ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) (CCOA) — Questions 151–225

Confirming whether the login was legitimate separates a true compromise from a false positive before containment or escalation. Contacting the user or manager satisfies the triage constraint of validating the alert, preventing wasted effort on benign activity such as travel or VPN use.

Mitigation status records the current state of each agreed control for a logged risk, showing whether treatment is planned, in progress, or complete. A formal Risk Register tracks risk, owner, likelihood, impact and treatment, so mitigation status is a standard field.

RAM is the most volatile evidence and is lost on power-off, so it must be captured before disk. Imaging memory first preserves encryption keys, running processes and network connections that a shutdown would destroy, following the Order of Volatility.

Verifying user account permissions identifies excessive privileges, orphaned accounts and misconfigured sudoers entries. This satisfies the audit's access-control objective by confirming least privilege, since weak file ownership or world-writable paths let unprivileged users escalate and undermine the system's integrity baseline.

Residual risk is what remains after controls are applied, and it never automatically disappears. A medium score still requires an owner, monitoring, and periodic reassessment, especially because EDR effectiveness depends on tuning, coverage, and threat evolution. The register entry should stay open with an updated residual rating.

Acceptance is the deliberate decision to acknowledge a risk and take no action to reduce it, often because the cost of mitigation outweighs the benefit or because no viable control exists. The CIO documents the risk and continues operation, which is a textbook example of risk acceptance.

CAP_NET_BIND_SERVICE is the specific Linux capability that allows a process to bind to privileged ports (ports numbered below 1024) without requiring full root privileges. By assigning this capability to the web server binary (e.g., using setcap), the server can listen on port 80 while running as a non-privileged user, reducing the attack surface. This follows the principle of least privilege and is a common practice for network services that need to bind to low-numbered ports.

The control yields a risk reduction of $180,000 per year, the difference between the $240,000 pre-control and $60,000 post-control annualized loss expectancy. Subtracting the $90,000 annual cost leaves a net benefit of $90,000, so the investment is quantitatively justified. This comparison of risk reduction against control cost is the standard cost-benefit basis for the CFO's question.

Using a legitimate RMM tool that is already trusted, deleting its logs, and renaming the executable to masquerade as a system process are actions designed to avoid detection. These behaviors obscure the adversary's activity and blend with normal operations, which is the core objective of the Defense Evasion tactic.

Least privilege is the principle of granting users only the minimum access rights necessary to perform their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions. The administrator's goal aligns exactly with this principle.

Hashing produces a fixed-length digest that changes if even one bit of evidence alters, so recomputing it later verifies the data remains unmodified. This directly satisfies the integrity requirement in forensic examination, where proving evidence has not been tampered with since acquisition is essential for admissibility.

Defining security policies during Preparation establishes the governance, acceptable-use and escalation rules the incident response plan must align with. This satisfies the stem's Preparation phase requirement because policy definition precedes detection and response, shaping team authority and decision criteria before any incident occurs.

File system permissions directly enforce access control by defining which users or groups may read, write, or execute a given resource. This satisfies the stem's requirement for an access control implementation, since permissions are a discretionary mechanism restricting subject actions on objects within the operating system itself.

Data sovereignty holds that data is subject to the laws of the jurisdiction where it is collected or stored, and cross-border transfer restrictions limit movement to countries with adequate protection. The regulation described directly reflects this principle, making it the governing concept for the retailer's compliance obligation.

A risk matrix maps likelihood against impact to produce a single overall risk rating, such as High, Medium, or Low. This directly satisfies the requirement to reflect both the chance of the event and the severity of its consequences, and it supports prioritization and consistent communication.

The relayed NTLM authentication to multiple servers, using a machine account to gain access on other hosts, indicates the adversary is moving from one system to another. NTLM relay is commonly used for lateral movement because it leverages captured authentication to reach additional targets, so Lateral Movement is the tactic directly supported by this evidence.

The organization has a defined policy requiring AES-256 encryption for Confidential data, yet it knowingly continues storing unencrypted tape backups. No compensating control, transfer, or remediation is in place. This is the defining characteristic of risk acceptance: the risk is identified and consciously retained without mitigation, whether formally documented or not. The audit finding confirms the exposure persists despite the stated policy.

Consistent timestamps are critical for accurate event correlation. If logs from different devices use varying time zones or formats, reconstructing the sequence of events becomes error-prone. Normalizing timestamps to a standard, such as UTC in ISO 8601, ensures that events can be ordered correctly, which is essential for incident timelines and forensic analysis.

Attackers blend C2 traffic into standard application layer protocols such as HTTP, HTTPS or DNS, so it appears as legitimate web traffic. This satisfies the Command and Control criterion by evading network detection that trusts common protocols.

Running processes and open network connections reside in memory and are lost when the system is powered off. They provide critical evidence of active malware, command-and-control channels, and attacker sessions. Collecting this data first preserves volatile evidence. Therefore, this is one of the correct choices.

Watchlists are queried in analytics rules through the _GetWatchlist function, which returns the uploaded indicators as a table for joining against log data. Referencing the watchlist alias this way lets the rule match malicious IPs against network events.

LotL binaries are signed, trusted system tools already present on the host, so their execution blends into legitimate administrative activity. This satisfies the stem's constraint of avoiding custom malware, which would introduce new files, hashes and behaviours that endpoint detection readily flags.

Encrypting ePHI at rest with AES-256 ensures that even if physical disks are stolen or improperly accessed, the data remains unreadable without the encryption keys. The HSM protects key material, preventing unauthorized decryption. This directly preserves confidentiality, the property that information is not disclosed to unauthorized individuals or processes, which is the core security objective addressed by encryption at rest.

The use of DNS queries with long, hexadecimal subdomains is a hallmark of DNS tunneling for command and control. Adversaries encode commands and responses in DNS queries and responses to communicate with compromised hosts, often bypassing network restrictions. This falls under the Command and Control tactic, specifically T1071.004 Application Layer Protocol: DNS. The frequent, varying queries indicate an active C2 channel.

Firewall logs record permitted and denied connection attempts with source, destination and port details, giving the SIEM network-level evidence to correlate against other events. This satisfies the stem's requirement for a common SIEM ingestion source supporting incident detection.

Red teams emulate attacker tactics, techniques and procedures to expose weaknesses, while blue teams defend, detect and respond to those simulated intrusions. This adversarial-versus-defensive split is the defining axis separating the two roles in a security simulation.

DNS server logs record queries made by hosts, including domain names resolved and the requesting IP. This directly reveals the domains that the malware attempted to contact, which is crucial for identifying C2 channels. Therefore, DNS logs are the best artifact for this purpose.

Screen capture grabs an image of the current desktop or application window, gathering information for later exfiltration. It satisfies the Collection tactic because the adversary is amassing data prior to staging and removal from the environment.

STRIDE threat modelling requires a data flow diagram, so identifying data flows maps how data moves between components, trust boundaries and processes. This satisfies the stem's requirement by establishing the system model against which each STRIDE category is systematically applied.

The ~/.bashrc file is a per-user shell startup script executed by interactive Bash sessions on each login. Attackers append commands there so malicious code runs automatically whenever the compromised account logs in, providing durable user-level persistence without requiring root access or system-wide configuration changes.

Timestomping modifies file metadata so that a malicious file appears consistent with legitimate files, which is a Defense Evasion technique. Analysts relying on creation time to spot recently dropped binaries can be misled. The technique targets the file system's timestamp attributes, and it is often combined with placing the file in a system directory to further blend in with expected content.

Encrypting the backup image with keys not stored alongside it means a stolen copy is unreadable, and tightening share permissions limits who can obtain the image in the first place. This directly targets the stated exposure of unencrypted backups on a shared share. It protects the data even after it leaves the hardened host, which is the scenario's key concern.

Eradication targets the underlying cause rather than its symptoms, removing malware, closing the exploited vulnerability and eliminating persistence so the threat cannot recur. This satisfies the stem's focus on root cause, distinguishing it from containment or recovery activities.

The network connection table and process list are highly volatile and change rapidly as processes start and stop. Exporting them captures active command-and-control connections, listening ports, and suspicious process trees. These artifacts are essential for understanding the attacker's activity and are lost once the system is rebooted or the processes terminate.

Event ID 4625 indicates a failed logon, and 4624 indicates a successful logon. Logon Type 3 is a network logon, such as a connection to a shared folder or remote desktop. The rapid sequence from the same source suggests an attacker attempted a password guess and then succeeded, especially against a privileged account. This pattern is a classic indicator of a brute-force attack.

In Windows ACL evaluation, an explicit Deny entry overrides any Allow entries, whether inherited or directly assigned. Effective Access therefore resolves to Deny even if the user belongs to groups with Full Control, making an explicit Deny the most likely cause.

Preparation involves establishing policies, plans, and procedures before an incident occurs. A communication protocol for external stakeholders is a preparatory element because it defines who to notify, when, and how. Without it, the organization may respond slowly or inconsistently during an incident, leading to regulatory penalties or reputational damage. The gap is in planning, which is part of preparation.

Restricting the inbound rule to TCP port 443 with source 10.0.1.0/24 permits only HTTPS from that subnet. Narrowing the source CIDR is the security-relevant axis; 0.0.0.0/0 or omitting the port would expose the instance more broadly.

Software in MITRE ATT&CK represents the specific tools or malware instances leveraged during an intrusion, satisfying the stem's demand for the "what" of the attack. Unlike Techniques, which describe adversary behaviour, Software maps directly to the actual utility or implant observed, such as a named backdoor or offensive tool.

Restricting access to only those roles with a business need limits insider and lateral-movement exposure, and comprehensive access logging gives the SOC the ability to detect anomalous reads or bulk exports. Together these controls support both prevention and detection for the most sensitive assets. They align with standard handling requirements for the top classification tier.

Sigcheck verifies Authenticode digital signatures and certificate chains for executables, reporting whether a binary is signed and by whom. Running it against the process image in C:\ProgramData confirms whether the file's signature is valid or tampered.

Granting 'Administrator' rights to a user whose role is routine data entry exceeds what the job requires, directly breaching least privilege. This principle demands each account hold only the minimum access necessary, so excessive standing permissions create unnecessary attack surface and insider-risk exposure.

Hashing the file produces a unique digest that can be matched against malware databases or threat intelligence, identifying known malicious content regardless of filename. Renaming only alters metadata, so hashing bypasses the disguise and reliably reveals the file's true identity.

ALE = SLE × ARO. SLE = AV × EF = 500,000 × 0.40 = 200,000. ALE = 200,000 × 0.2 = 40,000. This correctly applies the exposure factor to the asset value and then multiplies by the annualized rate of occurrence to estimate the expected annual loss.

EDR solutions capture process executions, network connections, and other endpoint activities. If a user clicked a link, the browser process would launch and make a network connection, which EDR would record. EDR can also detect subsequent malicious behavior like file downloads or script execution. This telemetry provides direct evidence of user interaction and is highly useful for determining if the link was clicked.

Customer account numbers combined with Social Security numbers are regulated personally identifiable information whose disclosure causes severe harm, financial fraud, and regulatory penalties. This data clearly warrants a Confidential classification with encryption, strict access control, and monitoring. It is the best example of an asset requiring the highest sensitivity handling in a financial services risk assessment.

Get-FileHash computes a cryptographic hash (SHA-256 by default) of a file's contents, directly satisfying the integrity-verification requirement in the stem. Comparing the returned digest against the publisher's published value detects any tampering or corruption of the downloaded binary, which is precisely the analyst's task here.

Encrypting the storage volume with AES-256 and storing keys in an HSM ensures data at rest is unreadable without the key. If the array is stolen, the ciphertext is useless because the HSM remains in the secure facility. This directly addresses the confidentiality objective for data at rest and satisfies the 'Restricted' classification requirement.

NetFlow records capture flow metadata — source, destination, ports, and byte counts — for every connection leaving the perimeter, revealing the beaconing pattern to random external addresses. This flow-level evidence identifies the botnet's command-and-control endpoints before host-level artefacts are collected.

WDAC is a Windows feature that enforces application control by allowing only trusted, signed code to run, based on policies defined by the organization. It can be configured to permit approved developer tools while blocking unauthorized executables, providing strong protection against untrusted code. This directly meets the requirement to control application execution without granting bypass rights.

Threat intelligence platforms aggregate data from multiple sources and can quickly reveal if the domain is associated with known malicious campaigns, malware, or phishing. This provides context and may save time by identifying the threat without direct interaction. It is a safe, passive method to gather intelligence on the domain.

Lessons learned should translate observed attacker behavior into updated detection logic, such as new signatures, correlation rules, or behavioral analytics. This directly improves the organization's ability to detect similar activity earlier. It also closes the gap identified during the incident when existing detections failed to alert.

Impact describes the potential harm to the organization if the threat event occurs, often rated on an ordinal scale. Together with likelihood, impact forms the two axes of a qualitative risk matrix. This combination lets the team rank risks by relative urgency and focus remediation efforts on the highest-priority items without needing precise financial estimates.

Fileless malware often loads malicious libraries or abuses handles rather than dropping executables, so enumerating loaded DLLs and open system handles in the memory image reveals injected or suspicious modules. This exposes in-memory persistence that disk forensics would miss.

The ssdt plugin parses the System Service Descriptor Table, listing service handlers and flagging entries that point outside expected kernel modules. Hooked or redirected entries reveal kernel-mode rootkits that intercept system calls, directly addressing the malicious kernel-mode rootkit identification requirement.

This removes the static plaintext secret from the file system and introduces brokered, auditable retrieval, which is a recognized compensating control when native modern authentication is unavailable. The backup platform still obtains valid credentials to run jobs, so functionality is preserved while the exposure of a long-lived plaintext secret is reduced and access is logged through the broker.

Business impact and status directly satisfies the executive summary's purpose: leadership needs to know what is affected, how severely, and whether service is restored. Executives prioritise operational and financial consequences over packet captures or log excerpts, so stating impact and current status enables informed decisions without technical detail.

Risk acceptance occurs when an organization acknowledges a risk and decides to retain it without implementing additional controls, often because the cost of mitigation outweighs the benefit or the exposure is temporary. The business owner's decision to tolerate the high likelihood and high impact for two months until decommissioning is a clear example of accepting the risk with a defined time boundary.

The netstat utility with the -a, -n, -o, and -b switches lists all active connections and listening ports in numeric form, includes the owning process ID, and resolves the executable name responsible for each connection. This directly preserves the mapping between live network sockets and the processes that own them, which is exactly the volatile state requested before containment destroys it.

Modifying a service's ImagePath to point to a malicious executable and setting it to auto-start is a classic persistence technique. It ensures the malicious code runs on system boot, maintaining access. This falls under the Persistence tactic, specifically T1543.003 Create or Modify System Process: Windows Service. The adversary leverages the existing service infrastructure to survive reboots.

Network isolation applies a restrictive host-based firewall policy on the endpoint, blocking all network traffic except the EDR agent's own management channel. This severs attacker command-and-control and lateral movement while retaining remote analyst access, rather than powering off or deleting files.

Recording both the business owner, who is accountable for the asset, and the technical custodian, who operates it, along with current contact details, gives responders an immediate escalation path. This is the only element that directly answers who to call, who can authorize disruptive containment actions, and who can interpret the asset's business impact during an active incident.

High-volume DNS queries with encoded subdomains and frequent NXDOMAIN responses are characteristic of DNS tunnelling or DNS beaconing used for command and control. The adversary encodes data or instructions in the query name to exfiltrate or receive tasking through a channel that often bypasses egress filtering. The signed Office add-in acting as the querying process is consistent with a compromised trusted application being used to reach the C2 infrastructure.

PowerShell scripts fall under Execution because they run adversary-controlled code on a target system, one of the techniques mapped to that tactic. Execution covers the actual running of malicious code, distinct from Initial Access or Persistence techniques.

Full-disk encryption converts all data on the volume, including database files, into ciphertext that requires the correct key to decrypt. When the key is sealed to a trusted platform module, removing the disk and mounting it elsewhere yields unreadable data. This directly addresses the theft scenario by protecting data at rest at the storage layer.

A firewall enforcing a default-deny policy between the DMZ and the internal network ensures that even if a web server is compromised, it cannot initiate connections to database servers. This directly implements network segmentation and least privilege at the network layer. The rule set should allow only required flows, such as database queries from a specific application server, and block all other traffic.

Lateral movement often involves an attacker using a compromised host to connect to other internal systems, particularly on administrative ports like SMB (445), RDP (3389), or WinRM (5985). NetFlow records capture source and destination IPs, ports, and byte counts. By analyzing for a single internal source connecting to many internal destinations on these ports, the analyst can identify patterns consistent with automated scanning or exploitation. This technique leverages flow data to detect east-west traffic anomalies without full packet capture.

Traffic over non-standard ports signals exfiltration because legitimate enterprise protocols typically use well-known ports, so unusual port usage can indicate tunnelling or covert channels. This satisfies the stem's requirement for a characteristic behaviour, as attackers often shift to non-standard ports to evade egress filtering and blend with permitted traffic.

Modifying the Run key is a classic Persistence technique (T1547.001 Registry Run Keys / Startup Folder). It ensures the malicious executable runs automatically when the user logs in, maintaining access across reboots. This is a direct attempt to establish persistence on the host, allowing the attacker to survive system restarts and maintain a foothold.

An IAM role attached to the instance profile supplies temporary credentials via instance metadata, and scoping the policy to the bucket ARN enforces least privilege. This satisfies the stem's constraint: the EC2 instance can only access that specific S3 bucket.

Discovery covers techniques that enumerate systems, accounts, shares and network resources to build situational awareness. Running whoami identifies the current user context, while net view lists reachable hosts and shares, both mapping directly to ATT&CK's Discovery tactic.

Loss Event Frequency derives from Threat Event Frequency and Vulnerability, the two factors determining how often loss events occur. Threat Event Frequency measures how often threat agents act, while Vulnerability expresses the probability those actions result in loss.

The Chain of Custody form documents who collected, handled and transferred each item of evidence, with timestamps and signatures. Providing it lets the forensic investigator demonstrate that evidence remained unaltered and admissible, satisfying the requirement for documentation proving integrity throughout the investigation.

The ps aux command lists all running processes with details such as user, PID, CPU, and memory usage. This is essential for identifying malicious processes, their parent-child relationships, and unusual command lines. It is a standard tool for capturing volatile process data on Linux systems.

Event ID 4769 is generated when a Kerberos service ticket is requested. Filtering for encryption type 0x17 (RC4-HMAC) and success code 0x0 reveals Kerberoasting attempts because attackers request RC4-encrypted tickets for offline cracking. The SPNs in these events identify the targeted service accounts, directly confirming the attack and scoping the affected services.