Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 101:

  SIMULATION On the Analyst Desktop is a Malware Samples folderwith a file titled Malscript.viruz.txt.

  What is the name of the service that the malware attempts to install?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the Malware Samples folder on the Analyst Desktop and open Malscript.viruz.txt in a plain-text editor (Notepad/Notepad++). Turn on word wrap off (if possible) so long lines don’t hide parameters.

  Identify the script type at a glance. If you see cmd/batch (sc, reg, net), PowerShell (New-Service, Set-Service, [WMIClass]'Win32_Service'), VBScript (WMI “Win32_Service”), or mixed. Note any obfuscation (Base64 blobs, string

  concatenation, character arrays, -enc).

  Search explicitly for service-creation patterns (Ctrl+F and check all hits):

  sc create

  sc.exe create

  New-Service

  [WMIClass]'Win32_Service' (or) GetObject("winmgmts:...Win32_Service").Create

  reg add HKLM\System\CurrentControlSet\Services

  InstallUtil.exe

  ServiceName=

  DisplayName=

  Extract the service name according to the pattern you find:

  sc create: the service name is the very first token after create (often quoted if it contains spaces). Example: sc create WinHostSvc binPath= …

  PowerShell New-Service: the service name is the value of -Name (not -DisplayName). Example: New-Service -Name "WinHostSvc" -BinaryPathName ...

  WMI Create: look for Name = "…andquot;. Example: ([WMIClass]'Win32_Service').Create(..., Name="WinHostSvc", ...)

  Registry method: the subkey under …\Services\‹ServiceKey› is the service name. Example: HKLM\…\Services\WinHostSvc --> service name is WinHostSvc.

  InstallUtil: if present, open the service executable path nearby; the service name is often set in the binary’s ServiceName property (but scripts sometimes pass it via arguments or config).

  If the file is obfuscated, decode just enough to reveal the service-creation line:

  Base64 PowerShell (-enc or FromBase64String): copy the Base64, remove whitespace, decode to UTF-8, then inspect the decoded text for the service-creation commands above.

  If you see URL-encoding (%xx), percent-decode and re-inspect.

  If you see character arrays or XOR snippets building strings like "sc" / "New-Service", let the script’s concatenations resolve (mentally or by quickly evaluating string building only in a safe, offline VM) and re-search for the patterns above.

  Disambiguate between ServiceName and DisplayName. If both appear, the answer they want is the service key name (the one used by sc create / -Name / Services\‹Key›), not the friendly DisplayName. Also ignore later commands like sc start/stop—those reference the same name but don’t define it.

  Confirm you’ve got the correct value by checking consistency across occurrences (e.g., the same name is used in sc create, sc start, reg add). Make sure you capture the exact spelling and casing, and do not include quotes.

  Submit only the service name (for example: WinHostSvc), with no path, no quotes, and no extra spaces.

• Question 102:

  Which of the following is thePRIMARYsecurity benefit of working from a graphical user interface (GUI) instead of a command line interface (CLI)

  A. It Is easier to build encryption into the GUI.
  B. TheCLI commands do not need to be exact.
  C. Scripting is easier when using the GUI.
  D. AGUIprovides developers more flexibility.
  A. It Is easier to build encryption into the GUI.

• Question 103:

  Which of the following BEST enables a cybersecurity analyst to influence the acceptance of effective security controls across an organization?

  A. Contingency planning expertise
  B. Knowledge of cybersecurity standards
  C. Communication skills
  D. Critical thinking
  C. Communication skills

• Question 104:

  What is the GREATEST security concern associated with virtual (nation technology?

  A. Inadequate resource allocation
  B. Insufficient isolation between virtual machines (VMs)
  C. Shared network access
  D. Missing patch management for the technology
  B. Insufficient isolation between virtual machines (VMs)

• Question 105:

  SIMULATION

  Following a ransomware incident, the network teamprovided a PCAP file, titled ransom.pcap, located in theInvestigations folder on the Desktop.

  What is the full User-Agent value associated with theransomware demand file download.

  Enter your responsein the field below.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the Investigations folder on the Desktop and confirm ransom.pcap is present, then open it in Wireshark.

  Validate there is cleartext web traffic: go to Statistics --> Protocol Hierarchy and ensure HTTP appears (if it’s only TLS/HTTPS and you don’t have keys, you won’t see a User-Agent; in typical labs it’s HTTP).

  Export HTTP objects: File --> Export Objects --> HTTP. In the objects list, sort by “Filename” and “Host” and look for a likely ransom note (common names include README.txt, HOW_TO_DECRYPT.html, DECRYPT_INSTRUCTIONS.txt, RECOVER_FILES.txt, ransom_note.txt). Double-click a candidate to preview; verify the content contains typical ransom text (payment instructions, wallet/portal link, deadline). Note the “Packet” number for the confirmed ransom note object.

  Jump to the packet for that object: close the dialog (or keep it open) and press Ctrl+G (Go To Packet), enter the noted frame number. If you land on the HTTP response, use “Follow --> HTTP Stream” to see the paired request and response for that exact file transfer.

  In the HTTP request headers for that stream, locate the “User-Agent:” header. Copy the full value exactly as shown (including spaces, slashes, and parentheses). Examples you might see in practice include browser UAs such as “Mozilla/5.0 … Chrome/… Safari/…” or tooling UAs like “WindowsPowerShell/5.1.19041.1” or “curl/7.68.0”. Do not copy “User-Agent:” itself—only the value to its right.

  Confirm you captured the UA from the request that fetched the ransom note file (the same stream whose response body is the ransom demand), not from a different asset request. If multiple downloads of the note occurred, any of the identical UA values for that file is acceptable; prefer the first occurrence.

  Paste the User-Agent value verbatim into the answer field, preserving capitalization, punctuation, and version numbers.

• Question 106:

  SIMULATION

  Which ruleset can be applied in the /home/administrator/hids/ruleset/rules directory?

  Double-click each image to view it larger.

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

  ---

  Explanation

  Step 1: Understand the Question Context

  The question is asking whichruleset can be appliedin the following directory:

  /home/administrator/hids/ruleset/rules

  This is typically the directory forHost Intrusion Detection System (HIDS)rulesets.

  Step 2: Ruleset File Characteristics

  To determine the correct answer, we must consider:

  File Format:

  The most common format for HIDS rules is.rules.

  Naming Convention:

  Typically, the file names are descriptive, indicating the specific exploit, malware, or signature they detect.

  Content Format:

  Rulesets containalert signaturesordetection patternsand follow a specific syntax.

  Step 3: Examine the Directory

  If you have terminal access, list the available rulesets:

  ls -l /home/administrator/hids/ruleset/rules

  This should display a list of files similar to:

  exploit_eternalblue.rules

  malware_detection.rules

  network_intrusion.rules

  default.rules

  Step 4: Analyze the Image Options

  Since I cannot view the images directly, I will guide you on what to look for:

  Option A:

  Check if the file has a.rulesextension.

  Look for keywords like"exploit","intrusion", or"malware".

  Option B:

  Verify if it mentionsEternalBlue,SMB, or other exploits. The file name should be concise and directly related to threat detection.

  Option C:

  Look for generic names like"default.rules"or"base.rules". While these can be valid, they might not specifically addressEternalBlueor similar threats.

  Option D:

  Avoid files with non-standard extensions (e.g., .conf, .txt). Rulesets must specifically have.rulesas the extension.

  Step 5: Selecting the Correct Answer

  Based on the most typical file format and naming convention, the correct answer should be:B

  The reason is thatOption Blikely contains a file named in line with typical HIDS conventions, such as"exploit_eternalblue.rules"or similar, which matches the context given.

  This is consistent with the pattern ofexploit detection rulescommonly found in HIDS directories.

• Question 107:

  After identified weaknesses have been remediated, which of the following should be completed NEXT?

  A. Perform a validation scan before moving to production.
  B. Perform software code testing.
  C. Perform a software quality assurance (QA) activity.
  D. Move the fixed system directly to production.
  A. Perform a validation scan before moving to production.

• Question 108:

  Which of the following is the PRIMARY reason for tracking the effectiveness of vulnerability remediation processes within an organization?

  A. To provide reports to senior management so that they can justify the expense of vulnerability management tools
  B. To identify executives who are responsible for delaying patching and report them to the board
  C. To ensure employees responsible for patching vulnerabilities are actually doing their job correctly
  D. To reduce the likelihood of a threat actor successfully exploiting vulnerabilities In the organization's systems
  D. To reduce the likelihood of a threat actor successfully exploiting vulnerabilities In the organization's systems

• Question 109:

  Which of the following is the MOST effective approach for tracking vulnerabilities in an organization's systems and applications?

  A. Walt for external security researchers to report vulnerabilities
  B. Rely on employees to report any vulnerabilities they encounter.
  C. Implement regular vulnerability scanning and assessments.
  D. Track only those vulnerabilities that have been publicly disclosed.
  C. Implement regular vulnerability scanning and assessments.

• Question 110:

  A nation-state that is employed to cause financial damage on an organization is BEST categorized as:

  A. a vulnerability.
  B. a risk.
  C. an attach vector.
  D. a threat actor.
  D. a threat actor.