ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) (CCOA) — Questions 76–150

Discovery scanning establishes what is actually reachable, while procurement and billing records reveal assets that may be offline, unlisted, or newly provisioned. Reconciling the two produces a defensible baseline inventory with ownership and classification data that can be maintained. This is the foundational first step before controls can be scoped to specific assets.

Never trust, always verify is the foundational zero trust principle requiring authentication and authorization for every access request using multiple dynamic signals such as identity, device posture, and location. This matches the requirement to evaluate each session before establishment. It replaces implicit trust based on network location with explicit, context-aware policy enforcement at each request.

Deleting volume shadow copies destroys the victim's ability to recover encrypted or damaged data, which is the destructive outcome Impact tactics aim to achieve. Ransomware operators run vssadmin this way to prevent restoration, so the technique sits under Impact rather than Defence Evasion or Execution.

Parameterized queries separate SQL code from data, ensuring that user input is treated as data and not executable code. This prevents attackers from altering the query structure. It is the most effective and recommended defense against SQL injection because it addresses the root cause: the mixing of code and data. Even if input contains malicious characters, they are handled safely.

A burst of failed authentications immediately followed by a success is the classic brute-force or credential-stuffing signature, indicating the attacker eventually guessed or reused valid credentials. Correlating both events in the SIEM distinguishes this pattern from routine user typos, directly satisfying the account takeover detection requirement.

A C2 beacon periodically contacts its command-and-control server to request instructions, allowing the implant to receive new tasks without maintaining a constant connection. This polling mechanism satisfies the question's focus on the beacon's primary function within attacker infrastructure.

Lateral movement commonly abuses SMB and administrative shares to reach remote hosts using harvested credentials, moving within the environment rather than breaching the perimeter. This satisfies the stem's request for a typical lateral movement behaviour.

The Information Security Policy is the governing document in which top management formally states its commitment to protecting information assets and sets the security objectives for the organisation. It provides the mandate and direction that lower-level standards, procedures and controls must align with.

Patching the hypervisor closes the isolation flaws that VM escape exploits target, while updating guest tools removes vulnerable drivers and services inside the guest. This directly addresses the stem's constraint of preventing escape, since escape requires a hypervisor or tools vulnerability to cross the isolation boundary.

A full forensic disk image preserves all sectors, so file system metadata such as MFT entries, inodes, timestamps and directory structures is captured alongside file content. This satisfies the stem's requirement, since metadata is essential for reconstructing activity and proving file provenance during analysis.

The existence of public exploit code significantly increases the risk of exploitation.

The `ss -p` command queries the kernel's socket tables and, with the `-p` flag, appends the owning process ID to each entry, satisfying the requirement to link open network connections to their specific PID. Unlike `netstat`, `ss` reads directly from netlink, making it the modern Linux default.

Clear roles and responsibilities assign ownership for detection, containment, eradication, and recovery, preventing duplicated effort and gaps during an incident. This structure lets responders act decisively under pressure, which is why it is essential to any effective IRP.

Creating a scheduled task that runs at startup is a direct persistence mechanism because it ensures the adversary's code executes automatically after reboots or logons. Scheduled tasks are a recognized autostart location, so this behavior aligns with the Persistence tactic rather than one-time execution or defense evasion alone.

DHCP snooping designates trusted ports toward legitimate DHCP servers and blocks server-originated DHCP offers on untrusted access ports, directly preventing rogue servers from leasing addresses. It satisfies the stem's requirement by filtering DHCPOFFER and DHCPACK messages at the switch, stopping the identified rogue server from responding to client broadcasts.

Hypervisor patching closes vulnerabilities in the virtualisation layer itself, preventing guest-to-host escapes that would compromise every VM on the physical host. This directly satisfies the stem's production-environment constraint, where a single unpatched hypervisor flaw exposes all hosted workloads, so it ranks as a primary control alongside guest OS hardening.

The parent process is a known vulnerable service, and the child process is unsigned, located in a temporary directory, and making external connections. This pattern is typical of an attacker exploiting a service to drop and execute a malicious payload, such as a web shell or reverse shell. The temporary directory and lack of signature indicate it is not a legitimate system process.

A bridged adapter places the virtual machine directly onto the physical network segment, giving it its own IP address and full visibility to other hosts. It bypasses the host's NAT isolation, so the VM becomes an independently reachable node subject to network attacks.

Patch recency reflects maintenance hygiene, not business impact. Criticality criteria should measure consequence of loss — revenue dependence, regulatory scope, data sensitivity, or process dependency. A recently patched asset can still be business-critical, so last-patched date cannot determine criticality and must be excluded from the definition.

NetFlow records contain metadata such as source and destination IP, ports, protocol, byte counts, packet counts, and flow start and end times. They reveal the volume and duration of large outbound transfers even when the payload is encrypted, and they can be correlated with firewall, proxy, and endpoint logs without storing full packet contents.

Kernel-level visibility allows the EDR agent to monitor low-level system activity, such as system calls and process creation, which is essential for detecting advanced threats that may evade user-mode hooks. This deep visibility is critical for effective detection of malicious behavior on endpoints.

Impact is the magnitude of harm that can be expected if a threat exploits a vulnerability. In this scenario, the analyst is assessing the potential loss if the trading platform is compromised, which directly relates to impact. Impact is a key factor in risk assessment, along with likelihood.

Acceptance is the deliberate decision to retain a risk after weighing treatment options, and it is valid only when made by an accountable owner with authority. The signed acceptance memo documents that informed decision, making acceptance the correct classification for this unpatched but business-critical application.

Attackers commonly use Base64 encoding with the -EncodedCommand parameter to obfuscate PowerShell commands. This encodes the entire script into a single string, making it unreadable to casual inspection and evading some security controls. The encoded command is then decoded and executed by PowerShell. This technique is prevalent in malicious scripts to hide their true intent.

The Microsoft-Windows-PowerShell/Operational log records PowerShell engine events, including script block logging (Event ID 4104) and module logging (Event ID 4103). These events capture the actual script content and pipeline execution, which are critical for reconstructing in-memory attacks. This log is specifically designed for PowerShell operational visibility and is the primary source for such forensic details.

An isolated sandbox or VM contains any drive-by download, exploit kit or redirect payload within a disposable environment, so the analyst can observe the site's behaviour and capture indicators without risking the corporate endpoint or network.

Choosing among mitigation, transfer, avoidance, and acceptance is the defining act of risk treatment. Each option is evaluated against cost, feasibility, and the organization's risk appetite, and the selected approach is documented with an accountable owner. Without this explicit selection step, identified risks remain unaddressed and the program cannot demonstrate that exposure was deliberately managed.

The IR family covers incident handling, reporting and response activities, which is exactly what unauthorised data exfiltration triggers. It addresses detection, containment, eradication and recovery from security incidents, satisfying the stem's requirement for the control family governing exfiltration incidents.

Email filtering policies inspect inbound messages and attachments, blocking or quarantining malicious senders, links and payloads before delivery. This directly counters T1566 Phishing, which relies on email as the initial access vector, satisfying the requirement to prevent phishing reaching users.

Rekall provides memory acquisition and analysis, parsing live RAM captures to extract processes, network connections and injected code artefacts. It satisfies the stem's requirement for a memory forensic tool, complementing Volatility as the other commonly cited framework for examining volatile memory images during incident response investigations.

Event ID 11 tracks FileCreate events, often associated with enumeration.

LotL abuses legitimate signed binaries such as PowerShell or certutil, so command-line arguments and parent-child process relationships are the observable artefacts. Process creation logs capture these, whereas network or authentication logs lack the command-line context needed to distinguish malicious from benign execution.

Removable media is a common initial infection vector for air-gapped or segmented ICS environments, as seen in historical incidents that spread via USB drives. Disabling mass storage and permitting only approved, scanned devices blocks that path while still allowing necessary firmware or configuration transfers through controlled media. This control directly reduces attack surface on engineering workstations without affecting PLC communications, making it appropriate for the baseline.

Effective Access on the Advanced Security Settings tab computes the resultant permissions a specified account holds on the executable, resolving group membership and deny entries, so you can confirm whether the service account lacks the required access.

Comprehensive audit logging records API calls and resource changes to immutable storage, enabling forensic investigation and anomaly detection. It satisfies the stem's requirement for a standard best practice by providing the accountability trail needed to detect and investigate cloud security incidents.

DNS security monitoring tools analyze query patterns, domain entropy, query volume, and response sizes to detect tunneling and beaconing. Machine learning models can baseline normal DNS behavior and flag anomalies like random subdomains and high query rates to non-standard resolvers. This directly addresses the scenario by identifying the covert channel based on behavioral and payload characteristics.

Drive audit logs record file creation, sharing and permission changes, including external sharing events and the acting user. They directly answer which files a specific user shared outside the organisation, unlike login or admin audit logs.

Malicious services registered with the Service Control Manager start automatically at boot under SYSTEM context, restoring attacker access after restarts. This is a classic persistence mechanism because the service persists independently of any user session.

Rundll32 loading a DLL from a user-writable path such as the Public folder is the hallmark of signed binary proxy execution, where a trusted Microsoft binary is abused to run attacker code and evade application whitelisting and process-based detections. The unusual file extension and non-system directory reinforce that this is masquerading as legitimate execution rather than a benign DLL load.

This preserves the required legacy protocol for the single approved peer while shrinking exposure to only that host. Enabling SMB signing raises the bar against relay and tampering attempts, and SMB auditing gives the SOC visibility into anomalous SMBv1 sessions. Together these act as compensating controls consistent with a documented, time-boxed exception.

An admission controller that verifies signatures and immutable digests ensures the exact scanned image is the one that runs. If an attacker swaps the image tag or tampers with the registry content, the signature or digest check fails and the pod is rejected. This directly closes the gap between scanning in CI and execution in the cluster, addressing post-scan tampering and tag mutation.

Before declaring an incident, the analyst must determine whether the group modification was authorized. Correlating the event with change management records and identifying the account that performed the action provides the context needed to distinguish a legitimate administrative change from malicious escalation. This evidence-based validation step is the correct immediate action before any containment.

NIST SP 800-53 catalogues security and privacy controls that US federal agencies must implement under FISMA, making it the mandated baseline for federal information systems. Its control families map directly to agency authorisation processes such as the RMF.

Customer-managed keys allow the organization to control the lifecycle and access policies of encryption keys. Using an HSM provides hardware-level protection and enables immediate revocation by disabling or deleting the key. This meets the requirements for organizational key control and rapid revocation, unlike provider-managed keys where the cloud provider controls the key lifecycle.

ALE is calculated as SLE multiplied by ARO, so $250,000 x 4 = $1,000,000. Because the risk appetite caps single-risk ALE at $500,000, this risk breaches the threshold and cannot simply be accepted; the analyst must recommend treatment or escalate for a formal exception.

Host Management lists every endpoint with the Falcon sensor installed and its current connectivity and prevention status, so missing or non-reporting agents are immediately visible. This directly satisfies the requirement to confirm all endpoints are running and reporting correctly.

EDR isolation cuts network communication while keeping the endpoint powered on, which preserves volatile memory and active process state. Capturing a memory image before remediation retains evidence such as injected code, encryption keys, and network connection tables. This combination stops the threat and preserves forensic artifacts for deeper analysis.

Large outbound transfers to external IPs during off-hours are a classic sign of data exfiltration. Attackers often schedule transfers when monitoring is reduced. The volume and timing deviate from normal business traffic, and the destination may be a known malicious or suspicious host. This indicator directly suggests data is being moved out of the network without authorization.

Credential Access consists of techniques for stealing credentials such as account names and passwords. The SAM hive contains local account password hashes, and the SYSTEM hive holds the boot key needed to decrypt them. Saving these hives for offline extraction is a direct credential theft technique, making Credential Access the correct tactic.

Segmenting the workstation VLAN from the PACS archive VLAN with deny-by-default firewall rules directly blocks the east-west path the attacker used to pivot. Only explicitly approved flows, such as the DICOM ports required by imaging modalities, are permitted. This containment control limits blast radius regardless of how the workstation was initially compromised, making it the most direct mitigation for lateral movement to the archive.

Running the web service under a dedicated non-privileged account enforces least privilege, so a compromise cannot gain root-level access to the host. This directly mitigates the high-privilege risk identified in the audit, containing any exploitation to limited service permissions.

Hosting the primary e-commerce database with stored credit card data satisfies the Critical criterion through regulatory and financial exposure. Compromise triggers PCI DSS breach obligations, customer notification costs and direct fraud liability, so the asset demands the highest protection tier.

Registry Run keys, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, store programs that execute automatically when a user logs on. Malware commonly adds entries here for persistence. Examining these keys can quickly reveal suspicious executables. Thus, this is the most direct artifact to identify autostart programs.

Cryptographic hashing and digital signatures provide integrity verification, directly countering Tampering by detecting any unauthorised modification of data in transit or at rest. This satisfies the design-phase constraint, where the threat targets data integrity rather than confidentiality or availability, making it the most effective control against that STRIDE category.

Script block logging records the content of PowerShell and other scripts, while AMSI (Antimalware Scan Interface) allows security products to inspect script content before execution. Together, they provide deep visibility into fileless techniques that rely on scripting engines. This is critical for detecting obfuscated or malicious scripts that may not touch disk.

ALE is calculated by multiplying single loss expectancy by annualised rate of occurrence: $10,000 × 0.5 = $5,000. This expresses the expected yearly financial loss from the risk, forming the basis for comparing safeguards against their cost.

Endpoint isolation via the EDR console immediately severs the laptop's network communication while preserving the agent's management channel for investigation. This contains the active command-and-control traffic fastest, satisfying the stem's requirement for the most immediate containment action.

Ensures that an action cannot be denied by the user.

Removing unauthorized access points or credentials is a primary eradication task to ensure the attacker cannot re-enter.

DNS tunneling often involves encoding data in DNS queries and responses, leading to unusually long or high-entropy domain names. Analyzing the size and entropy of these fields can reveal patterns indicative of tunneling. For example, base64-encoded data appears random and lengthy. This method directly inspects the DNS payload for signs of hidden data, providing strong evidence of tunneling activity.

Using the 'at' command to schedule a recurring job is a Persistence technique (T1053.002 At). It ensures the reverse shell runs regularly, maintaining the attacker's access even if the initial foothold is lost. This is a direct attempt to establish persistence on the Linux host, allowing the attacker to survive reboots and maintain long-term access.

A CMDB records each asset plus its dependencies and relationships, so impact analysis and change planning draw on accurate linkage data rather than isolated device lists. This directly satisfies the stem's requirement for good inventory management practise by keeping the inventory current, complete and relationship-aware.

Creating a scheduled task configured to run with highest privileges is a Privilege Escalation technique (T1053.005 Scheduled Task/Job: Scheduled Task). Adversaries can use this to execute code as SYSTEM or an administrator, thereby escalating privileges. This is distinct from persistence, as the immediate goal is to gain higher privileges, though it can also serve as persistence.

Password complexity is configured under Account Policies > Password Policy within Security Settings, reached via Computer Configuration > Policies > Windows Settings. This is the CIS Benchmark path where the 'Password must meet complexity requirements' setting is enforced for local accounts.

Spawning PowerShell from Outlook is a classic example of the Execution tactic, specifically T1204 User Execution or T1059 Command and Scripting Interpreter. The adversary leverages a trusted application to run malicious code, achieving code execution on the host. This aligns with the scenario where the initial execution vector is the user opening the attachment, leading to PowerShell execution.

A Watchlist holds the noisy service account, and a 'where' clause in the rule query filters it out before alert generation. This preserves the rule's detection coverage for all other entities, satisfying the requirement to suppress false positives without disabling the analytic rule entirely.

A vulnerability is a weakness, a threat is something that can exploit it, and risk is the potential for loss when the two intersect with a valuable asset. The unpatched server, the active ransomware group, and the regulated data together define the risk exposure.

Recover directly addresses resilience by restoring impaired capabilities after an incident, satisfying the stem's requirement for critical infrastructure continuity. Within the NIST Cybersecurity Framework, Recover supports timely recovery and service restoration, whereas Identify, Protect, Detect and Respond cover asset mapping, safeguards, monitoring and containment respectively.

After a click, the immediate priority is determining whether credentials were entered or a payload executed, so reviewing user activity logs for signs of account compromise confirms or rules out actual impact before containment or eradication decisions.

Lateral Movement fits because wsmprovhost.exe hosts PowerShell remoting sessions, and spawning cmd.exe from it indicates an attacker executing commands on a remote host via WinRM. This satisfies the stem's constraint: the parent process evidences remote execution rather than local privilege escalation or persistence.

Compressing files and uploading them to an external address during off-hours is data theft leaving the environment. Exfiltration covers techniques that transfer data out of the victim network, and the repeated archive uploads to an external IP match that objective, making this the most direct tactic represented by the observed activity.

Persistence consists of techniques an adversary uses to keep access across restarts, credential changes, or other interruptions. Creating a scheduled task that mimics a legitimate updater and runs a payload every 15 minutes is a classic persistence mechanism, ensuring the callback survives reboots and user logoffs without requiring re-exploitation.

Lens's 'Top values' aggregation groups documents by the source IP field and ranks them by count, directly returning the ten highest-volume addresses. Adding a time filter for the last hour and a destination filter satisfies both stem constraints, while Discover's raw document list cannot aggregate or rank unique values.

Capturing memory and disk images preserves volatile and non-volatile evidence without altering the system. This is the first step in digital forensics to ensure that all potential evidence, including running processes and network connections, is available for analysis. It aligns with the order of volatility and is essential for determining the scope of data exposure.

PsExec operates by copying a binary to the remote host and registering a temporary Windows service that runs it with SYSTEM privileges. That service-based execution is exactly what the System Services: Service Execution sub-technique describes. The remote service creation, execution, and subsequent deletion are the signature behaviours, distinguishing this technique from simple file transfer over admin shares or scheduled task abuse.