Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 21:

  Which of the following is the PRIMARY reason to regularly review firewall rules?

  A. To identify and remove rules that are no longer needed
  B. To identify and allow blocked traffic that should be permitted
  C. To ensure the rules remain in the correct order
  D. To correct mistakes made by other firewall administrators
  A. To identify and remove rules that are no longer needed

• Question 22:

  Before performing a penetration test for a client, it is MOST crucial to ensure:

  A. authorized consent is obtained.
  B. the timeframe has been determined.
  C. scope is defined.
  D. price has been estimated.
  A. authorized consent is obtained.

• Question 23:

  Which ofthe following is .1 PRIMARY output from the development of a cyber risk management strategy?

  A. Accepted processes are Identified.
  B. Business goals are communicated.
  C. Compliance implementation is optimized.
  D. Mitigation activities are defined.
  D. Mitigation activities are defined.

• Question 24:

  Which of the following tactics is associated with application programming interface (API) requests that may result in bypassing access control checks?

  A. Insecure direct object reference
  B. Input injection
  C. Forced browsing
  D. Broken access control
  D. Broken access control

• Question 25:

  SIMULATION

  The network team has provided a PCAP file withsuspicious activity located in the Investigations folderon the Desktop titled, investigation22.pcap.

  What is the filename of the webshell used to control thehost 10.10.44.200? Your response must include the fileextension.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the Investigations folder on the Desktop and confirm the file investigation22.pcap is present

  Launch Wireshark and open investigation22.pcap

  Establish whether 10.10.44.200 is the server for web traffic

  - Apply a display filter to scope all traffic involving that host: ip.addr == 10.10.44.200

  - Check if you see TCP port 80/8080/8000/8081 (or 443 if TLS) with 10.10.44.200 as the destination (client --> server) and as the source (server --> client). If most HTTP responses come from 10.10.44.200:80, then it is the web server being controlled

  Isolate cleartext web traffic to/from 10.10.44.200

  -If you see HTTP, use: http andand ip.addr == 10.10.44.200

  - If only HTTPS appears and you don’t have TLS keys, you won’t see filenames; in most simulations it’s HTTP

  List all HTTP objects to quickly spot candidate webshells

  -Go to File --> Export Objects --> HTTP

  -Sort by Host and then by the “Filename”/“URL” column

  - Look for suspicious script names accessed on 10.10.44.200 such as .php, .asp, .aspx, .jsp (common webshell names include 1.php, a.php, shell.php, cmd.php, upload.php, webshell.aspx, etc.)

  - Note any file repeatedly requested in short intervals or always used with query parameters like ?cmd=, ?exec=, ?pass=, ?run=

  Hunt via display filters for likely webshell access patterns

  - To pinpoint scripts with command parameters (adjust to your pcap contents):

  http.request.method == "POST" andand ip.dst == 10.10.44.200

  http.request.uri contains ".php" or http.request.uri contains ".asp" or http.request.uri contains ".aspx" or http.request.uri contains ".jsp"

  http.request.uri contains "cmd=" or http.request.uri contains "exec" or http.request.uri contains "pass=" or http.request.uri contains "run=" or http.request.uri contains "shell"

  -Combine host and method when needed, for example:

  http.request andand ip.addr == 10.10.44.200 andand (http.request.uri contains ".php" or ".asp" or ".aspx" or ".jsp")

  Inspect likely streams to confirm it’s a webshell (command in request, output in response)

  - Select a suspicious HTTP packet --> right-click --> Follow --> HTTP Stream

  - In the request, look for POST/GET to a script file with parameters like cmd/c/exec/pass

  - In the response, look for command output (directory listings, whoami, system info, error messages from shell execution). This confirms “used to control” rather than a benign script

  Extract the exact filename (with extension) used to control the host

  - From the request line (e.g., GET /cms/tmp/1.php?cmd=whoami HTTP/1.1), the filename is the last path segment before the query string: 1.php

  - If the path includes directories, ignore them and capture only the file’s basename with its extension

  - If multiple candidate scripts appear, choose the one repeatedly invoked with command parameters or returning command output; that is the controlling webshell

  Optional checks for alternate delivery/control paths

  - If you suspect the shell was uploaded via SMB or WebDAV first, you can confirm upload and then switch back to HTTP control; however, the requested answer is the filename used to control, which you already extracted from HTTP requests

  Validate and record the final answer

  - Re-run a focused filter to see all uses of that file during the capture (for example: http.request.uri contains "/1.php") and verify it’s consistently used as the control point

  - Submit the filename exactly as it appears (e.g., 1.php, shell.aspx, cmd.jsp), including its extension

• Question 26:

  Which of the following is the MOST important reason to limit the number of users with local admin privileges on endpoints?

  A. Local admin users might Install unapproved software.
  B. Local admin accounts have elevated privileges that can be exploited by threat actors.
  C. local admin accounts require more administrative work in order to manage them properly.
  D. Local admin users might make unauthorized changes.
  B. Local admin accounts have elevated privileges that can be exploited by threat actors.

• Question 27:

  Which type of middleware is used for connecting software components that are written in different programming languages?

  A. Transaction processing middleware
  B. Remote procedure call middleware
  C. Message-oriented middleware
  D. Object-oriented middleware
  D. Object-oriented middleware

• Question 28:

  SIMULATION

  You have been provided with authentication logs toinvestigate a potential incident. The file is titledwebserver-auth-logs.txt and located in theInvestigations folder on the Desktop.

  Which IP address is performing a brute force attack?

  What is the total number of successful authenticationsby the IP address performing the brute force attack?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the Investigations folder and preview the log format

  Path: Desktop/Investigations/webserver-auth-logs.txt

  Open a preview (head/less or Notepad). Note how IPs are logged (first field like Apache/Nginx combined, or in keys like client=, clientip=, src=, X-Forwarded-For:).

  Identify how outcomes are recorded. Common success tokens: 200, 302 on login endpoints, success, authenticated, login ok. Common failure tokens: 401, 403, fail, invalid, authentication failure, unauthori(z)ed.

  Identify login/auth endpoints or components to scope the search (/login, /signin, /auth, /session, /wp-login.php, etc.).

  Extract failed authentication attempts and find the top offending IP (the brute forcer)

  Filter lines that are clearly authentication attempts (contain login|signin|auth|session|wp-login).

  Within those, filter failures (401|403|fail|invalid|authentication failure|unauthori(z)ed).

  Extract client IPs:

  - If IP is the first field (Apache/Nginx): split on whitespace and take field 1.

  - If proxied, prefer X-Forwarded-For (first IP before any comma).

  - If key/value logs, pull the value of client=, clientip=, or src=.

  Count failures per IP and sort descending to identify the IP with the highest number of failed attempts. This IP is your brute-force source.

  Sanity check: ensure failures are clustered in time (optional but good practice) and not evenly distributed noise.

  Count the number of successful authentications by that same IP

  Define the attacker IP from the previous step.

  Filter authentication attempts for that IP only (same endpoint scope as above to avoid counting unrelated 200s).

  Within those, count successes. Treat as success any of:

  -Explicit success tokens (success, authenticated, login ok).

  -HTTP 200 on a POST to the login endpoint.

  - HTTP 302 immediately after a login POST (common post-login redirect).

  If the app logs both the POST and a following asset request (200 on CSS/JS), restrict to requests hitting the login endpoint (e.g., POST /login) or the app’s explicit “login success” message to avoid inflating the count.

  Handle common edge cases before finalizing

  Proxies/load balancers: prefer X-Forwarded-For over the reverse proxy’s IP; if both appear, take the left-most external IP.

  Mixed IPv4/IPv6: if you see IPv6 (: in address), make sure your extraction method captures it; don’t truncate.

  Multiple virtual hosts: ensure you are counting only the application’s login endpoint, not admin consoles or health checks, unless those are explicitly part of the brute force.

  Replays/bots that never succeed: the success count may legitimately be zero—report zero if no success lines exist for the attacker IP.

  Deliverables to submit

  The brute-forcing IP address you identified (exact string as it appears in the logs).

  The total number of successful authentications performed by that IP (an integer count confined to the authentication events).

• Question 29:

  Cyber threat intelligence is MOST important for:

  A. performing root cause analysis for cyber attacks.
  B. configuring SIEM systems and endpoints.
  C. recommending best practices for database security.
  D. revealing adversarial tactics, techniques, and procedures.
  D. revealing adversarial tactics, techniques, and procedures.

• Question 30:

  Which of the following BEST offers data encryption, authentication, and integrity of data flowing between a server and the client?

  A. Secure Sockets Layer (SSL)
  B. Kerbcros
  C. Transport Layer Security (TLS)
  D. Simple Network Management Protocol (SNMP)
  C. Transport Layer Security (TLS)