Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 91:

  SIMULATION

  Cyber Analyst Password:

  For questions that require use of the SIEM, pleasereference the information below:

  https://10.10.55.2

  Security-Analyst!

  CYB3R-4n4ly$t!

  Email Address:

  [email protected]

  Password:Security-Analyst!

  The enterprise has been receiving a large amount offalse positive alerts for the eternalblue vulnerability. TheSIEM rulesets are located in

  /home/administrator/hids/ruleset/rules.

  What is the name of the file containing the ruleset foreternalblue connections? Your response must includethe file extension.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open a terminal on the host that has the path /home/administrator/hids/ruleset/rules (Analyst Desktop or the SIEM server, depending on your lab setup)

  Navigate to the rules directory cd /home/administrator/hids/ruleset/rules

  List the files to understand naming and extensions ls -al

  Quickly check for filenames that already reference EternalBlue/MS17-010/CVE-2017-0144/SMB ls | grep -Ei "eternal|ms17|0144|smb"

  If filenames aren’t obvious, search inside all rule files for EternalBlue indicators (case-insensitive) grep -RinEI 'eternal\s*blue|EternalBlue|ms17[-_ ]?010|cve[-_ ]?2017[-_ ]?0144|smbv1' .

  From the grep results, note the filename(s) on the left; those are the candidate rule files. Open the most relevant candidate to verify it actually defines rules for EternalBlue “connections” (not something unrelated) less

  Inside the file, confirm the rule messages/metadata explicitly reference EternalBlue/MS17-010/CVE-2017-0144 or SMBv1 connection detection (for Suricata/Snort, look for msg: fields like “EternalBlue connection attempt”, for Wazuh/OSSEC XML, look for entries mentioning EternalBlue/MS17-010)

  If multiple files match, pick the one whose rules specifically describe “connections” to SMB/port 445 or EternalBlue handshake/negotiation, rather than generic exploit or other SMB detections

  Copy the filename exactly as it appears (include the extension, e.g., eternalblue.rules, ms17-010.rules, emerging-smb.rules, xploit_eternalblue.rules, or similar). Your final submission should be just the file name with its extension, no path and no quotes

• Question 92:

  Which of the following is the MOST important component of the asset decommissioning process from a data risk perspective?

  A. Informing the data owner when decommissioning is complete
  B. Destruction of data on the assets
  C. Updating the asset status in the configuration management database (CMD8)
  D. Removing the monitoring of the assets
  B. Destruction of data on the assets

• Question 93:

  SIMULATION

  The enterprise is reviewing its security posture byreviewing unencrypted web traffic in the SIEM.

  How many unique IPs have received well knownunencrypted web connections from the beginning of2022 to the end of 2023 (Absolute)?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Set the SIEM time range to an absolute window from 2022-01-01 00:00:00 to 2023-12-31 23:59:59 in the SOC’s standard timezone.

  In Splunk, run:

  index=network_traffic (dest_port IN (80,8080,8000,8081,8880)) (action=allowed OR action=accept OR action=pass OR action=success)

  | stats dc(dest_ip) AS unique_unencrypted_web_ips

  In Elastic/Kibana ESQL, run:

  FROM logs-*

  | WHERE destination.port IN (80, 8080, 8000, 8081, 8880) AND (@timestamp >= "2022-01-01T00:00:00Z" AND @timestamp < "2024-01-01T00:00:00Z") AND (event.outcome == "success" OR network.transport == "tcp")

  | STATS unique_unencrypted_web_ips = COUNT_DISTINCT(destination.ip)

  In Microsoft Sentinel KQL, run:

  CommonSecurityLog

  | where TimeGenerated between (datetime(2022-01-01) .. datetime(2023-12-31 23:59:59))

  | where DestinationPort in ("80","8080","8000","8081","8880")

  | where DeviceAction in ("allow","allowed","accept","pass","permit","success")

  | summarize unique_unencrypted_web_ips = dcount(DestinationIP)

  In generic SQL, run:

  SELECT COUNT(DISTINCT dest_ip) AS unique_unencrypted_web_ips

  FROM network_flows

  WHERE dest_port IN (80,8080,8000,8081,8880)

  AND action IN ('allow','accept','pass','success')

  AND ts >= '2022-01-01 00:00:00' AND ts < '2024-01-01 00:00:00'

• Question 94:

  Which of the following is the PRIMARY benefit of compiled programming languages?

  A. Streamlined development
  B. Fasterapplication execution
  C. Flexibledeployment
  D. Ability to change code in production
  B. Fasterapplication execution

• Question 95:

  Which of the following has been defined when a disaster recovery plan (DRP) requires daily backups?

  A. Maximum tolerable downtime (MTD)
  B. Recovery time objective (RTO|
  C. Recovery point objective {RPO)
  D. Mean time to failure (MTTF)
  C. Recovery point objective {RPO)

• Question 96:

  Management has requested an additional layer of remote access control to protect a critical database that is hosted online. Which of the following would 8EST provide this protection?

  A. Incremental backups conducted continuously
  B. A proxy server with a virtual private network (VPN)
  C. Implementation of group rights
  D. Encryption of data at rest
  B. A proxy server with a virtual private network (VPN)

• Question 97:

  Which of the following is foundational for implementing a Zero Trust model?

  A. Comprehensive process documentation
  B. Robust network monitoring
  C. Routine vulnerability and penetration testing
  D. Identity and access management (IAM) controls
  D. Identity and access management (IAM) controls

• Question 98:

  An insecure continuous integration and continuous delivery (CI/CD) pipeline would MOST likely lead to:

  A. software Integrity failures.
  B. broken access control.
  C. security monitoring failures.
  D. browser compatibility Issues.
  A. software Integrity failures.

• Question 99:

  After an organization's financial system was moved to a cloud-hosted solution that allows single sign-on (SSO) for authentication purposes, data was compromised by an individual logged onto the local network using a compromised username and password. What authentication control would have MOST effectively prevented this situation?

  A. Challenge handshake
  B. Multi-factor
  C. Token-based
  D. Single-factor
  B. Multi-factor

• Question 100:

  SIMULATION

  Your enterprise has received an alert bulletin fromnational authorities that the network has beencompromised at approximately 11:00 PM (Absolute) onAugust 19, 2024. The alert is located in the alerts folderwith filename, alert_33.pdf.

  Use the IOCs to find the compromised host. Enter thehost name identified in the keyword agent.name fieldbelow.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the Alerts folder on the Desktop and open alert_33.pdf. Carefully extract every IOC it lists: malicious IPs, domains, URLs (including full paths), file hashes, JA3/JA3S fingerprints, and any user-agent strings. Write them down exactly as shown.

  Open Security Onion SOC in your browser and go to Discover. Select the network and endpoint indices that typically hold your data (for example so-* or logs-*). Set the time range to an absolute window centered on the alert time: start 202408-19 22:55:00 and end 2024-08-19 23:05:00. If there are no hits, widen to 22:45:00–23:15:00. Confirm the timezone used by SOC so “Absolute” matches the question.

  Search for the IOCs across common ECS fields. Start with domains and URLs:

  dns.question.name:(ioc1.example OR ioc2.example …)

  OR http.host:(ioc1.example OR ioc2.example …)

  OR url.domain:(ioc1.example OR ioc2.example …)

  If the bulletin includes full URLs or paths, also filter:

  url.full:portion-from-bulletin OR url.path:portion-from-bulletin

  If it lists IPs, include them:

  source.ip:(IOC_IPs) OR destination.ip:(IOC_IPs)

  If it lists JA3/JA3S, include:

  tls.fingerprint.ja3:(JA3_hashes) OR tls.client.ja3:(JA3_hashes) OR tls.server.ja3s:(JA3S_hashes)

  If it lists file hashes relevant to endpoint telemetry, include:

  file.hash.sha256:(hashes) OR process.hash.sha256:(hashes)

  Apply the filter and review matching events within the 23:00 window. Identify the internal asset that communicated with the threat IOC. Use these cues:

  for inbound hits (attacker --> you), the targeted internal host is typically the destination.ip; for outbound hits (you --> attacker C2/domain), the targeted internal host is typically the source.ip. Prefer private RFC1918 addresses as your internal host indicator.

  Once you have the internal IP, pivot to events that will expose the host name via the agent.name field. Add a filter for the internal IP you found:

  (source.ip: INTERNAL_IP OR destination.ip: INTERNAL_IP)

  Keep the same time window. Add columns agent.name, host.name, source.ip, destination.ip so you can see the mapping. If your initial hits are Zeek/Suricata (where agent.name can be the sensor), pivot to endpoint/Windows logs for that IP in the same window (for example event.module:windows OR event.dataset:winlogbeat* OR event.kind:event) so that agent.name reflects the endpoint’s hostname rather than a network sensor.

  Validate that the activity tied to the IOC and time window involves this same internal IP/host by opening a few representative events (DNS query to the bulletin domain, HTTP request to the bulletin URL, TLS JA3 match, etc.). Confirm timestamps are between 23:00 and the surrounding minutes as per your chosen window.

  Read the value shown in the agent.name field for that compromised host. If both agent.name and host.name are present, prefer agent.name because the question explicitly asks for the host name identified in the keyword agent.name. Ensure it is the workstation/server name (for example, WIN-WS-ACCT01) and not the name of a network sensor.

  Submit the agent.name value exactly as displayed (case, dashes, and any numbers), with no extra spaces.