart the Windows Management Instrumentation (WMI) service.

Question 3

Which TWO of the following are primary functions of an Information Security Governance program?

Accepted Answer

Strategic alignment. Strategic alignment (A) is a primary function of Information Security Governance because governance ensures that security initiatives, investments, and controls are aligned with the organization's business objectives, strategy, and regulatory obligations. Risk management (D) is also a core governance function, as governance establishes the frameworks, policies, and oversight processes for identifying, assessing, treating, and monitoring information security risks at an enterprise level. Writing code (B) is a software development or engineering activity, not a governance function. Wiring network cables (C) is a physical infrastructure implementation task. Patching server OS (E) is an operational/technical vulnerability management activity, not a governance-level responsibility.

Answer

Writing code

Answer

Wiring network cables

Answer

Patching server OS

Question 4

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

Accepted Answer

To provide continuous monitoring and automated response to threats on endpoints.. EDR solutions continuously collect endpoint telemetry (process execution, file changes, registry modifications, network connections) and use behavioral analytics to detect threats, then automate responses such as isolating a host, killing a process, or quarantining a file. This continuous monitoring plus automated response is the defining purpose of EDR. It operates at the endpoint layer, not the network edge or application layer.

Answer

To block all incoming traffic at the network edge.

Answer

To scan for vulnerabilities in web applications.

Answer

To manage user passwords and enforce complexity.

Question 5

A company is deploying a new web application in a public cloud. The security team must ensure that the application's data at rest is encrypted and that the encryption keys are managed by the cloud provider while still allowing the company to control key rotation. Which cloud key management service should they use?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. AWS KMS customer managed keys allow the customer to define and rotate keys while AWS manages the underlying HSMs. This provides the desired balance: the cloud provider handles the infrastructure, but the customer retains control over key rotation policies. Other services either focus on secrets, in-transit encryption, or require full customer key management, which does not meet the stated requirements.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 6

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Accepted Answer

Running 'whoami' or 'net view'. Discovery involves gathering information about the system and network to plan subsequent steps.

Answer

Installing a backdoor

Answer

Deleting logs to hide traces

Answer

Encrypting files for ransom

Question 7

A CCOA analyst is investigating a suspected insider threat involving unauthorized access to a file server. The analyst needs to correlate user activity with file access events. Which two log sources should the analyst prioritize? (Choose two.)

Accepted Answer

Active Directory authentication logs from domain controllers. To correlate user activity with file access, the analyst needs object access auditing events that identify the user and the file, and authentication logs that confirm the user's logon to the server. Together they establish who accessed what and from where. System, proxy, and firewall logs lack the necessary user-to-file mapping for this investigation.

Answer

Web proxy logs showing internet browsing activity

Answer

Firewall logs showing allowed and denied connections between network segments

Answer

File server system logs showing disk errors and hardware faults

Question 8

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

Accepted Answer

Detection and Analysis. In NIST SP 800-61, the Detection and Analysis phase is where precursors (early warning signs) and indicators of compromise (IoCs) are identified, validated, and used to determine whether an incident has occurred. This phase covers monitoring, alert triage, and incident declaration. The other phases handle readiness, response actions, and review, not attack-signal identification.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 9

A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?

Accepted Answer

Documenting a clear chain of custody for the forensic image from creation to presentation. Chain of custody is the most critical element for admissibility because it provides a chronological record of the evidence's handling, ensuring that it has not been altered or compromised. While encryption, write blockers, and hashing support integrity and confidentiality, they do not replace the need to document who accessed the evidence and under what circumstances. A complete chain of custody allows the court to trust the evidence's authenticity.

Answer

Generating a hash value of the forensic image and storing it separately from the image

Answer

Using a write blocker during imaging to prevent modification of the original disk

Answer

Encrypting the forensic image with a strong algorithm and storing the key in a secure vault

Question 10

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.

Answer

Increasing password complexity

Answer

VLAN isolation

Answer

Firewall rules