Isaca ISACA-CCOA Online Practice Questions and Exam Preparation

Isaca ISACA-CCOA Online Questions & Answers

• Question 51:

  SIMULATION

  Your enterprise has received an alert bulletin fromnational authorities that the network has beencompromised at approximately 11:00 PM (Absolute) onAugust 19, 2024. The alert is located in the alerts folderwith filename, alert_33.pdf.

  What is the name of the suspected malicious filecaptured by keyword process.executable at 11:04 PM?

  A. See the solution in Explanation.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the solution in Explanation.

  ---

  Explanation

  Open the Alerts folder on the Desktop and read alert_33.pdf to note any process, filename, or path IOCs; keep them handy to help you recognize the malicious process when you see it in logs. Open the Security Onion SOC web interface (Discover) and select the endpoint indices that contain Windows process events (for example so-* / logs-* where event.module is windows or sysmon). Set the time range to an Absolute window that tightly brackets the event: start 2024-08-19 23:04:00 and end 2024-08-19 23:04:59 in your SOC’s timezone (adjust if the SOC displays in UTC). Search for Windows process creation events and require the executable path field to be present. Use filters like:

  event.kind: event AND (event.module: windows OR event.module: sysmon) AND process.executable: *

  Optionally reduce noise with common IDs:

  winlog.event_id: 1 OR (event.code: 1 AND provider: Sysmon)

  Add columns to the results so you can see everything you need at a glance: @timestamp, agent.name, process.name, process.executable, process.command_line, rule.name (or message). Sort by @timestamp ascending.

  If alert_33.pdf listed specific filename or path fragments, add them to the search to quickly isolate the malicious entry:

  process.executable: fragment-from-alert OR process.command_line: fragment-from-alert

  Open the events that fall within 23:04 and look for one flagged or obviously suspicious (for example, rule.name mentions Suspicious PowerShell, or the command line shows -enc, IEX, WebClient/DownloadString, curl/wget, or an odd user profile temp path). Confirm the event timestamp is within 23:04:00–23:04:59.

  Read the value of process.executable in that event. If file.name is present, prefer file.name; otherwise extract the basename from process.executable (text after the final backslash), preserving the original extension (for example, updater.ps1, runme.exe, payload.vbs).

  Cross-check the filename against any IOCs from alert_33.pdf to ensure this is the suspected malicious file executed at 11:04 PM.

  Submit only the filename (basename with extension), exactly as it appears in the log, with no path and no extra spaces.

• Question 52:

  Which ofthe following is the PRIMARY purpose of load balancers in cloud networking?

  A. Distributing traffic between multiple servers
  B. Optimizing database queries
  C. Monitoring network traffic
  D. Load testing applications
  A. Distributing traffic between multiple servers

• Question 53:

  Which of the following services would pose the GREATEST risk when used to permit access to and from the Internet?

  A. Server Message Block (5MB) on TCP 445
  B. File Transfer Protocol(FTP) on TCP 21
  C. Domain Name Service (DNS) on UOP 53
  D. Remote Desktop Protocol (RDP) on TCP 3389
  D. Remote Desktop Protocol (RDP) on TCP 3389

• Question 54:

  Which of the following Is a PRIMARY function of a network intrusion detection system (IDS)?

  A. Dropping network traffic if suspicious packets are detected
  B. Analyzing whether packets are suspicious
  C. Filtering incoming and outgoing network traffic based on security policies
  D. Preventing suspicious packets from being executed
  B. Analyzing whether packets are suspicious

• Question 55:

  In the Open Systems Interconnection (OSI) Model for computer networking, which of the following is the function of the network layer?

  A. Facilitating communications with applications running on other computers
  B. Transmitting data segments between points on a network
  C. Translating data between a networking service and an application
  D. Structuring and managing a multi-node network
  D. Structuring and managing a multi-node network

• Question 56:

  Which of the following is a security feature provided by the WS-Security extension in the Simple Object Access Protocol (SOAP)?

  A. Transport Layer Security (TLS)
  B. Message confidentiality
  C. MaIware protection
  D. Session management
  B. Message confidentiality

• Question 57:

  Which of the following is a network port for service message block (SMS)?

  A. 445
  B. 143
  C. 389
  D. 22
  A. 445

• Question 58:

  A small organization has identified a potential risk associated with its outdated backup system and has decided to implement a new cloud-based real-time backup system to reduce the likelihood of data loss. Which of the following risk responses has the organization chosen?

  A. Risk mitigation
  B. Risk avoidance
  C. Risk transfer
  D. Risk acceptance
  A. Risk mitigation

• Question 59:

  An organization was breached via a web application attack to a database in which user inputs were not validated. This can BEST be described as which type of attack?

  A. Broken access control
  B. Infection
  C. Buffer overflow
  D. X-Path
  A. Broken access control

• Question 60:

  Which of the following should be the ULTIMATE outcome of adopting enterprise governance of information and technology in cybersecurity?

  A. Business resilience
  B. Risk optimization
  C. Resource optimization
  D. Value creation
  D. Value creation