Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 111:

  Target discovery and service enumeration would MOST likely be used by an attacker who has the initial objective of:

  A. corrupting process memory, likely resulting in system Instability.
  B. port scanning to identify potential attack vectors.
  C. deploying and maintaining backdoor system access.
  D. gaining privileged access in a complex network environment.
  B. port scanning to identify potential attack vectors.

• Question 112:

  Which of the following is a technique for detecting anomalous network behavior that evolves using large data sets and algorithms?

  A. Machine learning-based analysis
  B. Statistical analysis
  C. Rule-based analysis
  D. Signature-based analysis
  A. Machine learning-based analysis

• Question 113:

  Which of the following is MOST likely to outline and communicate the organization's vulnerability management program?

  A. Vulnerability assessment report
  B. Guideline
  C. Policy
  D. Control framework
  C. Policy

• Question 114:

  SIMULATION

  On the Analyst Desktop is a Malware Samples folderwith a file titled Malscript.viruz.txt.

  Based on the contents of the malscript.viruz.txt, whichthreat actor group is the malware associated with?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the “Malware Samples” folder on the Analyst Desktop and locate the file named malscript.viruz.txt.

  Open malscript.viruz.txt in a text editor such as Notepad to review its full contents.

  Scan through the file for identifiable indicators of compromise (IOCs) such as domain names, IP addresses, registry keys, mutex names, C2 URLs, specific file names, or embedded comments.

  Look for any distinctive code patterns, strings, or markers that are often tied to known threat actor groups. This can include unique variable names, language artifacts, or hardcoded encryption keys.

  Note any references in the script that directly mention an operation name, campaign codename, or a malware family that is publicly attributed to a specific threat actor group.

  If the file contains obfuscated or encoded strings (e.g., base64, hex, ROT13), decode them using built-in decoding tools or online decoders. This can reveal hidden domains, commands, or attacker signatures.

  Take the extracted IOCs or malware family name and compare them against known threat actor profiles using internal threat intel databases, open-source intelligence sources (MITRE ATTandCK, threat reports, vendor blogs), or the threat intelligence module in your SOC tools.

  Identify which threat actor group is historically and consistently associated with the malware family or campaign indicators you have found.

  Record the exact name of the threat actor group as it appears in the intelligence source and submit it as your answer.

• Question 115:

  SIMULATION

  Your enterprise SIEM system is configured to collect andanalyze log data from various sources. Beginning at12:00 AM on December 4, 2024, until 1:00 AM(Absolute), several instances of PowerShell arediscovered executing malicious

  commands andaccessing systems outside of their normal workinghours.

  What is the physical address of the web server that wastargeted with malicious PowerShell commands?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  First, understand what’s being asked: the “physical address” refers to the MAC address of the host that was targeted by malicious PowerShell activity, within a one-hour absolute window (2024-12-04 00:00 to 2024-12-04 01:00). The logs

  should contain the MAC address in a field like destination.mac, host.mac, or network.mac.

  Open your SIEM (Security Onion SOC/Kibana) and select the correct log index that contains endpoint or network telemetry — for malicious PowerShell, these could be Sysmon logs (event.module:sysmon), Windows PowerShell logs

  (event.dataset:windows.powershell), or IDS/packet capture logs if network analysis is enabled.

  Set the time range to absolute: Start = 2024-12-04 00:00:00, End = 2024-12-04 01:00:00 in your SOC’s standard timezone (often UTC).

  Search for malicious PowerShell executions. If your SIEM stores rule names, filter for something like:

  process.name:powershell.exe AND (rule.name:"Suspicious PowerShell" OR powershell.script_block_text:*malicious*)

  Also consider other detection fields such as process.command_line containing suspicious flags (-nop, -enc, iex, new-object net.webclient), or use the alert signature name if your SOC has a detection rule for malicious PowerShell.

  From those results, identify which events correspond to network activity (PowerShell reaching out to a web server). Check for fields like destination.ip, destination.port, url.full, or http.host. This will give you the targeted web server’s IP

  address.

  Pivot on that destination IP to confirm it’s the targeted web server. Look for multiple hits during that one-hour window, verifying that the connection pattern matches the malicious behavior described.

  Once you confirm the targeted web server’s IP, adjust your search to include that IP and look for MAC address fields. In network sensor logs (Zeek, Suricata) or endpoint ARP/cache logs, you might see:

  destination.mac (if the server was the destination)

  source.mac (if your workstation connected directly to the server over LAN)

  If you only have the IP but not the MAC in the same record, search for logs in the same timeframe where that IP appears in the source.ip or destination.ip and contains a MAC address field.

  Identify the MAC address (physical address) of the targeted web server from the appropriate field. It should be in the standard format XX:XX:XX:XX:XX:XX (hexadecimal pairs separated by colons or dashes).

  Verify that this MAC address belongs to the server in question — consistent across multiple logs from the same period.

  Submit the MAC address exactly as shown in the logs, preserving formatting (colons or dashes) with no extra spaces.

• Question 116:

  An organization's financial data was compromised and posted online. The forensics review confirms proper access rights and encryption of the database at the host site. A lack of which of the following controls MOST likely caused the exposure?

  A. Continual backups
  B. Multi-factor authentication (MFA)
  C. Encryption o' data in transit
  D. Properly configured firewall
  B. Multi-factor authentication (MFA)

• Question 117:

  Which type of access control can be modified by a user or data owner?

  A. Mandatory access control
  B. Role-based access control (RBAC)
  C. Discretionary access control
  D. Rule-based access control
  C. Discretionary access control

• Question 118:

  Which of the following is a KEY difference between traditional deployment methods and continuous integration/continuous deployment (CI/CD)?

  A. CI/CD decreases the frequency of updates.
  B. CI/CD decreases the amount of testing.
  C. CI/CD increases the number of errors.
  D. CI/CD Increases the speed of feedback.
  D. CI/CD Increases the speed of feedback.

• Question 119:

  An organization uses containerization for its business application deployments, and all containers run on the same host, so they MUST share the same:

  A. user data.
  B. database.
  C. operating system.
  D. application.
  C. operating system.

• Question 120:

  Which of the following is the BEST method of logical network segmentation?

  A. Encryption and tunneling
  B. IP address filtering and access control list (ACL)
  C. Virtual local area network (VLAN) tagging and isolation
  D. Physical separation of network devices
  C. Virtual local area network (VLAN) tagging and isolation