Technology Essentials

A CCOA analyst is reviewing a memory image from a compromised Windows host. The analyst needs to identify evidence of process injection and persistence that may not appear in the file system. Which two artifacts should the analyst prioritize examining? (Choose two.)

You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?

What is the function of the 'netstat' command in a Windows environment?

A CCOA analyst is reviewing the security posture of an organization's public cloud tenancy. The team wants to reduce the risk of credential-based attacks against the cloud management plane. Which two measures most directly strengthen identity protection for administrative access? (Choose two.)

You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?

You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this typically signify?

A security operations center (SOC) analyst is reviewing logs from a Windows server and notices Event ID 4625 (An account failed to log on) occurring repeatedly for the same user account from a single source IP within a short time frame. Which type of attack does this pattern most likely indicate?

A security operations analyst is reviewing a packet capture and notices a large volume of TCP SYN packets sent to many different destination ports on a single internal host, with no corresponding SYN-ACK responses. The analyst wants to determine the intent of this traffic. Which type of activity does this pattern most likely represent?

Which protocol is most appropriate for secure remote management of network infrastructure devices?

Which TWO of the following are essential components of a secure network design for a segmented corporate network?

Which TWO of the following are common indicators of a compromised system found during host-based log analysis?

A CCOA analyst is evaluating a zero trust architecture for a hybrid environment. The organization wants to ensure that every access request is authenticated and authorized based on multiple signals before a session is established. Which core zero trust principle does this requirement embody?

A company is deploying a new web application and wants to ensure that it is protected against SQL injection attacks. The application uses a backend database. Which of the following is the MOST effective mitigation to prevent SQL injection?

You are hardening a virtual machine's security. Which action is the most effective way to prevent VM escape attacks?

You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?

Which TWO of the following are primary security controls for securing virtual machines in a production environment?

When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?

A security analyst is examining a suspicious PowerShell script that was executed on a Windows endpoint. The script appears to download and execute a payload from a remote server. Which of the following PowerShell features is MOST likely being abused to obfuscate the malicious code?

A security operations center (SOC) analyst is investigating a suspected breach. The attacker used PowerShell to download and execute a payload in memory, leaving minimal disk artifacts. The analyst needs to reconstruct the attack by examining Windows event logs. Which Windows event log source should the analyst prioritize to find PowerShell script block logging and module logging details?

You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?

Which THREE of the following are standard best practices for securing cloud infrastructure?

A security analyst is reviewing firewall logs and sees that an internal web server is making DNS queries to an external IP address that is not a known DNS resolver. The queries are for random-looking subdomains of a domain with no reputation. The volume of queries is high and consistent. The analyst suspects DNS tunneling for command and control. Which technology would best detect this activity by analyzing DNS query patterns and payload characteristics?

A company is migrating its on-premises workloads to a hybrid cloud environment. The security team must ensure that data stored in the cloud object storage service is encrypted at rest and that the encryption keys are managed by the organization, not the cloud provider. The team also needs the ability to revoke access to the keys immediately if a compromise is suspected. Which key management approach should the team implement?

You are auditing a web application server. You discover it is running with high privileges. What is the standard security practice to mitigate this risk?

A security operations center is reviewing its endpoint detection and response (EDR) coverage. The team wants to ensure that the EDR solution can detect and respond to threats that use fileless techniques and living-off-the-land binaries (LOLBins). Which two capabilities are most critical for the EDR to provide this coverage? (Choose two.)

A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large volume of outbound traffic from an internal server to an external IP address over port 53. The analyst suspects DNS tunneling. Which of the following techniques would BEST confirm this suspicion?

Which THREE of the following are common steps in performing a security audit of a Linux system?

A security administrator is configuring a Linux web server to run as a non-privileged user. The server needs to bind to TCP port 80. Which capability should be assigned to the web server binary to allow binding to a privileged port without running as root?

A security operations center (SOC) is implementing a new SIEM and needs to ensure that log data from various sources is normalized for effective correlation. Which TWO of the following are key considerations when normalizing log data? (Choose two.)

A security analyst is examining a Windows event log and notices Event ID 4625 followed by Event ID 4624 with Logon Type 3 from the same source IP within a few seconds. The account used is a local administrator. What is the most likely explanation for this sequence?

A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?

In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?

An analyst needs to verify the hash of a downloaded binary to ensure it has not been tampered with. Which command is used on Windows PowerShell?

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered two days ago. The analyst needs to perform dynamic analysis of the URL to determine if it leads to a malicious payload. Which two actions should the analyst take to safely analyze the URL and gather threat intelligence? (Choose two.)

A CCOA analyst is documenting the controls used to protect data at rest on a database server. The organization requires that stored data remain unreadable even if the physical disk is stolen. Which technology directly satisfies this requirement?

A network engineer is designing a demilitarized zone (DMZ) for a company's public-facing web servers. The requirement is to ensure that if a web server is compromised, the attacker cannot directly reach internal database servers. Which control best achieves this segmentation?

A security analyst is investigating a suspected breach and needs to determine whether an attacker moved laterally within the network. The analyst has access to NetFlow records from core switches. Which analysis technique is most effective for identifying lateral movement?

A CCOA analyst is hardening a Kubernetes cluster and wants to prevent any container from running with root privileges or escalating to root inside the pod. Which Kubernetes security control directly enforces this at admission time?

A company is deploying a new web application in a public cloud. The security team must ensure that the application's data at rest is encrypted and that the encryption keys are managed by the cloud provider while still allowing the company to control key rotation. Which cloud key management service should they use?

An analyst is reviewing authentication logs and sees repeated successful logons for a service account from several geographically distant locations within a short time window. The service account is configured with a long random password and is used by a scheduled backup job. Which explanation is most consistent with this pattern?

Which THREE of the following represent critical areas to inspect when a web application has been suspected of an injection attack?

You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?

During an investigation, a CCOA analyst observes that a Linux web server's /var/log/auth.log shows repeated successful sudo commands by the www-data account, which should never have interactive privileges. The analyst must preserve volatile evidence before remediation. Which action best follows accepted order of volatility while enabling later forensic reconstruction?

A CCOA analyst is investigating a suspected data exfiltration incident. The analyst has captured network traffic and wants to reconstruct files that were transferred over HTTP. Which tool should the analyst use to extract files from the packet capture?

In the context of the principle of least privilege, why should you avoid using a root or administrator account for daily system administration?

During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?

An analyst at a financial firm is reviewing network flow logs and notices a workstation repeatedly initiating SMB connections to multiple internal servers on TCP port 445, followed by large outbound data transfers to an external IP. The workstation's user reports no unusual activity. The analyst suspects lateral movement and data exfiltration. Which technology should the analyst use to correlate these network events with endpoint process and file activity to confirm the attack chain?

A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts to various external IP addresses on port 445. The analyst suspects a compromised host is attempting to spread laterally or exfiltrate data. Which protocol is associated with port 445, and what is the primary security concern?

A CCOA analyst is reviewing authentication logs for a Windows environment. The analyst observes a large number of successful logons using NTLMv2 for internal file share access, even though the domain is at a functional level that supports Kerberos. The analyst suspects that some clients are not using Kerberos due to misconfiguration. Which Windows command-line tool should the analyst use to verify the effective authentication protocol being used for a specific server?

Which of the following best describes the function of a 'container runtime' in a virtualization environment?

A CCOA analyst is examining a Linux server that is suspected of being compromised. The analyst runs the command 'netstat -tulnp' and sees an unfamiliar process listening on TCP port 4444. To identify the executable path associated with this process, which command should the analyst use next?

When reviewing cloud storage buckets, you find one is configured with 'public read access'. What is the risk?

A security operations center (SOC) is implementing network segmentation to protect critical assets. Which TWO of the following are essential components of a secure segmented network design? (Choose two.)

A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?

A SOC analyst is investigating a suspected data exfiltration event on a Windows 10 endpoint. The analyst needs to enumerate all active network connections along with the owning process IDs to identify which process is communicating with an external IP. Which built-in Windows command should the analyst use?

A SOC analyst is investigating suspicious outbound traffic from an internal host to a known command-and-control server. The analyst needs to capture full packet payloads for deep inspection and later forensic analysis. Which tool should the analyst use to capture the traffic on the Linux-based sensor?

A security analyst is configuring a web application firewall to protect an e-commerce site from injection attacks. The analyst wants to block requests that contain suspicious SQL syntax in input fields while minimizing false positives on legitimate product searches. Which approach best meets this goal?