CCOA Practice Questions

Question 1

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

Accepted Answer

Time window. In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.

Answer

Throttle field

Answer

Notable event urgency

Answer

Risk score adjustment

Question 2

You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?

Accepted Answer

Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.. When a Nessus Agent is installed but the endpoint does not appear in Tenable.io's Asset Inventory, the first step is to verify the agent's link status and connectivity to the manager using 'nessuscli agent status' (or the equivalent on Windows). This command shows whether the agent is linked, the last connection time, and the manager it is linked to — quickly isolating whether the problem is agent-side linking/network versus a Tenable.io-side configuration issue.

Answer

Reinstall the Nessus Agent using the 'Force Install' flag.

Answer

Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.

Answer

Restart the Windows Management Instrumentation (WMI) service.

Question 3

Which TWO of the following are primary functions of an Information Security Governance program?

Accepted Answer

Strategic alignment. Strategic alignment (A) is a primary function of Information Security Governance because governance ensures that security initiatives, investments, and controls are aligned with the organization's business objectives, strategy, and regulatory obligations. Risk management (D) is also a core governance function, as governance establishes the frameworks, policies, and oversight processes for identifying, assessing, treating, and monitoring information security risks at an enterprise level. Writing code (B) is a software development or engineering activity, not a governance function. Wiring network cables (C) is a physical infrastructure implementation task. Patching server OS (E) is an operational/technical vulnerability management activity, not a governance-level responsibility.

Answer

Writing code

Answer

Wiring network cables

Answer

Patching server OS

Question 4

What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?

Accepted Answer

To provide continuous monitoring and automated response to threats on endpoints.. EDR solutions continuously collect endpoint telemetry (process execution, file changes, registry modifications, network connections) and use behavioral analytics to detect threats, then automate responses such as isolating a host, killing a process, or quarantining a file. This continuous monitoring plus automated response is the defining purpose of EDR. It operates at the endpoint layer, not the network edge or application layer.

Answer

To block all incoming traffic at the network edge.

Answer

To scan for vulnerabilities in web applications.

Answer

To manage user passwords and enforce complexity.

Question 5

A company is deploying a new web application in a public cloud. The security team must ensure that the application's data at rest is encrypted and that the encryption keys are managed by the cloud provider while still allowing the company to control key rotation. Which cloud key management service should they use?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. AWS KMS customer managed keys allow the customer to define and rotate keys while AWS manages the underlying HSMs. This provides the desired balance: the cloud provider handles the infrastructure, but the customer retains control over key rotation policies. Other services either focus on secrets, in-transit encryption, or require full customer key management, which does not meet the stated requirements.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 6

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Accepted Answer

Running 'whoami' or 'net view'. Discovery involves gathering information about the system and network to plan subsequent steps.

Answer

Installing a backdoor

Answer

Deleting logs to hide traces

Answer

Encrypting files for ransom

Question 7

A CCOA analyst is investigating a suspected insider threat involving unauthorized access to a file server. The analyst needs to correlate user activity with file access events. Which two log sources should the analyst prioritize? (Choose two.)

Accepted Answer

Active Directory authentication logs from domain controllers. To correlate user activity with file access, the analyst needs object access auditing events that identify the user and the file, and authentication logs that confirm the user's logon to the server. Together they establish who accessed what and from where. System, proxy, and firewall logs lack the necessary user-to-file mapping for this investigation.

Answer

Web proxy logs showing internet browsing activity

Answer

Firewall logs showing allowed and denied connections between network segments

Answer

File server system logs showing disk errors and hardware faults

Question 8

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

Accepted Answer

Detection and Analysis. In NIST SP 800-61, the Detection and Analysis phase is where precursors (early warning signs) and indicators of compromise (IoCs) are identified, validated, and used to determine whether an incident has occurred. This phase covers monitoring, alert triage, and incident declaration. The other phases handle readiness, response actions, and review, not attack-signal identification.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 9

A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?

Accepted Answer

Documenting a clear chain of custody for the forensic image from creation to presentation. Chain of custody is the most critical element for admissibility because it provides a chronological record of the evidence's handling, ensuring that it has not been altered or compromised. While encryption, write blockers, and hashing support integrity and confidentiality, they do not replace the need to document who accessed the evidence and under what circumstances. A complete chain of custody allows the court to trust the evidence's authenticity.

Answer

Generating a hash value of the forensic image and storing it separately from the image

Answer

Using a write blocker during imaging to prevent modification of the original disk

Answer

Encrypting the forensic image with a strong algorithm and storing the key in a secure vault

Question 10

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.

Answer

Increasing password complexity

Answer

VLAN isolation

Answer

Firewall rules

Question 11

A security analyst is reviewing the configuration of a Windows Server 2022 file server that stores HR records. The server is a member of an Active Directory domain. The analyst finds that the local Administrators group contains the domain group 'Helpdesk_Tier1'. Helpdesk technicians need to reset user passwords and unlock accounts, but they should not have full control over the HR file server. Which action should the analyst take to enforce least privilege while preserving the technicians' ability to perform their duties?

Accepted Answer

Remove Helpdesk_Tier1 from the local Administrators group and delegate the 'Reset Password' and 'Unlock Account' permissions on the relevant Organizational Units.. The helpdesk team needs only two specific Active Directory actions: resetting passwords and unlocking accounts. Delegating those exact permissions at the Organizational Unit level removes their broad local administrative rights on the HR file server while still allowing them to do their job. This is the textbook application of least privilege for administrative delegation in Active Directory.

Answer

Remove Helpdesk_Tier1 from the local Administrators group and add it to the 'Account Operators' group in Active Directory.

Answer

Keep Helpdesk_Tier1 in the local Administrators group but enable the 'Protected Users' security group for all helpdesk accounts.

Answer

Remove Helpdesk_Tier1 from the local Administrators group and configure a Group Policy Object that denies logon to the HR file server for that group.

Question 12

Which TWO of the following are examples of 'Initial Access' tactics?

Accepted Answer

Phishing. In the MITRE ATT&CK framework, Initial Access consists of techniques that adversaries use to gain an entry point into a network, and Phishing (B) is a canonical example because it delivers malicious content via email, links, or attachments to compromise a user's credentials or execute code. Exploiting public-facing applications (D) is also an Initial Access technique (T1190), since it leverages vulnerabilities in internet-exposed services such as web servers or VPN gateways to establish a foothold. Registry modification (A) is a Defense Evasion/Persistence technique, not Initial Access, because it occurs after the adversary already has access. Screen capture (C) is a Collection technique used to gather data from an already-compromised host. Network scanning (E) is Discovery (or Reconnaissance), used to enumerate targets rather than to gain initial entry.

Answer

Registry modification

Answer

Screen capture

Answer

Network scanning

Question 13

A security operations analyst is reviewing the configuration of a newly deployed Windows Server 2022 file server that stores PII. The server has SMB signing disabled. Which of the following best describes the primary risk of leaving SMB signing disabled in this environment?

Accepted Answer

An attacker on the same network segment can perform a man-in-the-middle attack to modify SMB traffic between the client and server.. SMB signing ensures that SMB packets are not altered in transit and that they originate from a trusted source. Without it, an attacker positioned on the network can perform man-in-the-middle attacks, modifying file contents or injecting malicious commands. This is especially critical for a server storing PII, where data integrity and authenticity are paramount.

Answer

Unauthenticated users can mount the file share without providing credentials, leading to unauthorized data access.

Answer

SMB traffic will be sent in clear text, exposing sensitive PII to network sniffing attacks.

Answer

The server will be unable to negotiate SMB 3.0 connections, forcing fallback to the insecure SMB 1.0 protocol.

Question 14

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Accepted Answer

Exploiting an exposed VPN gateway. T1133 External Remote Services refers to adversaries leveraging legitimate, externally facing remote access services — most commonly VPN gateways, RDP, Citrix, or VDI — to gain initial access using valid or stolen credentials. Exploiting an exposed VPN gateway is the textbook example, as attackers frequently target unpatched VPN appliances (e.g., Pulse Secure, Fortinet, Citrix ADC) or use credential stuffing against VPN portals to establish a foothold.

Answer

Exploiting an internal web server

Answer

Phishing a user

Answer

Using a USB drive

Question 15

A security operations center (SOC) analyst is triaging an alert indicating that a user's workstation has been infected with malware that is attempting to communicate with a command-and-control (C2) server. The analyst wants to quickly identify the process responsible for the network connection. Which of the following tools is MOST appropriate for this task on a Windows system?

Accepted Answer

netstat -ano. netstat -ano is the correct tool because it lists active connections with the owning process ID, allowing the analyst to quickly identify the malicious process. The other tools provide DNS or routing information but do not correlate connections to processes, which is essential for rapid triage.

Answer

ipconfig /displaydns

Answer

route print

Answer

nslookup

ISACA Certified Cybersecurity Operations Analyst CCOA practice test

Three ways to study

Study CCOA by domain

Study CCOA by topic

Technology Essentials practice questions

Adversarial Tactics practice questions

Cybersecurity Principles And Risk practice questions

Securing Assets practice questions

Incident Detection And Response practice questions

CCOA fundamentals practice questions

CCOA scenario practice questions

CCOA troubleshooting practice questions

ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) practice questions