ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) (CCOA) — Questions 226–300

Pod Security Admission restricted profile is an admission-time control that rejects pods violating runAsNonRoot, allowPrivilegeEscalation false, and capability restrictions. It directly prevents containers from running as root or escalating privileges, matching the hardening objective. Because it operates at admission, noncompliant workloads never start, providing deterministic enforcement rather than runtime detection.

Changes to web server configuration files signal tampering, such as altered document roots, added rewrite rules or malicious modules. Monitoring configuration integrity satisfies the compromise-detection requirement because unauthorised edits often accompany persistence mechanisms established after initial exploitation.

A Business Impact Analysis identifies which business processes are most critical by assessing the consequences of their disruption over time. This criticality ranking, expressed through recovery time and recovery point objectives, then drives continuity strategy and resource prioritisation, making process criticality determination its primary objective.

The time window restricts the lookback period to evaluate the threshold logic.

Checking `nessuscli agent status` confirms whether the agent has successfully linked to its manager, since an unlinked or offline agent never reports plugin and asset data. This directly addresses the stem's constraint: endpoints absent from Asset Inventory despite installation, isolating link-state failure before investigating scanning or licensing.

Strategic alignment ensures security initiatives directly support organisational objectives and risk appetite, which is a core governance function. It satisfies the stem's requirement by connecting security strategy to business goals, rather than addressing operational controls or technical implementation tasks.

EDR continuously collects endpoint telemetry — process, file, registry and network activity — then applies behavioural analytics to detect malicious patterns, enabling automated containment such as isolating a host or killing a process. This satisfies the stem's requirement for both ongoing monitoring and automated threat response, distinguishing it from signature-only antivirus.

AWS KMS with customer managed keys allows the company to create and control the lifecycle of encryption keys, including rotation, while the underlying hardware security modules are managed by AWS. This meets the requirement for provider-managed infrastructure with customer control over rotation. It is designed for encrypting data at rest in AWS services.

Mitigation directly lowers likelihood and impact by making encryption of production data harder and restoring services faster. Immutable offline backups defeat ransomware's extortion leverage, segmentation limits lateral spread, and rehearsed recovery sustains clinical availability. This treatment aligns residual risk with the hospital's tolerance while respecting the availability requirement stated in the scenario, making it the most defensible option.

The assurance gap is the absence of independent attestation over confidentiality controls across a period. A SOC 2 Type II covering the confidentiality criterion provides exactly that: tested operating effectiveness of controls protecting data throughout the audit window. It directly complements the existing security and availability coverage and satisfies due diligence for regulated financial data handling.

Object Access auditing, enabled via audit policy on the file server, records file system events including Delete and Delete Subfile entries with the responsible account. This directly attributes deletion activity to a user, unlike logon or process-tracking logs, which lack file-level detail.

Isolating the host from the network severs command-and-control and lateral movement paths, halting ransomware propagation while preserving volatile memory and disk evidence for forensics. Powering off or deleting files destroys evidence and may trigger encryption, so network isolation is the immediate containment step.

Detection and Analysis is the phase where precursors and indicators are identified, satisfying the stem's requirement to classify the incident. It gathers evidence, validates whether an event is genuinely an incident, and determines its scope and impact before containment, eradication, and recovery activities begin.

Execution encompasses techniques that result in adversary-controlled code running on a system. Invoking rundll32.exe to call an exported function from a malicious DLL is a direct method of running that code. The tactic describes the act of getting the payload to run, which is exactly what the observed command accomplishes.

Segment isolation cuts the network path ransomware or an intruder needs for lateral movement, satisfying the containment goal of stopping spread while forensic evidence is preserved. It is reversible and scoped, unlike full shutdown, so business continuity is maintained during investigation.

A scheduled backup job running across distributed infrastructure or through a proxy pool can authenticate from several apparent source addresses at once. Because the account has a strong random password and a defined automated role, the simultaneous logons most likely reflect how the backup application egresses traffic rather than malicious use of stolen credentials.

Chain of custody documentation records who handled the evidence, when, and why, ensuring that the evidence has not been tampered with or altered. In legal proceedings, a broken or incomplete chain of custody can lead to evidence being ruled inadmissible. For PHI breaches, maintaining an unbroken chain is critical to demonstrate integrity and support potential legal action or regulatory penalties.

Delegating only the specific Active Directory permissions needed for password reset and account unlock on the appropriate Organizational Units grants the helpdesk technicians exactly the rights required to perform their job. Removing them from the local Administrators group eliminates unnecessary full control over the HR file server, directly enforcing least privilege while preserving operational capability.

Mutual TLS requires both client and server to present X.509 certificates, so a service account cannot be impersonated without possessing its private key. This cryptographically binds the identity to the credential, directly countering impersonation, unlike network controls that only restrict reachability.

Phishing qualifies as an Initial Access tactic because it gains an attacker their first foothold in a target environment, typically by harvesting credentials or delivering malware. It satisfies the scenario's requirement by directly enabling entry, unlike later-stage tactics such as persistence or privilege escalation, which presuppose existing access.

Automated discovery tools help ensure that new assets are detected promptly, reducing the risk of unmanaged devices. They can also identify changes to existing assets, such as software updates or configuration changes, keeping the inventory current. This is a foundational practice for maintaining an accurate asset inventory.

Application and database logs record the actual queries and requests reaching the backend, revealing injected payloads, unexpected SQL syntax and error patterns that confirm exploitation. They satisfy the scenario's need to trace how malicious input was processed and what data or commands it triggered.

Exploiting an exposed VPN gateway directly matches T1133, which covers adversary use of external-facing remote services such as VPNs, RDP and Citrix to gain initial access. The exposed gateway satisfies the technique's requirement for a publicly reachable service, letting the attacker authenticate or exploit it rather than relying on user execution.

SMB signing provides integrity and authentication for SMB packets, preventing an attacker from intercepting and altering data in transit. Without it, a malicious actor on the network path can modify file contents or commands, leading to data tampering or privilege escalation. This directly threatens the confidentiality and integrity of PII stored on the server.

The Data Owner holds business accountability for a data asset, determining its value and sensitivity, and therefore assigns the appropriate classification level. This decision-making authority, rather than day-to-day handling performed by custodians, satisfies the stem's classification responsibility.

The XSS on the public login page is the highest risk because it is exploitable by any internet user without authentication. Even though it is medium severity, its public exposure and potential for credential theft make it more urgent than an RCE that is not externally reachable. Risk prioritization considers exploitability and exposure.

Secure coding practices such as input validation and parameterized queries remove entire vulnerability classes at the source, independent of any network control. Even if the WAF is bypassed or misconfigured, properly coded queries resist injection, giving a genuinely separate layer of protection for the application.

netstat -ano displays active network connections along with the process ID (PID) that owns each connection. The analyst can then map the PID to a process name using Task Manager or tasklist. This directly identifies the process responsible for the C2 communication, making it the most appropriate tool for this scenario.

The 'lsof -i :8443' command lists open files associated with Internet sockets on port 8443, including the process name, PID, and user. It is a standard, reliable way to map a listening port to its owning process on Linux. This directly answers the analyst's need to identify the process bound to the unexpected port and assess whether it is authorized.

AWS CloudTrail records every API call made in the account, capturing the identity, timestamp, source IP and request details. Reviewing its event history for the IAM role reveals the anomalous calls, satisfying the need to trace what that role actually invoked.

ARP scanning works by broadcasting ARP requests across every address in a subnet range to map live hosts, producing exactly the pattern described: one source host generating many ARP requests to the whole subnet. It is a reconnaissance technique preceding further attacks.

Confirmed sensitive PII exposure triggers the organisation's data breach response plan, which defines containment, notification timelines and regulatory reporting duties. Activating it immediately ensures legal and privacy obligations are met while forensic evidence is preserved.

The -A INPUT appends a rule to the inbound chain, -s 192.168.10.0/24 matches the source subnet, and -j DROP discards matching packets. Together they block all incoming traffic from that subnet, satisfying the stated requirement.

Order of volatility dictates collecting the most perishable evidence first: process tables, network connections, and kernel state vanish on reboot or service restart. Capturing these before touching logs preserves volatile artifacts, while subsequent acquisition of auth.log and file metadata retains persistent evidence for timeline reconstruction. This sequence supports both live response and later forensic analysis without destroying either category.

Pass-the-Token attacks replay a stolen token, so Microsoft Entra ID sign-in logs show token-based authentication succeeding without an MFA challenge. That combination confirms the attacker bypassed credential and MFA verification by reusing an already-issued token.

Wireshark provides a graphical interface to analyze packet captures and includes a feature to export objects from HTTP, SMB, and other protocols. By navigating to File > Export Objects > HTTP, the analyst can list and save files transferred over HTTP. This makes Wireshark the appropriate tool for reconstructing files from a pcap in this scenario.

A central database holding both PII and credit card data warrants 'High' criticality because compromise triggers regulatory breach notification, financial penalties and identity theft risk. Its confidentiality, integrity and availability requirements exceed those of internal or public assets, matching the highest classification tier.

'net user /domain' enumerates domain user accounts, which is a Discovery technique (T1087 Account Discovery). It helps the adversary understand the user landscape for targeting. This is a classic example of Discovery because it gathers information about accounts and permissions within the domain, aiding in further attacks.

Using net.exe and nltest.exe to enumerate domain groups and trusts is internal reconnaissance to understand the environment. This aligns with TA0007 Discovery, which includes techniques like Domain Trust Discovery (T1482) and Permission Groups Discovery (T1069). The goal is gathering information to plan further actions, not directly executing payloads or moving laterally.

Microsoft Sentinel analytics rules have an incident creation toggle independent of the rule's query and schedule. When disabled, matching alerts still generate but no incident is raised, so brute force detections never surface in the incident queue despite the KQL rule being enabled.

Amcache.hve records metadata about executables that have run on the system, including file paths and first execution times. It is particularly useful for tracking the initial appearance of a suspicious binary. Therefore, it provides direct evidence of the executable's path and creation time.

Daily administration under a root or administrator account grants unrestricted, system-wide write access, so a single mistyped command or misdirected script can alter critical configuration or delete data irreversibly. Using a standard account with Microsoft Entra ID role assignments scoped to specific tasks enforces least privilege, containing mistakes before they escalate.

Windows Registry keys satisfy the fileless constraint because malicious scripts persist as encoded values rather than files on disk, evading signature-based scanning. Attackers store payloads in keys such as Run or user hives, then execute them via trusted binaries like PowerShell or mshta, leaving minimal forensic artefacts.

`-EncodedCommand` accepts a Base64-encoded UTF-16LE string, letting PowerShell execute code without quoting or special characters. It directly matches the stem's Base64 constraint, so its presence in a process command line is a strong indicator of obfuscated, encoded execution during investigation.

Access logs record every HTTP request with timestamp, source IP, URI and response code, so the POST that wrote the web shell appears alongside the attacker's earlier reconnaissance and upload attempts. This traces the upload's origin, which file-integrity or malware scanning alone cannot establish.

Access control policy is a management-level directive defining who may access which resources and under what conditions, satisfying the NIST administrative control family. It governs behaviour through rules and expectations rather than technical enforcement, unlike logical controls such as firewalls or encryption, and differs from physical safeguards like locks.

Event ID 4624 records successful logon events and includes Logon Type, Account Name, and Source Network Address fields. For this scenario, filtering 4624 for svc_backup with Logon Type 2 confirms an interactive logon and shows the originating workstation, directly validating whether the backup service account was misused outside its scheduled job context.

Isolation keeps the machine powered so RAM contents, running processes, network connections and encryption keys remain intact. Powering off destroys volatile memory, losing evidence such as injected code and active sessions. Isolation preserves this volatile evidence while blocking attacker access and further lateral movement.

Sysmon assigns a globally unique ProcessGuid to each process and records the ParentProcessGuid in Event ID 1 (Process Creation). These GUIDs are stable and unique, allowing the analyst to reliably reconstruct the process tree even if PIDs are reused. This is the recommended method to establish lineage and spot malicious parent-child relationships.

Domain controller Security logs capture authentication events such as 4624 and 4625, including the user account, logon type, and source workstation. Correlating these with file access events helps confirm whether the user authenticated to the file server and from where, strengthening the insider threat timeline.

Checking the digital signature of the executable referenced by the Run key reveals whether it is signed by a trusted publisher or tampered with. Unsigned or invalid signatures indicate likely malicious persistence, satisfying the need to distinguish legitimate from malicious entries.

SIEM aggregates and correlates logs from network devices and endpoints, while EDR provides deep process-level visibility on the workstation. Integrating them allows the analyst to link SMB connections, process execution, and file access into a coherent attack narrative. This combination directly addresses the need to confirm lateral movement and exfiltration by joining network and host telemetry.

A legitimate action flagged as malicious accurately defines a false positive: benign activity that a SIEM correlation rule incorrectly matches, triggering an unnecessary alert. This satisfies the scenario's requirement by distinguishing false positives from false negatives (missed threats) and true positives (genuine detections), so analysts can tune rules to reduce alert fatigue.

Port 445 is used by SMB (Server Message Block) for file sharing, printer sharing, and inter-process communication. Outbound SMB traffic to external IPs is highly suspicious because it can be used to exfiltrate files or spread worms like WannaCry. Blocking outbound SMB at the perimeter is a common best practice to prevent such abuse.

Masquerading as a system process names a legitimate-looking executable, such as svchost.exe, so defenders and users overlook malicious activity. It is catalogued under Defense Evasion because it conceals the adversary's true identity rather than exploiting a vulnerability.

klist displays the Kerberos ticket cache for the current logon session, showing which service tickets have been obtained. If a connection uses Kerberos, a corresponding ticket appears; if NTLM is used, no ticket is present for that service. By running klist before and after accessing the file share, the analyst can confirm whether Kerberos authentication succeeded or fell back to NTLM.

Applying the highest classification label and restricting access is a conservative, risk-based approach that prevents potential data exposure while awaiting formal classification. Since the server stores ePHI, it likely warrants a high classification, and this action ensures immediate protection without delaying the classification process.

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider. By purchasing cyber insurance, the organization retains the operational risk but transfers the financial consequences of a breach to the insurer. This aligns with the definition of transference in risk treatment.

The container runtime is the low-level component that unpacks the image and starts, monitors and stops container processes on the host, interfacing with the kernel's isolation primitives. It executes containerised applications, distinct from orchestration or image-building tools.

X-Frame-Options: DENY instructs the browser to refuse rendering the page inside any frame or iframe, blocking the framing technique clickjacking relies on. This directly satisfies the stem's requirement to mitigate clickjacking, unlike headers such as Content-Security-Policy alone or X-Content-Type-Options.

The outbound SMB connections from a non-standard process like rundll32.exe loading a DLL from a user-writable location strongly indicate the adversary is moving laterally across the network. SMB is a common protocol for lateral movement via administrative shares or remote service execution. The tactic of Lateral Movement encompasses techniques that adversaries use to enter and control remote systems.

Event ID 4740 is logged on domain controllers when a user account is locked out, capturing the target username and caller computer name. Filtering on this ID directly satisfies the stem's requirement to trigger on account lockout, unlike authentication failure events such as 4625, which record individual failed logons rather than the lockout itself.

On Linux, /proc/<PID>/exe is a symbolic link to the actual executable file. Using ls -l on this link reveals the full path to the binary, even if the process name was changed. This is the most direct and reliable method to identify the executable associated with a running process, which is critical for further malware analysis.

Public read access lets any unauthenticated internet user list and download every object in the bucket, so the exposure is direct data theft rather than mere modification. This satisfies the stem's confidentiality risk: unauthorised exfiltration of stored contents, with no credentials or exploit required.

windows.malfind scans process memory for pages marked executable and writable that lack a corresponding file on disk, the classic signature of injected code. This directly satisfies the stem's requirement to detect code injection within a suspicious process, unlike plugins that only list processes or network sockets.

Acceptance means management acknowledges the residual risk and proceeds without patching, which matches their refusal driven by legacy dependencies. Unlike mitigation, transfer or avoidance, no control change occurs; the risk is formally retained and should be documented in the risk register with an owner.

Scope measures how many systems, accounts or data sets the incident touches, directly driving severity because broader compromise means greater business impact. It is one of the three factors, alongside data sensitivity and operational impact, used to rate the incident.

VLANs provide logical segmentation by isolating broadcast domains and separating traffic at layer 2. They are a building block for network segmentation, allowing different departments or security zones to be separated. However, VLANs alone do not enforce security policies; they must be combined with firewalls or ACLs. Still, they are an essential component.

Risk acceptance occurs when an organization acknowledges a risk and decides to retain it without additional mitigation, typically because the cost of treatment exceeds the benefit or because the system is operationally required. The CISO's documented decision to accept residual risk for the unpatched payroll application matches this treatment exactly.

Recording both successful and failed authentication attempts reveals brute-force attacks, credential stuffing, and unauthorised access, while establishing an audit trail for compliance. This satisfies the stem's requirement to detect malicious activity and meet regulatory logging obligations on the database.

Disabling unused modules removes unnecessary attack surface from the web service itself, eliminating known vectors such as WebDAV exploitation and directory listing information disclosure. This directly satisfies endpoint hardening of the service rather than host or network controls.

Modifying an existing scheduled task to execute a malicious script ensures the adversary's code runs automatically on a recurring basis, even after reboots or credential changes. This is a classic persistence mechanism because it maintains foothold without requiring ongoing interactive access. The use of a legitimate task name and SYSTEM privileges further hides the activity, aligning with TA0003 Persistence.

User Execution occurs when a victim runs a malicious file or link, causing adversary code to execute on the host. This satisfies the Execution tactic, which covers techniques that result in running attacker-controlled code on a target system.

A Domain Generation Algorithm (DGA) is used by malware to generate a large number of pseudo-random domain names that it can attempt to contact. The malware queries many domains, most of which are not registered, resulting in NXDOMAIN responses. The frequent, random subdomains under a single domain indicate a DGA attempting to locate its command-and-control server.

Assets that handle regulated data and directly support revenue are high criticality because their compromise can cause regulatory penalties, financial loss, and reputational damage. This criterion ties classification to business impact and legal obligations, which is the correct basis for prioritizing security controls and monitoring.