Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 121:

  Which of the following is the PRIMARY purpose for an organization to adopt a cyber security framework?

  A. To ensure compliance with specific regulations
  B. To automate cybersecurity processes and reduce the need for human intervention
  C. To provide a standardized approach to cybetsecurity risk management
  D. To guarantee protection against possible cyber threats
  C. To provide a standardized approach to cybetsecurity risk management

• Question 122:

  SIMULATION

  The CISO has received a bulletin from law enforcementauthorities warning that the enterprise may be at risk ofattack from a specific threat actor. Review the bulletin named CCOA Threat Bulletin.pdf on the Desktop.

  Which of the following domain name(s) from the CCOAThreat Bulletin.pdf was contacted between 12:10 AMto 12:12 AM (Absolute) on August 17, 2024?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open “CCOA Threat Bulletin.pdf” on the Desktop and list every domain exactly as shown in the bulletin (keep spelling, dots, and hyphens).

  Open the SIEM (Security Onion SOC/Kibana) and select the network indices (for example so-* or logs-*).

  Set the time range to an absolute window from 2024-08-17 00:10:00 to 2024-08-17 00:12:00 in your SOC’s standard timezone (adjust if your SIEM displays in UTC).

  Filter for DNS and web traffic fields that carry domains. In Kibana KQL, search domains from the bulletin across common fields:

  event.dataset: "zeek.dns" AND dns.query: (domain1.tld OR domain2.tld OR domain3.tld)

  OR event.dataset: "zeek.http" AND http.host: (domain1.tld OR domain2.tld OR domain3.tld)

  OR event.module: "suricata" AND destination.domain: (domain1.tld OR domain2.tld OR domain3.tld)

  Run the same search once more to also capture subdomains, using wildcards for each domain:

  event.dataset: "zeek.dns" AND dns.query: (".domain1.tld" OR ".domain2.tld" OR ".domain3.tld")

  OR event.dataset: "zeek.http" AND http.host: (".domain1.tld" OR ".domain2.tld" OR ".domain3.tld")

  OR event.module: "suricata" AND destination.domain: (".domain1.tld" OR ".domain2.tld" OR "*.domain3.tld")

  Confirm hits are within the exact two-minute window and not outside; keep only allowed/successful connections if your data includes action/outcome fields.

  Extract the unique domains observed in results during that window. In Discover, add “Top values” for dns.query, http.host, and destination.domain to see which bulletin domains (or their subdomains) were contacted.

  Cross-reference the observed values with the bulletin list and write down only the bulletin domain name(s) that appear in the results during 00:10-00:12 on 2024-08-17.

  Submit those domain name(s) exactly as they appear in the bulletin.

• Question 123:

  Compliance requirements are imposed on organizations to help ensure: A. systemvulnerabilities are mitigated in a timely manner.

  B. security teams understand which capabilities are most important for protecting organization.

  C. rapidly changing threats to systems are addressed.

  D. minimum capabilities for protecting public interests are in place.

  Correct Answer. D
  D

• Question 124:

  Which of the following is MOST helpful to significantly reduce application risk throughout the system development life cycle (SOLC)?

  A. Security by design approach
  B. Security through obscurity approach
  C. Peer code reviews
  D. Extensive penetration testing
  A. Security by design approach

• Question 125:

  A password Is an example of which type of authentication factor?

  A. Something you do
  B. Something you know
  C. Something you are
  D. Something you have
  B. Something you know

• Question 126:

  Which of the following is MOST important for maintaining an effective risk management program?

  A. Approved budget
  B. Automated reporting
  C. Monitoring regulations
  D. Ongoing review
  D. Ongoing review

• Question 127:

  Multi-factor authentication (MFA) BEST protects against which of the following attack vectors?

  A. Compromised credentials
  B. Social engineering
  C. Malware
  D. Ransomware
  A. Compromised credentials

• Question 128:

  Which of the following Is a control message associated with the Internet Control Message Protocol (ICMP)?

  A. Transport Layer Security (TLS) protocol version Is unsupported.
  B. Destination is unreachable.
  C. 404 is not found.
  D. Webserver Is available.
  B. Destination is unreachable.

• Question 129:

  Which of the following can be used to identity malicious activity through a take user identity?

  A. Honeypot
  B. Honey account
  C. Indicator of compromise (IoC)
  D. Multi-factor authentication (MFA)
  B. Honey account

• Question 130:

  A bank employee is found to be exfiltration sensitive information by uploading it via email. Which of the following security measures would be MOST effective in detecting this type of insider threat?

  A. Data loss prevention (DIP)
  B. Intrusion detection system (IDS)
  C. Network segmentation
  D. Security information and event management (SIEM)
  A. Data loss prevention (DIP)