CCOA Timed Practice Test 2 — 10 Questions

Question 1

A security analyst is reviewing the configuration of a Windows Server 2022 file server that stores HR records. The server is a member of an Active Directory domain. The analyst finds that the local Administrators group contains the domain group 'Helpdesk_Tier1'. Helpdesk technicians need to reset user passwords and unlock accounts, but they should not have full control over the HR file server. Which action should the analyst take to enforce least privilege while preserving the technicians' ability to perform their duties?

10 minute time limit — choose an answer to begin.

Accepted Answer

Remove Helpdesk_Tier1 from the local Administrators group and delegate the 'Reset Password' and 'Unlock Account' permissions on the relevant Organizational Units.. The helpdesk team needs only two specific Active Directory actions: resetting passwords and unlocking accounts. Delegating those exact permissions at the Organizational Unit level removes their broad local administrative rights on the HR file server while still allowing them to do their job. This is the textbook application of least privilege for administrative delegation in Active Directory.

Answer

Remove Helpdesk_Tier1 from the local Administrators group and add it to the 'Account Operators' group in Active Directory.

Answer

Keep Helpdesk_Tier1 in the local Administrators group but enable the 'Protected Users' security group for all helpdesk accounts.

Answer

Remove Helpdesk_Tier1 from the local Administrators group and configure a Group Policy Object that denies logon to the HR file server for that group.

Question 2

Which TWO of the following are examples of 'Initial Access' tactics?

Accepted Answer

Phishing. In the MITRE ATT&CK framework, Initial Access consists of techniques that adversaries use to gain an entry point into a network, and Phishing (B) is a canonical example because it delivers malicious content via email, links, or attachments to compromise a user's credentials or execute code. Exploiting public-facing applications (D) is also an Initial Access technique (T1190), since it leverages vulnerabilities in internet-exposed services such as web servers or VPN gateways to establish a foothold. Registry modification (A) is a Defense Evasion/Persistence technique, not Initial Access, because it occurs after the adversary already has access. Screen capture (C) is a Collection technique used to gather data from an already-compromised host. Network scanning (E) is Discovery (or Reconnaissance), used to enumerate targets rather than to gain initial entry.

Answer

Registry modification

Answer

Screen capture

Answer

Network scanning

Question 3

A security operations analyst is reviewing the configuration of a newly deployed Windows Server 2022 file server that stores PII. The server has SMB signing disabled. Which of the following best describes the primary risk of leaving SMB signing disabled in this environment?

Accepted Answer

An attacker on the same network segment can perform a man-in-the-middle attack to modify SMB traffic between the client and server.. SMB signing ensures that SMB packets are not altered in transit and that they originate from a trusted source. Without it, an attacker positioned on the network can perform man-in-the-middle attacks, modifying file contents or injecting malicious commands. This is especially critical for a server storing PII, where data integrity and authenticity are paramount.

Answer

Unauthenticated users can mount the file share without providing credentials, leading to unauthorized data access.

Answer

SMB traffic will be sent in clear text, exposing sensitive PII to network sniffing attacks.

Answer

The server will be unable to negotiate SMB 3.0 connections, forcing fallback to the insecure SMB 1.0 protocol.

Question 4

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Accepted Answer

Exploiting an exposed VPN gateway. T1133 External Remote Services refers to adversaries leveraging legitimate, externally facing remote access services — most commonly VPN gateways, RDP, Citrix, or VDI — to gain initial access using valid or stolen credentials. Exploiting an exposed VPN gateway is the textbook example, as attackers frequently target unpatched VPN appliances (e.g., Pulse Secure, Fortinet, Citrix ADC) or use credential stuffing against VPN portals to establish a foothold.

Answer

Exploiting an internal web server

Answer

Phishing a user

Answer

Using a USB drive

Question 5

A security operations center (SOC) analyst is triaging an alert indicating that a user's workstation has been infected with malware that is attempting to communicate with a command-and-control (C2) server. The analyst wants to quickly identify the process responsible for the network connection. Which of the following tools is MOST appropriate for this task on a Windows system?

Accepted Answer

netstat -ano. netstat -ano is the correct tool because it lists active connections with the owning process ID, allowing the analyst to quickly identify the malicious process. The other tools provide DNS or routing information but do not correlate connections to processes, which is essential for rapid triage.

Answer

ipconfig /displaydns

Answer

route print

Answer

nslookup

Question 6

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. Reviewing CloudTrail logs allows you to see the history of API calls made by a specific IAM role, which is essential for investigating anomalous behavior.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 7

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

Accepted Answer

Token-based sign-in with no MFA. 'Token-based' sign-ins that lack a corresponding MFA challenge or device registration are strong indicators of session theft or pass-the-token attacks.

Answer

Successful MFA challenge

Answer

Location change

Answer

Successful password-based sign-in

Question 8

During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?

Accepted Answer

A central database containing customer Personally Identifiable Information (PII) and credit card data.. A central database containing PII and credit card data represents the highest business impact if compromised, triggering regulatory penalties (GDPR, PCI DSS), financial loss, and reputational damage. This combination of sensitive data types and centralization makes it a textbook 'High' criticality asset. The other options have minimal confidentiality, integrity, or availability impact.

Answer

A guest Wi-Fi access point used for public internet access.

Answer

A local printer used for departmental documents.

Answer

An internal employee breakroom display showing weather and news.

Question 9

Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?

Accepted Answer

Activate the data breach response plan. Option B is correct because once an incident is confirmed to involve sensitive PII, the organization's data breach response plan must be activated to guide containment, investigation, notification, and remediation steps in a consistent, compliant manner. Option E is correct because legal counsel must be notified promptly so they can assess regulatory notification obligations (e.g., GDPR, HIPAA, state breach laws), preserve privilege, and advise on liability and disclosure requirements. The unmarked options do not belong: changing all company Wi-Fi passwords (A) is an unrelated blanket action that does not address the PII breach, posting an intranet message (C) is a communication step that could prematurely disclose information and is not a required response action, and deleting all user databases (D) would destroy evidence and potentially worsen the breach rather than contain it.

Answer

Change all company Wi-Fi passwords

Answer

Post a message on the company intranet

Answer

Delete all user databases

Question 10

A threat hunter is reviewing logs for signs of adversary reconnaissance. Which TWO of the following activities are considered Discovery techniques in the MITRE ATT&CK framework? (Choose two.)

Accepted Answer

Running 'net user /domain' to list domain users. The correct answers are running 'net user /domain' and using 'netstat -ano' because both are Discovery techniques that gather information about users and network connections. The other options are Persistence, Credential Access, and Defense Evasion, which serve different purposes in the attack lifecycle.

Answer

Creating a scheduled task to run a payload at logon

Answer

Using 'wevtutil cl' to clear Windows event logs

Answer

Dumping LSASS memory to extract credentials