ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) (CCOA) — Questions 1–75

You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?

You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

What is the primary goal of the 'Command and Control' (C2) tactic?

Which THREE types of network logs are most effective for identifying a data breach?

You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?

An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?

You are implementing 'Just-in-Time' (JIT) access for Azure Virtual Machines using Microsoft Defender for Cloud. A developer complains they cannot request access to a VM. What is the most likely reason?

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?

What is the function of the 'netstat' command in a Windows environment?

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

You are investigating a suspected data exfiltration incident. You need to analyze network traffic captured in a PCAP file. Which tool is the industry standard for performing deep packet inspection and protocol analysis during this investigation?

Which TWO of the following are examples of 'Discovery' techniques?

You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

You are configuring an Endpoint Security policy to harden Windows 10 devices. Which TWO of the following settings are recommended as best practice to mitigate physical access risks?

You observe that a specific Windows service is running as 'SYSTEM' but is vulnerable to DLL hijacking. What is the most effective way to harden this service without disabling it?

A SIEM alert indicates a 'Golden Ticket' attack. What is the primary indicator of this attack in the logs?

You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this typically signify?

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

Which TWO of the following are considered 'Defense Evasion' techniques?

Which TWO of the following are considered 'Technical' controls?

You are auditing your cloud environment for 'Shadow IT'. Which TWO of the following methods are effective for identifying unauthorized assets?

Which protocol is most appropriate for secure remote management of network infrastructure devices?

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

Which TWO of the following are essential components of a secure network design for a segmented corporate network?

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

Which TWO of the following are core components of the CIA Triad?

Which TWO sources are used to populate threat intelligence feeds for incident detection?

Which TWO of the following Windows log types are most useful for detecting lateral movement?

What is the purpose of 'T1027 Obfuscated Files or Information'?

You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?

Which TWO of the following are considered 'Credential Access' techniques?

Which TWO of the following are common indicators of a compromised system found during host-based log analysis?

Which of these is a typical 'Lateral Movement' technique?

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

During an investigation, you discover a malicious cron job on a Linux server. Which directory is the primary location for user-specific cron tasks?

Which THREE of the following are common 'Impact' techniques?

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

A CISO asks for a list of indicators that should be monitored in the SIEM to detect potential account takeover attempts. Which THREE indicators are most relevant?

What is the primary function of a 'C2 Beacon'?

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Which document outlines the formal commitment of top management to support information security objectives?

An incident response team is performing containment on a compromised Linux server that is part of a containerized environment. Given that the container is running in a Kubernetes cluster, which action is the most appropriate initial containment step to preserve the volatile memory for forensics while preventing further data exfiltration?

You are hardening a virtual machine's security. Which action is the most effective way to prevent VM escape attacks?

Which THREE types of data are typically found in a full forensic disk image?

Your vulnerability management program requires prioritizing fixes based on exploitability. Which THREE of the following factors should be included in your risk score?

In a Linux system, which tool is used to identify open network connections and the specific process ID (PID) associated with them?

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

In a Palo Alto Networks environment, you need to identify if a specific internal host is beaconing to a command-and-control server. Which log type provides the necessary data?

Which TWO of the following are primary security controls for securing virtual machines in a production environment?

When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?

When setting up a new security monitoring tool, you need to define 'Critical Assets'. Which criteria should NOT be used to determine asset criticality?

You are investigating a potential credential harvesting site. Which tool is best suited to safely inspect the site without triggering a potential infection?

You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Which TWO tools are commonly used for memory forensic analysis?

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Which THREE of the following are standard best practices for securing cloud infrastructure?

While investigating an incident in Google Workspace, you notice suspicious file sharing. Which log type should be queried to see which files were shared externally by a specific user?

In the context of the NIST Incident Response lifecycle, which phase involves the identification of the root cause?

Which THREE techniques do attackers use to maintain persistence on a Windows host?

Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?