Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 11:

  Which types of network devices are MOST vulnerable due to age and complexity?

  A. Ethernet
  B. Mainframe technology
  C. Operational technology
  D. Wireless
  C. Operational technology

• Question 12:

  Which type of security model leverages the use of data science and machine learning (ML) to further enhance threat intelligence?

  A. Brew-Nash model
  B. Bell-LaPadula confidentiality model
  C. Security-ln-depth model
  D. Layered security model
  D. Layered security model

• Question 13:

  Which of the followingBESTdescribes static application security testing (SAST)?

  A. Vulnerability scanning
  B. Codereview
  C. Attack simulation
  D. Configuration management
  B. Codereview

• Question 14:

  During a post-mortem incident review meeting, it is noted that a malicious attacker attempted to achieve network persistence by using vulnerabilities that appeared to be lower risk but ultimately allowed the attacker to escalate their privileges. Which ofthe following did the attacker MOST likely apply?

  A. Exploit chaining
  B. Brute force attack
  C. Cross-site scripting
  D. Deployment of rogue wireless access points
  A. Exploit chaining

• Question 15:

  Exposing the session identifier in a URL is an example of which web application-specific risk?

  A. Cryptographic failures
  B. Insecure design and implementation
  C. Identification and authentication failures
  D. Broken access control
  C. Identification and authentication failures

• Question 16:

  Which of the following MOST effectively minimizes the impact of a control failure?

  A. Business continuityplan [BCP
  B. Business impact analysis (B1A)
  C. Defense in depth
  D. Information security policy
  C. Defense in depth

• Question 17:

  Which of the following BEST describes privilege escalation in the context of kernel security?

  A. A process by which an attacker gains unauthorized access to user data
  B. A security vulnerability in the operating system that triggers buffer overflows
  C. A type of code to inject malware into the kernel
  D. A technique used by attackers to bypass kernel-level security controls
  D. A technique used by attackers to bypass kernel-level security controls

• Question 18:

  SIMULATION

  The network team has provided a PCAP file withsuspicious activity located in the Investigations folderon the Desktop titled, investigation22.pcap.

  What date was the webshell accessed? Enter the formatas YYYY-MM-DD.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the Investigations folder on the Desktop and confirm that investigation22.pcap is present.

  Launch Wireshark (or your preferred packet analysis tool) and open investigation22.pcap.

  Apply a display filter to focus on traffic involving the suspected victim host (if known from context, for example 10.10.44.200) and HTTP requests:

  http andand ip.addr ==

  If you don’t know the victim IP yet, start with just http to see all HTTP traffic and then identify the server IP.

  Look for HTTP GET or POST requests to script files that could be a webshell, such as files ending in .php, .asp, .aspx, or .jsp, and often with suspicious names (1.php, shell.aspx, cmd.jsp, etc.) or query strings like ?cmd=.

  Once you locate the HTTP request to the webshell, click the packet and note the “Frame” or “Packet Details” section where the timestamp is displayed.

  Wireshark timestamps are usually in the PCAP’s capture timezone (often UTC). Confirm if you need to adjust the timezone for your answer — in most lab questions, you use the timestamp as shown.

  From that timestamp, extract the date portion only, in the format YYYY-MM-DD.

  Double-check if there are multiple accesses to the same webshell — they should have the same date unless the activity spans midnight. If there are multiple days, use the first date of access unless the question specifies otherwise.

  Submit that date in the exact format YYYY-MM-DD as your answer.

• Question 19:

  Which of the following is the PRIMARY benefit of implementing logical access controls on a need-to-know basis?

  A. Limiting access to sensitive data and resources
  B. Ensuring users can access all resources on the network
  C. Providing a consistent user experience across different applications
  D. Reducing the complexity of access control policies and procedures
  A. Limiting access to sensitive data and resources

• Question 20:

  An organization has received complaints from a number of its customers that their data has been breached. However, after an investigation, the organization cannot detect any indicators of compromise. The breach was MOST likely due to which type of attack?

  A. Supply chain attack
  B. Zero-day attack
  C. injection attack
  D. Man-in the-middle attack
  A. Supply chain attack