203 questions total · 3pages · All types, answers revealed
Page 3 of 3
Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?
The Data Owner is accountable for data classification.
Why this answer
The Data Owner is the individual responsible for determining the classification and appropriate protection levels for data.
You are performing a credentialed vulnerability scan using Nessus Professional on a Linux server. The scan reports that the 'Remote Windows SMB' service is missing patches, but the target is Linux. What is the most likely cause of this discrepancy?
The vulnerability scan likely applied a Windows plugin set because the credentials provided or the SSH banner allowed for a misidentification of the OS family during the initial discovery phase.
Why this answer
This is a common issue when the 'Safe Checks' are enabled or when the SSH service is configured to allow legacy protocols that trigger incorrect plugin attribution in the vulnerability database.
You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?
CloudTrail provides a comprehensive history of API calls made by users, roles, and services.
Why this answer
AWS CloudTrail records all API activity within an AWS account, including the identity and source of the request.
You are monitoring a network and detect a large number of ARP requests from a single host targeting the entire subnet. This is a sign of what?
The activity of mapping the local subnet.
Why this answer
ARP scanning is a common technique used by attackers to map a network and identify active hosts.
An organization is updating its BCP plan. Which step in the risk assessment process should occur immediately after identifying the critical assets?
Threats must be identified against the specific assets found.
Why this answer
After identifying assets, the next logical step is to identify the threats that could impact those specific assets.
Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?
Ensures compliance with reporting laws.
Why this answer
Confirmed PII incidents require legal notification and the activation of the data breach response procedure.
You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?
This is the correct command structure for blocking a subnet in the INPUT chain.
Why this answer
The 'iptables -A INPUT -s [network] -j DROP' syntax correctly appends a rule to the INPUT chain to drop traffic from the specified source.
You are evaluating a third-party application's access requirements. Which THREE of the following are considered 'Least Privilege' implementations?
Service accounts should be unique to the application to ensure accountability and scoping.
Why this answer
Least privilege requires granting only the absolute minimum permissions needed for a task, using granular roles, and scoping access by resource.
You are analyzing an incident where a user's machine was compromised via a malicious document. Which Windows log indicates that a macro was executed?
Records macro execution details when auditing is configured.
Why this answer
Microsoft Office logs (or specific Windows Event logs, such as those related to Office applications) record macro execution if auditing is enabled.
In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?
Indicates the reuse of a stolen session token.
Why this answer
'Token-based' sign-ins that lack a corresponding MFA challenge or device registration are strong indicators of session theft or pass-the-token attacks.
During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?
Storing PII and financial data makes the asset critical due to regulatory and business impacts.
Why this answer
Assets that hold PII, financial data, or are critical to core business functions are universally classified as 'High'.
While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?
This is a common configuration error where alerts are generated but not promoted to incidents.
Why this answer
If 'Incident creation' is disabled in the Microsoft Sentinel analytics rule settings, the rule will generate logs but will not group them into an incident for investigation.
In the context of the principle of least privilege, why should you avoid using a root or administrator account for daily system administration?
Least privilege limits the damage potential of errors and malware.
Why this answer
Using a high-privilege account for daily tasks increases the risk that an accidental error or a compromised process will have full system control.
You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?
A common location for hiding fileless script execution.
Why this answer
Fileless malware often lives in the Windows Registry, specifically under 'Run' or 'RunOnce' keys, to ensure execution without a physical file on disk.
You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?
Used to execute base64-encoded strings.
Why this answer
The '-EncodedCommand' (or '-e', '-enc') switch in PowerShell is a common flag used to execute obfuscated or Base64 encoded scripts.
While investigating a web server breach, you find malicious PHP web shells. What is the most effective way to identify the source of the upload?
Provides the evidence of the HTTP request used for upload.
Why this answer
Web server access logs record every HTTP POST request, including the URI and the time, allowing you to correlate file creation with specific web requests.
Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?
A policy document is administrative.
Why this answer
Administrative controls are policies, procedures, and management tasks rather than technical or physical hardware.
When a workstation is compromised, why is it recommended to isolate it rather than turning it off?
The main reason for preferring isolation over power-off.
Why this answer
Turning off the machine clears the RAM, which contains volatile evidence that is critical for incident analysis.
During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?
Legitimate services are almost always digitally signed by a trusted publisher.
Why this answer
Checking the 'Image Path' and verifying the digital signature of the file are necessary to confirm if a startup entry is legitimate.
What is a 'False Positive' in the context of SIEM alerting?
Definition of a false positive.
Why this answer
A false positive is an alert that indicates a security incident when in reality, the activity is legitimate.
Which of these is a 'Defense Evasion' technique?
Making malware look like a standard Windows process evades observation.
Why this answer
Using masquerading (renaming files to look like system files) is a common way to hide malicious processes.
Which of the following best describes the function of a 'container runtime' in a virtualization environment?
Runtime components like containerd or runc are responsible for launching and managing container processes.
Why this answer
The container runtime is responsible for executing containers and managing image layers and namespaces.
A vulnerability report shows that your web application is susceptible to 'Clickjacking'. Which HTTP header should you implement to mitigate this?
The 'DENY' value prevents the page from being displayed in a frame, effectively mitigating clickjacking.
Why this answer
The 'X-Frame-Options' header (or the more modern 'Content-Security-Policy: frame-ancestors') prevents a site from being rendered within an iframe on an external site.
You are configuring a SIEM alert to trigger when a user account is locked out. Which Windows Event ID should your filter target?
This is the correct event ID for an account lockout.
Why this answer
Event ID 4740 is the standard Windows Security log event for an account lockout.
When reviewing cloud storage buckets, you find one is configured with 'public read access'. What is the risk?
Anyone on the internet can read and download the bucket's content.
Why this answer
Public read access allows anyone on the internet to list and download the contents of the bucket, leading to data exposure.
When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?
Specifically identifies injected code or hidden DLLs.
Why this answer
The 'windows.malfind' plugin in Volatility 3 is designed to locate injected code segments by scanning for memory regions with suspicious permissions (e.g., PAGE_EXECUTE_READWRITE).
During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?
The organization has acknowledged the risk and chosen not to modify the environment.
Why this answer
Risk acceptance is the decision to accept the risk because the cost of mitigation outweighs the potential impact or because business requirements forbid the change.
Which THREE factors should be considered when assessing the severity of a security incident?
Indicates the size of the compromise.
Why this answer
Severity assessment depends on the impact to business operations, the sensitivity of the compromised data, and the scope of the affected systems.
You are configuring security monitoring for a database. Which THREE events should you definitely log to ensure compliance and detect malicious activity?
Necessary to detect brute-force or unauthorized access attempts.
Why this answer
Monitoring administrative changes, authentication success/failure, and data access are the pillars of database security logging.
You are hardening a web server. Which TWO of the following steps are critical for 'Endpoint Hardening' of the web service itself?
Reducing the attack surface by disabling unnecessary modules is a fundamental hardening step.
Why this answer
Disabling unnecessary features and removing default configuration files are standard hardening steps to reduce the attack surface.
Which THREE of the following are considered 'Execution' techniques?
Triggering by a user is an execution method.
Why this answer
Command scripting, binary execution, and scheduled task execution are all ways to start code.
A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?
Analyzing the variance in time intervals between connections identifies the regularity characteristic of automated malware beaconing.
Why this answer
Beaconing is characterized by high periodicity and low jitter, which can be identified by calculating the variance in the time interval between consecutive connections.
You are configuring Microsoft Defender for Endpoint (MDE) to restrict USB storage access on corporate-managed Windows endpoints. Which policy setting should you configure in the Microsoft Intune Endpoint Security portal to ensure only authorized hardware IDs are permitted while blocking all others?
This is the correct path in the Endpoint Security Device Control profile to restrict access while providing an allow-list for specific hardware.
Why this answer
In Intune, the 'Removable Storage Access' settings under 'Device Control' allow for granular control over USB access, specifically allowing the specification of Hardware IDs for allow-listing.
A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?
Resource Monitor provides a detailed breakdown of disk I/O per process.
Why this answer
Resource Monitor is the standard Windows utility for granular monitoring of per-process disk, CPU, and memory activity.
Which TWO actions are required to properly secure a compromised user account during the eradication phase?
Prevents existing sessions from continuing.
Why this answer
Eradication of a compromised account requires both stopping the current access (revoking tokens) and preventing future unauthorized access (password reset).
Which type of log provides the most granular detail regarding local account creation on a Windows Server?
Contains auditing information such as account management.
Why this answer
Windows Security Event Logs (specifically Event ID 4720) record the creation of new user accounts, providing the most granular detail.
Which THREE actions are essential to the 'Identify' function of the NIST CSF?
Strategy is a core part of Identify.
Why this answer
Identify covers inventory, risk management, and governance.
You are hardening a Linux server and want to disable all unused network ports. Which command would be best to identify listening ports and their associated processes?
This command shows all TCP/UDP listening ports and the process ID (PID) owning the port.
Why this answer
'ss' (socket statistics) with the '-tulpn' flags is the modern, preferred tool over the deprecated 'netstat' for viewing listening sockets with process IDs.
Which THREE of the following are 'Privilege Escalation' techniques?
The core technique.
Why this answer
Exploiting system software, abusing user accounts, and using local security exploits are common escalation vectors.
Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?
Qualitative uses descriptive risk levels.
Why this answer
Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.
You are reviewing a list of vulnerabilities found by an automated scanner. Which type of vulnerability would be considered the most critical to remediate first?
RCE on an internet-facing asset is the highest priority due to ease of exploitation and impact.
Why this answer
An RCE (Remote Code Execution) vulnerability allows an attacker to execute arbitrary code with the privileges of the application, representing the highest possible threat.
Which THREE of the following are common 'Exfiltration' techniques?
A common exfiltration technique.
Why this answer
Using cloud storage, scheduled transfers, and network protocols are common ways to move data out.
You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?
Designed for forensic imaging with built-in hash verification.
Why this answer
FTK Imager is a widely recognized industry tool for creating forensic bit-stream images and verifying the integrity of the data using MD5 or SHA-1 hashes.
Which TWO of the following are examples of 'Persistence' tactics?
A common persistence technique.
Why this answer
Creating scheduled tasks and adding items to the Startup folder are standard ways to ensure malware survives reboot.
You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?
Removing logs is a classic technique to hide tracks.
Why this answer
Clearing logs is an explicit attempt to remove traces of activity to evade detection.
A SIEM has triggered an alert for 'Excessive Failed Login Attempts' followed by a 'Successful Login'. Which technique is this most likely attempting to detect?
Characterized by high failure rates followed by a successful credential match.
Why this answer
This pattern is characteristic of a password spraying or brute force attack, where the attacker tries many passwords until one is successful.
You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?
Encryption makes data unreadable to unauthorized parties.
Why this answer
Confidentiality ensures that only authorized parties can access data, which is achieved through encryption.
You are investigating an alert in CrowdStrike Falcon. To determine if a file was moved laterally after its initial execution, which feature provides the most accurate visualization?
Shows the causality and movement of processes across the environment.
Why this answer
The Process Tree visualization in CrowdStrike Falcon allows analysts to trace the execution history and lateral movement paths of malicious files across different endpoints.
During a digital forensics investigation of a Windows host, an analyst suspects an attacker used PowerShell 'Fileless' execution. Which artifact within the Windows Event Logs would provide the most definitive evidence of the specific command line arguments used during the execution?
Event ID 4104 (PowerShell Script Block Logging) captures the entire code block executed, even if the command is obfuscated or fileless.
Why this answer
Event ID 4104 records Script Block Logging, which captures the full content of executed PowerShell blocks, including obfuscated code.
You are analyzing logs to detect a 'Lateral Movement' attack. Which THREE of the following behaviors are common indicators?
This 'horizontal' movement pattern is a hallmark of credential harvesting/lateral movement.
Why this answer
Lateral movement often involves using legitimate tools like PowerShell or WMI (Living off the Land) to move between systems using captured credentials.
Which THREE factors are commonly used to calculate risk in a basic qualitative model?
The harm caused to the organization.
Why this answer
Risk is typically defined by the combination of a threat, the vulnerability, and the potential impact.
You are setting up a secure baseline for a new server. You need to ensure the operating system logs are sent to a centralized logging server. Which service should you configure?
rsyslog is the standard service for collecting and forwarding system logs.
Why this answer
Syslog (or Syslog-ng/rsyslog) is the standard protocol and service for forwarding logs from a Linux server to a central collection point.
You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?
The correct API call for modifying S3 bucket policies.
Why this answer
'PutBucketPolicy' is the specific API call recorded in CloudTrail when an IAM identity modifies the bucket policy of an S3 bucket.
Page 3 of 3
Practice CCOA by domain
Target a specific domain to shore up weak areas.