Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 131:

  SIMULATION

  Following a ransomware incident, the network teamprovided a PCAP file, titled ransom.pcap, located in theInvestigations folder on the Desktop.

  What is the name of the file containing the ransomwaredemand? Your response must include the fileextension.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  On the Analyst Desktop, open the “Investigations” folder and confirm the presence of ransom.pcap.

  Launch Wireshark (or your preferred packet analysis tool) and open ransom.pcap.

  In Wireshark, review the protocol hierarchy (Statistics --> Protocol Hierarchy) to identify what types of traffic are present; look for HTTP, FTP, SMB, or email protocols that could be used to deliver a ransom note.

  If HTTP is present, follow these steps:

  -In the display filter bar, type http to isolate HTTP traffic.

  -

  Look for HTTP GET or HTTP response entries that transfer files (Content-Type text/plain, text/html, application/octet-stream, etc.).

  -

  Right-click a relevant HTTP transaction --> “Follow” --> “HTTP Stream” to view the transferred content. Check for ransom note text (demands for payment, wallet addresses, instructions).

  -

  Note the filename from the HTTP header (Content-Disposition: filename="...") or from the GET/POST URL path.

  If SMB is present (typical for network shares), filter with smb2 or smb, then look at SMB “Write Request” or “File” operations; the ransom note is often dropped as a file like README.txt, DECRYPT_INSTRUCTIONS.html, or similar. The filename appears in the SMB request details.

  If email protocols are present, follow the TCP streams for SMTP/IMAP/POP to see attachments and decode them; ransom notes can arrive this way too.

  If the ransom note is inside a compressed archive, note the archive filename; but if the note’s own filename is visible in cleartext inside the transfer, that’s the one to record.

  Confirm that the file’s content contains ransom instructions (payment address, time limit, etc.) to ensure it’s the actual demand note, not another file.

  Write down the exact filename including its extension (for example, README.txt, HOW_TO_DECRYPT.html, RECOVER_FILES.txt) exactly as it appears in the pcap, and submit that as your answer.

• Question 132:

  How can port security protect systems on a segmented network?

  A. By enforcing encryption of data on the network
  B. By preventing unauthorized access to the network
  C. By establishing a Transport Layer Security (TLS) handshake
  D. By requiring multi-factor authentication
  B. By preventing unauthorized access to the network

• Question 133:

  SIMULATION For this question you must log into GreenboneVulnerability Manager using Firefox. The URL is:https://10.10.55.4:9392 and credentials are: Username:admin Password:Secure-gvm! A colleague performed a vulnerability scan but did notreview prior to leaving for a family emergency. It hasbeen determined that a threat actor is using CVE-2021-22145 in the wild. What is the host IP of the machinethat is vulnerable to this CVE?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open Firefox and browse to https://10.10.55.4:9392. If you see a certificate warning, accept the risk and continue so the login page loads.

  Log in with Username: admin and Password: Secure-gvm!.

  From the left navigation, go to Scans --> Reports. If you land on “Tasks,” click the most recent finished task, then click its latest Report to open it.

  Switch to the Results view (the tab or link labeled “Results” within the report). Ensure the Report row count is not truncated; use the “Filter” bar or “Displayed Rows” control so all relevant results are visible.

  Use the report’s search/filter box to locate the CVE. In the filter/search field, type CVE-2021-22145 and apply the filter. If your GVM build supports filter keys, you can also try entering cve:CVE-2021-22145. The “Vulnerability” column should now show entries whose description includes that CVE.

  Verify you are viewing the correct detection by clicking the matching result to open its details. Confirm the vulnerability references include CVE-2021-22145 in the References section or the NVT description.

  Return to the Results table and read the Host column for that CVE entry. The Host column lists the target machine’s IP address to which this result applies. If multiple rows exist for the same host and CVE, they will share the same Host IP; if more than one distinct host appears, note each, but the question expects the single IP shown in your scan.

  Record the IP address exactly as displayed for the CVE-2021-22145 result and submit it as the answer.

• Question 134:

  Which of the following controls would BEST prevent an attacker from accessing sensitive data from files or disk images that have been obtained either physically or via the network?

  A. Next generation antivirus
  B. Data loss prevention (DLP)
  C. Endpoint detection and response (EOR)
  D. Encryption of data at rest
  D. Encryption of data at rest

• Question 135:

  SIMULATION

  An employee has been terminated for policy violations.Security logs from win-webserver01 have been collectedand located in the Investigations folder on theDesktop as win- webserver01_logs.zip.

  Generate a SHA256 digest of the System-logs.evtx filewithin the win-webserver01_logs.zip file and providethe output below.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Locate the evidence file by opening the Investigations folder on the Desktop and confirming that win-webserver01_logs.zip exists.

  Extract the ZIP file’s contents to a known location (either on the Desktop or a working directory). On Windows, you can right-click --> Extract All, or use PowerShell with:

  Expand-Archive -Path "$env:USERPROFILE\Desktop\Investigations\win-webserver01_logs.zip" -DestinationPath "$env:USERPROFILE\Desktop\Investigations\win-webserver01_logs"

  Navigate into the extracted folder and locate the file named System-logs.evtx.

  Generate the SHA256 hash. In PowerShell, you can run:

  Get-FileHash -Algorithm SHA256 "$env:USERPROFILE\Desktop\Investigations\win-webserver01_logs\System-logs.evtx"

  From the output, copy the 64-character hexadecimal value from the Hash field.

  Submit that exact hash value (no spaces, all characters in the original case) as your answer.

• Question 136:

  Which of the following should be considered FIRST when determining how to protect an organization's information assets?

  A. A prioritized Inventory of IT assets
  B. The organization's business model
  C. Results of vulnerability assessments
  D. The organization's risk reporting
  B. The organization's business model

• Question 137:

  Which ofthe following is a type of middleware used to manage distributed transactions?

  A. Message-oriented middleware
  B. Transaction processing monitor
  C. Remote procedure call
  D. Object request broker
  B. Transaction processing monitor

• Question 138:

  An organization moving its payment card system into a separate location on its network (or security reasons is an example of network:

  A. redundancy.
  B. segmentation.
  C. encryption.
  D. centricity.
  B. segmentation.

• Question 139:

  Robust background checks provide protection against:

  A. distributed dental of service (DDoS) attacks.
  B. insider threats.
  C. phishing.
  D. ransomware.
  B. insider threats.