ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) (CCOA) — Questions 301–338

Beaconing produces regular callbacks, so measuring the intervals between connections and looking for low variance or a dominant periodicity exposes the pattern. Frequency analysis of connection time intervals isolates that rhythm within high-volume PCAP or NetFlow data.

Resource Monitor's Disk tab lists per-process read and write bytes per second, directly exposing which process generates the heaviest write load. Task Manager shows totals, and Performance Monitor needs counters configured manually, so Resource Monitor answers the specific-process question fastest.

A documented offboarding procedure is an administrative control that ensures accounts are disabled or removed as part of the termination process. It directly reduces the window in which former employees can authenticate. Because it defines roles, steps, and timing, it addresses the root cause of stale credentials and is the appropriate first control to implement in this scenario.

Revoking active sessions and refresh tokens immediately invalidates the attacker's existing authenticated access, satisfying eradication by cutting off persistence. Password reset alone leaves stolen tokens valid until expiry, so session revocation is required to fully evict the intruder.

Security logs record account management events such as user account creation, including the actor, target account and timestamp, when the relevant audit policy is enabled. This gives the most granular detail on local account creation, unlike System, Application or Setup logs.

The -a switch displays all active TCP connections and listening ports, -n shows addresses and ports numerically to avoid slow name resolution, and -o includes the owning process ID for each connection. This combination directly maps suspicious external connections to PIDs, enabling the analyst to pivot to the process and determine whether it is legitimate or malicious.

The Received header fields are added by each mail server as the message passes through. The bottom-most Received header (the first one added) typically contains the IP address of the originating server. This is the most reliable way to trace the true source of the email, though it can be forged if the sender controls the first server.

Just-in-time elevation removes standing administrative rights and grants them only when a task is approved and for a limited window. A stolen credential therefore yields little value outside that window, directly shrinking the blast radius. It also creates an approval and audit trail that ties each elevation to a business justification, which supports both containment and after-action review.

The ss -tulpn flags list TCP and UDP listening sockets with numeric ports and owning process names, giving exactly the port-to-process mapping needed to identify and disable unused services during hardening. It supersedes the deprecated netstat for this purpose.

The core technique.

Qualitative risk assessment ranks likelihood and impact using descriptive labels such as High, Medium, and Low rather than numeric values. This matches the stem's descriptive scales, distinguishing it from quantitative approaches that assign monetary or numerical scores.

Full-disk encryption with AES-256 renders stored data unreadable without the correct key, and an HSM protects key material from extraction. If the physical media is stolen, the attacker lacks the secret needed to decrypt, directly satisfying the requirement for confidentiality of data at rest.

PASTA is a risk-centric, attacker-centric methodology whose stages explicitly incorporate business impact, threat intelligence on adversary capability and intent, and attack surface analysis before producing a prioritized, likelihood-weighted threat model. Stage II defines the technical scope and Stage III decomposes the application, while adversary and threat analysis stages score realistic threat agents. This directly matches the requirement to combine capability, intent, and opportunity against the specific API gateway surface.

RCE on an internet-facing application allows unauthenticated attackers to execute arbitrary code remotely, typically yielding full host compromise. Its external exposure and direct exploitation path make it the highest-severity finding, demanding immediate remediation ahead of lesser vulnerabilities.

The lsof command with -i :4444 lists open files associated with the process listening on port 4444, including the executable path. It directly maps the port to the process and shows the binary. This helps identify malicious software. Therefore, lsof is the correct next step to associate the port with an executable.

Exfiltration over alternative protocol transfers stolen data through a channel other than the command-and-control path, such as DNS, FTP, or ICMP, evading controls that monitor the primary channel. It satisfies the stem by being a recognised MITRE ATT&CK exfiltration technique.

FTK Imager creates a bit-stream forensic image of the SATA drive and generates MD5 or SHA-1 hashes of both source and image, verifying integrity. That hash comparison proves the copy is an exact, unaltered reproduction, which is the evidential requirement.

Domain controllers log authentication events, including successful and failed logons, in the Windows Security event log. By analyzing these logs, the analyst can identify which systems the service account authenticated to, especially if logon events include the source workstation name or IP address. This provides a comprehensive view of lateral movement across the domain, making it the most effective source.

Scheduled tasks let an adversary register malicious code to run automatically at defined times or triggers, surviving reboots and logoff. This satisfies the stem's definition of Persistence, since the mechanism re-establishes execution without further attacker interaction, maintaining foothold on the compromised host.

Process Injection (T1055) involves injecting code into another process to evade detection and potentially elevate privileges. The use of CreateRemoteThread to execute code in a remote process is a classic example of process injection. This technique allows the adversary to run code under the context of a legitimate process, making it harder to detect.

Removing unnecessary packages and services directly reduces the attack surface by eliminating potential vulnerabilities. If a service is not needed for the server's role, it should be disabled or uninstalled. This aligns with the principle of least functionality and is a core hardening practice.

A risk matrix is a qualitative tool that maps risks based on likelihood and impact ratings, often using scales like low, medium, and high. It is suitable for a new cloud platform because it allows analysts to prioritize risks without requiring precise quantitative data, facilitating discussion and decision-making.

Accessing NTDS.dit is a direct attempt to extract credential material, including password hashes for domain accounts, which is the defining goal of the Credential Access tactic. The subsequent NTLM authentications to member servers are consistent with the adversary using harvested credentials or hashes to move laterally, but the initial activity that enables that movement is the credential theft itself. The tactic mapping therefore centres on Credential Access.

Clearing Windows Event Logs destroys evidence of prior activity, so the adversary gains nothing tactically except avoiding detection. That places wevtutil cl under Defense Evasion, which covers indicator removal on host, rather than Execution, Persistence or Impact.

tcpdump with the -w flag writes raw packet data, including full payloads, to a pcap file for offline analysis. Specifying the host filter limits capture to the suspicious IP, reducing noise. This provides the complete packet contents needed for deep inspection and forensic review, unlike tools that only show metadata or summaries.

Identify is the CSF function that develops organizational understanding of systems, assets, data, and capabilities, including business environment, governance, risk assessment, and risk management strategy. It directly answers the CISO's need to know assets and risk appetite before prioritizing security activities, making it the correct function here.

Brute force attacks generate many failed authentications before one succeeds, exactly matching the failed-then-successful pattern the SIEM correlation rule detects. The technique relies on repeated credential guesses against a single account, so the volume of failures preceding the successful login is the defining signal Microsoft Entra ID sign-in logs would surface.

AES-256 is a symmetric block cipher that encrypts data in transit, rendering intercepted traffic unreadable without the key. It directly satisfies the confidentiality constraint by protecting sensitive data from unauthorised disclosure during transmission, unlike hashing or access controls which address different principles.

Periodic connections to an external IP with small data transfers are characteristic of malware beaconing to a command-and-control server. This allows the attacker to maintain persistence and issue commands. The consistent interval and low data volume are typical of such communication, distinguishing it from normal user activity.

Rapid authentication across 20 distinct workstations within five minutes exceeds any plausible human interaction pattern, signalling automated credential reuse typical of lateral movement. This satisfies the scenario's requirement for a behavioural indicator by exposing anomalous breadth of host access, which Microsoft Entra ID sign-in logs would surface as correlated risk detections.

The NIST CSF provides a common taxonomy of functions, categories, and subcategories that lets technical and executive audiences discuss risk consistently. It is voluntary, widely adopted across industries, and designed to complement other standards, making it ideal for demonstrating program alignment to auditors while communicating with leadership.

The regsvr32.exe invocation with /s /u /i:URL scrobj.dll is a classic signed-binary proxy execution technique, often called Squiblydoo, used to bypass application control and execute a remote scriptlet without writing to disk. Its primary purpose is to evade defenses, not to achieve persistence or credential access, so Defense Evasion is the most direct tactic.

An effective risk appetite statement must be actionable, which requires both qualitative framing and quantitative thresholds. For a hospital, that might mean tolerating no more than four hours of downtime for life-critical systems while accepting moderate risk in administrative applications. Without measurable thresholds, decision-makers cannot objectively determine whether a given risk falls inside or outside the organization's willingness to accept it.

The execution of a malicious macro that runs PowerShell to download and run a payload is a clear example of the Execution tactic. Execution encompasses techniques that result in adversary-controlled code running on a local or remote system. Here, the macro is the execution method, specifically T1204.002 User Execution: Malicious File. The adversary uses the user's action of enabling macros to execute code.

Impact measures the potential harm a realised threat would cause, making it a core axis of qualitative risk scoring alongside likelihood. In a basic model, risk is derived by rating impact severity against probability, so impact directly satisfies the stem's requirement for a commonly used calculation factor.

A signature-based rule set detects known injection patterns, and tuning it to the application's normal parameter behavior reduces false positives on legitimate searches. Monitoring alerts in a learning mode before enabling blocking allows the analyst to validate detections against real traffic, which balances protection with usability for the e-commerce site.

rsyslog is the standard Linux logging daemon that forwards local system and application logs to a remote centralised server. Configuring it satisfies the baseline requirement to ship operating system logs off-host for retention and correlation.

PutBucketPolicy is the CloudTrail event name recorded when an S3 bucket policy is created or replaced. Searching for it isolates the unauthorised modification, since that API call is the exact action that alters a bucket policy.