Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 1:

  Which of the following is the BEST method for hardening an operating system?

  A. Implementing a host Intrusion detection system (HIOS)
  B. Manually signing all drivers and applications
  C. Removing unnecessary services and applications
  D. Applying only critical updates
  C. Removing unnecessary services and applications

• Question 2:

  Which of the following should be considered FIRST when defining an application security risk metric for an organization?

  A. Critically of application data
  B. Identification of application dependencies
  C. Creation of risk reporting templates
  D. Alignment with the system development life cycle (SDLC)
  A. Critically of application data

• Question 3:

  Which of the following is the core component of an operating system that manages resources, implements security policies, and provides the interface between hardware and software?

  A. Kernel
  B. Library
  C. Application
  D. Shell
  A. Kernel

• Question 4:

  SIMULATION

  The CISO has received a bulletin from law enforcementauthorities warning that the enterprise may be at risk ofattack from a specific threat actor. Review the bulletin named CCOA Threat Bulletin.pdf on the Desktop.

  Which host IP was targeted during the following timeframe: 11:39 PM to 11:43 PM (Absolute) on August 16,2024?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open “CCOA Threat Bulletin.pdf” on the Desktop and review its contents. Note all the indicators of compromise (IOCs) provided — in this case, focus on IP addresses, domain names, file hashes, or other network indicators related to the specific threat actor.

  Make a list of all the relevant IP addresses from the bulletin. These are the potential attacker IPs that you will search for in the SIEM.

  Open the SIEM (Security Onion SOC/Kibana or the platform provided in your lab) and select the appropriate network log index (for example so-* or logs-*).

  Set the time range to an absolute window from 2024-08-16 23:39:00 to 2024-08-16 23:43:00 in your SOC’s standard timezone (adjust if your SIEM defaults to UTC).

  Create a search filter that matches traffic involving any of the IP addresses from the bulletin. This can be done with a query like: source.ip: (list_of_bulletin_ips) OR destination.ip: (list_of_bulletin_ips)

  Review the filtered events to identify which internal host(s) communicated with those bulletin IPs during the specified time window. Pay attention to the “targeted” host — usually the internal host that was the destination in inbound traffic from the threat IP, or the source in outbound connections if the attack vector was reverse.

  Confirm the host’s role in the event by checking connection direction, protocol, and event details. Ensure it aligns with the definition of “targeted” in the incident context.

  From the relevant event(s), extract the host’s internal IP address. This is the targeted host IP you will submit.

  Record the IP exactly as it appears in the logs and submit it as the answer.

• Question 5:

  An attacker has compromised a number of systems on an organization's network and is exfiltration data Using the Domain Name System (DNS) queries. Which of the following is the BEST mitigation strategy to prevent data exfiltration using this technique?

  A. Implement Secure Sockets Layer (SSL) encryption on the DNS server.
  B. Install a host-based Intrusion detection system (HIDS) on all systems in the network.
  C. Block all outbound DNS traffic from the network.
  D. Implement a DNS sinkhole to redirect alt DNS traffic to a dedicated server.
  D. Implement a DNS sinkhole to redirect alt DNS traffic to a dedicated server.

• Question 6:

  Which of the following MOST directly supports the cyber security objective of integrity?

  A. Data backups
  B. Digital signatures
  C. Least privilege
  D. Encryption
  B. Digital signatures

• Question 7:

  Which of the following is the PRIMARY security related reason to use a tree network topology rather than a bus network topology?

  A. It enables easier network expansion and scalability.
  B. It enables better network performance and bandwidth utilization.
  C. It is more resilient and stable to network failures.
  D. It Is less susceptible to data Interception and eavesdropping.
  C. It is more resilient and stable to network failures.

• Question 8:

  The PRIMARY function of open source intelligence (OSINT) is:

  A. encoding stolen data prior to exfiltration to subvert data loss prevention (DIP) controls.
  B. Initiating active probes for open ports with the aim of retrieving service version information.
  C. delivering remote access malware packaged as an executable file via social engineering tactics.
  D. leveraging publicly available sources to gather Information on an enterprise or on individuals.
  D. leveraging publicly available sources to gather Information on an enterprise or on individuals.

• Question 9:

  Which of the following should occur FIRST during the vulnerability identification phase?

  A. Inform relevant stakeholders that vulnerability scanning will be taking place.
  B. Run vulnerability scans of all in-scope assets.
  C. Determine the categories of vulnerabilities possible for the type of asset being tested.
  D. Assess the risks associated with the vulnerabilities Identified.
  A. Inform relevant stakeholders that vulnerability scanning will be taking place.

• Question 10:

  Most of the operational responsibility remains with the customerin which of the following cloudservice models?

  A. Data Platform as a Service (DPaaS)
  B. Software as a Service (SaaS)
  C. Platform as a Service (PaaS)
  D. Infrastructure as a Service (laaS)
  D. Infrastructure as a Service (laaS)