ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) (CCOA) — Questions 1–75

Memory-resident process structures retain parent-child relationships and command lines even when the executable is deleted or the process is hidden from the live API. Anomalous chains, such as a browser spawning a command shell, strongly indicate injection or malicious execution. This artifact is volatile and unavailable after reboot, making it a priority in memory forensics for detecting stealthy activity.

Using WMI to create a process on a remote host with compromised credentials is a classic Lateral Movement technique (T1047). It allows the adversary to move from one system to another and execute code remotely. The use of valid domain credentials and remote process creation directly aligns with the goal of expanding access within the network.

Selecting manual status update leaves the notable event in 'In Progress' until an analyst changes it, rather than auto-closing or auto-advancing on a timer or rule. This satisfies the requirement that status remains until a specific analyst manually updates it.

The perimeter network sits between trusted internal networks and untrusted external ones, so it forms the primary boundary where traffic is filtered and inspected first. Addressing it initially establishes the outermost control before hardening internal segments.

Host isolation enforces network containment at the endpoint, blocking all inbound and outbound traffic except the Falcon sensor's channel to the cloud. This severs the adversary's lateral movement paths while preserving the responder's Real Time Response session, which is required to pull memory dumps remotely.

AIDE maintains a cryptographic hash database of file attributes, detecting unauthorised changes to system binaries on Red Hat Enterprise Linux. It satisfies the integrity verification requirement by comparing current hashes against the stored baseline, flagging any modification to monitored files.

T1537 describes adversaries copying data from a victim environment into adversary-controlled cloud storage, so it maps to the Exfiltration tactic. The cloud account is merely the destination, not a separate technique, making exfiltration the correct categorisation.

Command and Control establishes an ongoing channel between the compromised host and attacker infrastructure, letting the adversary issue instructions and receive output. This sustained management distinguishes C2 from initial exploitation or lateral movement, satisfying the tactic's goal of remote direction of the victim.

Web proxy logs record outbound HTTP and HTTPS requests with URLs, user identities and response sizes. They expose command-and-control callbacks and data exfiltration to external destinations, satisfying the breach-detection requirement by revealing suspicious egress traffic that other log sources miss.

The `client.geographicalContext.proxyType` field explicitly identifies anonymising proxies, including Tor exit nodes and VPN services, satisfying the requirement to determine whether the session originated from anonymised infrastructure. Unlike raw IP addresses, which require external lookups, this field provides Okta's own classification directly within the log event.

Full-disk encryption protects data at rest by rendering the storage unreadable without the decryption key, directly mitigating physical theft or disk imaging. If the drive is removed, the ciphertext is useless without proper key material. This control specifically addresses the threat of stolen or copied storage media containing payment card data, making it the right choice for the scenario.

Adversaries performing T1005 search local directories for document extensions such as .docx or .xlsx to locate and stage valuable data before exfiltration. This action directly matches the technique's focus on collecting files from the compromised host's local file system.

Keeping personal data within the country's borders satisfies the localization requirement, while replicating anonymized or aggregated data allows global analytics without exposing personal information. This architecture respects the legal constraint and supports business processing needs. It separates regulated personal data from derived, non-personal datasets, which is a common pattern for meeting data residency and privacy obligations simultaneously.

Availability ensures timely and reliable access to data by authorized users. Immutable offline backups allow the organization to restore patient records after ransomware encrypts production systems, directly preserving access to care-critical information. This matches the CIO's requirement that records remain available during an incident, making availability the correct principle.

The 'reg save' commands are used to extract the SAM and SYSTEM registry hives, which contain password hashes. This is a classic Credential Access technique (T1003 OS Credential Dumping). By saving these hives, the attacker can later extract credentials offline, gaining access to accounts. The subsequent exfiltration of these files further confirms the intent to steal credentials.

Application authentication logs are generated by the login service itself and explicitly record the outcome (success or failure), the submitted username, and the source IP or session identifier. They capture failures even when the HTTP response is a 200 OK with an error message, which access logs miss. For a credential-stuffing investigation, these logs provide the authoritative, per-attempt evidence needed to confirm the attack and scope affected accounts.

A DDoS attack floods the database with traffic, exhausting resources so legitimate users cannot connect. This directly compromises availability, which concerns ensuring timely and reliable access to data for authorised users, rather than confidentiality or integrity.

A risk matrix is a qualitative tool that maps risks based on likelihood and impact, often using descriptive scales such as low, medium, and high. It helps prioritize risks by categorizing them into different levels of severity. This method relies on expert judgment to assign ratings.

Netstat enumerates active TCP connections, listening ports, and protocol statistics by querying the local TCP/IP stack, satisfying the stem's requirement to inspect current network activity. Unlike ping, which tests reachability, or ipconfig, which displays adapter configuration, netstat reports established sessions and their associated endpoints and states.

Phishing-resistant multi-factor authentication, such as hardware security keys or passkeys, prevents attackers from replaying stolen credentials even if a password is captured. For the cloud management plane, this directly blocks credential-based attacks that rely on password theft or real-time phishing proxies, making it one of the strongest identity protections available.

T1203 describes adversaries exploiting vulnerabilities in client applications, such as browsers, office suites or document readers, to execute code on a victim's system. The technique's defining axis is abuse of a software flaw rather than user action, so it implies the attacker targeted an application vulnerability.

Stopping the Windows Defender service disables a key security control and is categorized under Defense Evasion as Impair Defenses. By turning off antivirus protection, the adversary prevents the tool from detecting or blocking subsequent malicious activity. This directly weakens the host's defenses, fitting the tactic precisely.

ALE is calculated as SLE x ARO. The SLE is $500,000 x 0.20 = $100,000. Multiplying by the ARO of 3 gives $100,000 x 3 = $300,000. This represents the expected annual loss from DDoS attacks and is the correct quantitative risk value used to justify countermeasure spending.

Wireshark decodes hundreds of protocols and reassembles streams, enabling deep packet inspection to spot exfiltration payloads, beaconing, and covert channels within the PCAP. Its protocol dissectors and filtering satisfy the deep-analysis requirement; ping, traceroute, and netstat cannot parse captured packet contents.

Creating a new Windows service to run a malicious executable at startup is a classic Persistence technique. T1543.003 specifically covers the creation or modification of Windows services. The service ensures the malicious code runs automatically, maintaining access. This directly matches the scenario.

System owner/user discovery counts as a Discovery technique because it identifies who owns or uses an asset, satisfying the inventory-building constraint before assessment begins. Discovery establishes what exists and who is responsible for it, distinct from later phases such as vulnerability scanning or configuration hardening.

TLS encrypts data in transit between client and database, directly satisfying the in-transit encryption requirement. It negotiates a session key via handshake, so credentials and query results cannot be read if intercepted on the network path.

T1555 targets credentials stored in password managers and applications. Chromium-based browsers persist saved usernames and passwords in a SQLite 'Login Data' database, encrypted with the local profile key, making that file the primary artefact attackers harvest under this technique.

ICMP Echo Request packets carrying unusually large payloads indicate data being smuggled inside ICMP, since normal pings use small fixed payloads. This pattern is characteristic of ICMP tunnelling, where attackers encapsulate traffic within permitted ICMP packets to bypass filtering.

BitLocker encrypts fixed drives with AES, rendering data unreadable without the recovery key or TPM-bound authentication. This directly satisfies the physical access constraint: if a device is stolen or its drive removed, the attacker cannot read the volume offline. Enforcing it across all fixed drives closes the gap left by unencrypted secondary partitions.

Restricting write access to the service binary folder prevents attackers from planting malicious DLLs that the service might load.

A Golden Ticket is a forged Kerberos TGT signed with the compromised KRBTGT hash, so the domain controller never issued it. Detection hinges on anomalous TGT properties: an abnormally long lifetime (default 10 hours, often set to years) and missing corresponding 4768 issuance events, satisfying the stem's log-indicator requirement.

Mandatory peer review and automated security gates insert a human and machine verification step between a compromised credential and production. Even if an attacker holds valid developer credentials, unreviewed malicious commits cannot merge, directly addressing the scenario's root cause. This is a preventive administrative and technical control combination that constrains the blast radius of credential compromise.

Remote access software covers the use of legitimate remote monitoring and management tools to maintain access. Because the RMM tool is signed and already present for administrative purposes, the attacker can blend in with normal IT activity. This technique specifically addresses adversaries leveraging these tools for command and control and persistence, which matches the scenario exactly.

A set RST flag signals an abrupt teardown rather than graceful closure: one endpoint forcibly aborts the TCP session, often because the port is closed or data arrived unexpectedly. This immediately terminates the connection instead of completing the normal FIN exchange.

A brute-force attack involves repeatedly attempting different passwords for a single account until the correct one is found. Event ID 4625 is generated for each failed logon, and a high volume of these events from a single source IP targeting the same account in a short period strongly indicates an automated brute-force attempt. This pattern is a classic indicator of such an attack, and the SOC analyst should investigate further, possibly blocking the source IP and enforcing account lockout policies.

Disabling Windows Defender or altering firewall rules directly implements T1562 Impair Defenses, which covers adversary actions that weaken or disable security controls to evade detection. This satisfies the scenario's requirement to hunt for defence-impairment activity, since both actions remove protective telemetry and filtering rather than merely executing or persisting.

Decoding the encoded command reveals the script's actual instructions. If it contains malicious actions like downloading a file from an external IP or creating a reverse shell, that directly confirms malicious intent. This is the most conclusive step because it analyzes the payload's behavior rather than relying on circumstantial evidence from process creation logs.

After collecting volatile data, the next step is to capture non-volatile evidence, such as the hard drive, using a write-blocker to prevent modification. Documenting the chain of custody ensures that the evidence is admissible in legal proceedings. This preserves the integrity of the evidence and allows for thorough analysis.

Tamper protection is a feature in many EDR solutions that prevents local administrators from disabling or modifying the agent. It enforces protection at the kernel level, ensuring the agent remains active even if an administrator attempts to stop its services or modify its files. This directly addresses the requirement.

Sending SYN packets to many ports with no completed handshake is the signature of a TCP SYN port scan. The absence of SYN-ACK responses indicates the scanned ports are closed or filtered, and the breadth of destination ports shows the sender is enumerating services rather than communicating with one. This matches reconnaissance activity against the internal host.

Classification is a governance decision made by the accountable asset owner, who understands the data's value, regulatory scope, and business criticality. Only after the owner assigns a sensitivity and criticality level can the team select a proportionate control set instead of defaulting to the heaviest baseline. This keeps the lighter control decision defensible and auditable.

The netstat -ano command displays active network connections along with the owning process ID (PID) and the executable name. By running this on the workstation, the analyst can correlate the remote IP and port to the PID, then use Task Manager or tasklist to identify the process. This is a quick and built-in way to map connections to processes.

Firewall configuration is implemented through hardware or software that filters traffic by rule, so enforcement is automated and technology-based. This places it squarely within the technical control category the stem asks for, distinguishing it from administrative and physical controls.

Firewall logs record outbound connections to cloud provider CIDR blocks, exposing shadow assets by destination IP rather than domain name. This satisfies the audit's detection requirement even when DNS is encrypted or bypassed, complementing domain-based methods.

The pattern of a completed handshake followed by a long idle period and then a small periodic message is characteristic of beaconing, where malware periodically checks in with a C2 server. The consistent timing and small application-layer payloads suggest automated communication rather than normal user-driven traffic. This behavior is a common indicator of compromise that analysts should investigate further.

Dumping credentials from memory, such as using Mimikatz to extract plaintext passwords or hashes from LSASS, is a classic Credential Access technique (T1003 OS Credential Dumping). The goal is to obtain credentials for lateral movement or privilege escalation. This directly aligns with the Credential Access tactic.

SSH encrypts the entire management session, providing confidentiality and integrity for credentials and configuration commands in transit. Unlike Telnet, which sends data in cleartext, SSH satisfies the secure remote management requirement for infrastructure devices such as routers, switches and firewalls.

LSASS credential dumping requires a process to open a handle to lsass.exe with read access. Monitoring handle-access events, such as Sysmon Event ID 10, detects this behaviour regardless of the dumping tool, unlike signature-based or file-creation detection.

Discretionary access control is characterized by object owners or administrators assigning permissions directly to named users and groups on each resource, as seen with NTFS access control lists. The described payroll folder configuration, where specific HR members are granted read and others are denied, is the classic discretionary model in action on a Windows file server.

When on-site audits are not permitted, contractual controls such as right-to-audit clauses, security addenda, and requirements for breach notification and data deletion can provide assurance and recourse. This approach addresses the residual risk by legally binding the provider to security obligations without requiring physical access.

Post-incident activity covers the lessons-learned review held after containment, eradication and recovery, where the team performs root cause analysis and documents findings to improve future response. This directly satisfies the stem's requirement for root cause analysis and lessons-learned documentation within the NIST lifecycle.

Long, high-entropy subdomains encode data in DNS queries, a hallmark of DNS tunnelling used to smuggle commands and exfiltrated data past perimeter controls. This covert channel provides the command-and-control channel an adversary needs to direct compromised hosts.

Lateral Movement consists of techniques used to enter and control remote systems on a network. Mapping an administrative share on a remote server with credentials for a service account, then scheduling a task on that remote host, is a textbook lateral movement sequence. The 'net use' establishes the authenticated remote connection that enables subsequent remote execution.

Stolen credentials from phishing directly satisfy T1078's requirement for legitimate, valid account access, bypassing exploitation and malware entirely. Because the account already exists and is authorised, the adversary authenticates normally against Microsoft Entra ID, evading perimeter defences and blending with genuine user activity.

Normalizing timestamps to a common time zone (typically UTC) and format is essential before correlating events from multiple sources. Without this, events may appear out of order, leading to incorrect conclusions about cause and effect. This step ensures that the timeline is accurate and that sequence of events can be reliably established, which is fundamental to incident analysis.

VLANs logically partition a physical network into isolated broadcast domains, separating traffic by function or trust level. This delivers the segmentation the scenario requires, restricting direct Layer 2 communication between groups unless routed through a controlled device.

The Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run causes a program to execute automatically at user logon, establishing persistence so the adversary survives reboots. Modification of this key is a classic autostart technique, not credential access, exfiltration or lateral movement.

Confidentiality ensures information is disclosed only to authorised parties, typically through encryption, access controls and classification. It is one of the three foundational CIA Triad components the stem requests, satisfying the constraint that exactly two listed options are core elements.

These files record authentication events such as successful and failed logins, sudo usage, and su attempts. They are the primary source for detecting unauthorized access and privilege escalation on Linux. Collecting them centrally enables correlation and alerting on suspicious authentication patterns, making them a top priority for security monitoring.

Honeypot monitoring data feeds threat intelligence by capturing attacker tactics, malware payloads and scanning patterns from decoy systems, supplying observed adversary behaviour rather than vendor-reported indicators. This satisfies the detection requirement because it provides real, environment-relevant threat artefacts that populate feeds used to identify incidents.

T1027 covers techniques such as packing, encoding and encryption that alter files or information so their true content is hidden. This defeats signature-based detection, because antivirus and similar tools match known byte patterns that obfuscation changes, allowing the adversary to evade identification.

A Process Tree view renders parent-child relationships between processes, exposing which executable spawned the suspicious PowerShell instance. This directly satisfies the need to identify the parent process rather than merely listing isolated events or command lines.

PCAP contains full packet data, allowing the analyst to reconstruct TCP sessions and calculate the amount of data transferred. By focusing on outbound sessions with large data volumes, the analyst can identify potential exfiltration. This technique is direct and effective because it uses the actual payload sizes and session durations to flag anomalies, making it the most reliable method among the options.

Brute force systematically guesses credentials to gain account access, mapping to MITRE ATT&CK Credential Access (T1110). It directly targets authentication secrets, satisfying the stem's requirement for a technique whose objective is obtaining credentials rather than execution or persistence.

Mitigation involves implementing controls to reduce the likelihood or impact of a risk. Since the cost of the control is less than the potential loss, it is cost-effective to implement the control. This aligns with the organization's low risk appetite for PII breaches.

Malware command-and-control and reverse shells frequently dial outbound to high-numbered ephemeral ports, which legitimate services rarely initiate. Host-based logs and firewall records capturing these connections reveal beaconing or exfiltration activity, satisfying the stem's requirement for a compromise indicator found during log analysis.

Lateral movement involves pivoting from a compromised host to other systems. Remote Desktop Protocol lets an attacker authenticate to additional machines using harvested credentials, making RDP a common technique for moving deeper into a network.

Sysmon Event ID 1 records process creation, logging the full command line and, critically, the ParentImage and ProcessGuid fields. Filtering this event reconstructs the process tree by linking each spawned process to its parent, directly satisfying the triage requirement to trace the suspicious PowerShell execution's ancestry.

DNS tunneling encodes data into the query name, producing subdomain labels that look like random or base64/hex-encoded strings rather than human-readable hostnames. High entropy in the leftmost labels is a strong indicator that the DNS channel is being used to carry a payload. In this scenario, labels such as 'a1b2c3d4e5' are consistent with encoded exfiltration data rather than legitimate service names.

Physical and Environmental Security governs tangible safeguards over facilities and hardware, so it directly satisfies the Annex A requirement for restricting server-room entry. Physical access controls such as locks, badges and surveillance sit in this category, not in logical access or organisational controls, which address user permissions and policy respectively.

A policy is a high-level statement of management intent that outlines the organization's commitment to cybersecurity and sets direction. It does not include detailed procedures or technical configurations. This matches the analyst's need for a document that provides overarching guidance without operational specifics.

User-specific crontab files are stored under /var/spool/cron/crontabs/, one file per user, which cron reads at execution. This differs from /etc/crontab and /etc/cron.d, which hold system-wide jobs, making it the primary location for per-user scheduled tasks.

Encrypting data for impact satisfies the availability constraint by rendering files unusable without the decryption key, rather than exposing them. Unlike exfiltration or ransomware encryption for extortion, this technique destroys access outright, aligning with the Impact tactic's objective of disrupting business operations.

Disabling unnecessary services is a fundamental step in reducing the attack surface. Telnet and FTP are insecure protocols that transmit data in cleartext and are often targeted by attackers. Turning them off eliminates potential entry points and aligns with the principle of least functionality.