Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 31:

  SIMULATION

  Analyze the file titled pcap_artifact5.txt on the AnalystDesktop.

  Decode the C2 host of the attack. Enter your responsebelow.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  1.Locate the file

  cd ~/Desktop/AnalystDesktop

  cat pcap_artifact5.txt

  2.Inspect the content

  Look for any base64, hex, or URL-encoded strings.

  Identify patterns such as long strings of letters/numbers, suspicious domain-like text, or encoded IP addresses.

  3.Decode if necessary

  Base64:

  echo "" | base64 -d

  Hex:

  echo "" | xxd -r -p

  URL-encoded:

  python3 -c "import urllib.parse; print(urllib.parse.unquote(''))"

  4.Find the C2 host

  The decoded string should reveal a domain name or IP address.

  It may appear in HTTP headers, DNS queries, or as part of an HTTP GET/POST request path.

  5.Submit the decoded domain/IP as your answer.

• Question 32:

  SIMULATION

  The enterprise is reviewing its security posture byreviewing unencrypted web traffic in the SIEM.

  How many logs are associated with well knownunencrypted web traffic for the month of December2023 (Absolute)? Note: Security Onion refers to logsas documents.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open Security Onion’s SOC/Kibana Discover and select the index pattern that includes network traffic (for example so-* or logs-*)

  Set the time range to an absolute window covering December only; use start 2023-12-01 00:00:00 and end 2023-12-31 23:59:59, or equivalently start 2023-12-01T00:00:00 and end 2024-01-01T00:00:00 exclusive; ensure the timezone matches your SOC standard (often UTC)

  Ensure the search shows exact totals; in Discover set Total hits to the precise count (disable “optimize for speed” or enable “All results” / track_total_hits so it does not display “andgt;10,000”)

  Filter specifically for well-known unencrypted web traffic; prefer the protocol/dataset first, ports second KQL filter example to paste:

  (event.dataset: "zeek.http" OR network.protocol: http OR service.name: http OR destination.port: (80 or 8080 or 8000 or 8081 or 8880))

  Apply the filter and run the search; do not add time bucketing or deduplication; you want the raw document count

  Read the document total shown at the top of Discover; that exact number of documents is the answer to submit

  Optional validation before submitting: briefly add a quick breakdown to confirm results look like HTTP by adding a “Top values” on destination.port or http.request.method in the sidebar; remove it before finalizing the count to avoid any unintended aggregation

• Question 33:

  Which of the following utilities is MOST suitable for administrative tasks and automation?

  A. Command line Interface (CLI)
  B. Integrated development environment (IDE)
  C. System service dispatcher (SSO)
  D. Access control list (ACL)
  A. Command line Interface (CLI)

• Question 34:

  In which phase of the Cyber Kill Chain" would a red team run a network and port scan with Nmap?

  A. Exploitation
  B. Delivery
  C. Reconnaissance
  D. Weaponization
  C. Reconnaissance

• Question 35:

  A cybersecurity analyst has discovered a vulnerability in an organization's web application. Which ofthe following should be done FIRST to address this vulnerability?

  A. Restart the web server hosting the web application.
  B. Immediately shut down the web application to prevent exploitation.
  C. Follow the organization's incident response management procedures.
  D. Attempt to exploit the vulnerability to determine its severity.
  C. Follow the organization's incident response management procedures.

• Question 36:

  Which type of cloud deployment model is intended to be leveraged over the Internet by many organizations with varying needs and requirements?

  A. Hybrid cloud
  B. Community cloud
  C. Public cloud
  D. Private cloud
  C. Public cloud

• Question 37:

  SIMULATION The user of the Accounting workstation reported thattheir calculator repeatedly opens without their input. The following credentials are used for thisquestion. Username:Accounting Password:1x-4cc0unt1NG-x1 Using the provided credentials, SSH to the Accountingworkstation and generate a SHA256 checksum of the filethat triggered RuleName Suspicious PowerShell usingeither certutil or Get-FileHash of the file causing theissue. Copy the hash and paste it below.

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  1.SSH into the Accounting workstation:

  ssh Accounting@

  # Password: 1x-4cc0unt1NG-x1

  2.Identify the file that triggered RuleName: Suspicious PowerShell and note its full path.

  3.Generate the SHA256 hash:

  Option A (PowerShell):

  Get-FileHash -Algorithm SHA256 ""

  Option B (cmd):

  certutil -hashfile "" SHA256

  4.Copy the 64-character SHA256 value and paste it as the answer.

• Question 38:

  Which of the following BEST enables an organization to identify potential security threats by monitoring and analyzing network traffic for unusual activity?

  A. Web application firewall (WAP)
  B. Endpoint security
  C. Security operation center (SOC)
  D. Data loss prevention (DLP)
  C. Security operation center (SOC)

• Question 39:

  Which of the following is the MOST common output of a vulnerability assessment?

  A. A list of identified vulnerabilities along with a severity level for each
  B. A detailed report on the overall vulnerability posture, including physical security measures
  C. A list of potential attackers along with their IP addresses and geolocation data
  D. A list of authorized users and their access levels for each system and application
  A. A list of identified vulnerabilities along with a severity level for each

• Question 40:

  When identifying vulnerabilities, which of the following should a cybersecurity analyst determine FIRST?

  A. The number of vulnerabilities Identifiable by the scanning tool
  B. The numberof tested asset types included in the assessment
  C. The vulnerability categories possible for the tested asset types
  D. The vulnerability categories Identifiable by the scanning tool
  C. The vulnerability categories possible for the tested asset types