Free CCOA sample questions

Correct answer: Command and Control

The activity described—internal hosts initiating periodic connections (beaconing) to an external server—is characteristic of the Command and Control (C2) phase. In this phase, compromised systems communicate with the attacker to receive instructions or exfiltrate data. Exploitation involves the actual vulnerability trigger, Delivery is sending the weaponized bundle, and Actions on Objectives happens after C2 is established. flowchart LR Attacker((Attacker)) -->|1. Recon| Target Attacker -->|2. Weaponize| Payload Attacker -->|3. Deliver| Target Target -->|4. Exploit| System System -->|5. Install| Malware Malware |6. C2 Beaconing| C2Server[C2 Server] Malware -->|7. Actions| Objectives style C2Server fill:#f96,stroke:#333,stroke-width:4px

Correct answer: SQL Injection (SQLi)

The log entry shows a URL-encoded string `%27%20OR%201=1;--`, which decodes to `' OR 1=1;--`. This is a classic SQL Injection payload used to bypass authentication or retrieve all records from a database by making the query condition always true. XSS would typically involve script tags (` `), and Directory Traversal would involve `../` patterns.

Correct answer: Syslog over TLS (TCP/6514)

Syslog over TLS (Transport Layer Security), typically using TCP port 6514, provides both encryption (confidentiality) and reliability (TCP). Standard Syslog uses UDP/514 which is unencrypted and unreliable (fire-and-forget), while TCP/514 adds reliability but lacks encryption.

Correct answers: Tactics; Techniques

Tactics represent the 'Why' of an attack technique—the adversary's tactical goal (e.g., Initial Access, Persistence).

Techniques represent the 'How'—the specific method used to achieve a tactical goal (e.g., Phishing, Scheduled Task).

Correct answer: Luhn Algorithm validation

The Luhn Algorithm (or Mod 10 algorithm) is the standard checksum formula used to validate a variety of identification numbers, including credit card numbers. While Regex can find patterns of digits, it cannot verify if the number is mathematically valid, leading to high false positives. The Luhn check ensures the digits form a valid potential card number.

Correct answer: FTK Imager

FTK Imager (or similar tools like DumpIt) is designed to capture volatile memory (RAM) where active network connections and running processes reside. While it can also image disks, its ability to capture live memory is key here. Wireshark captures packets, not process lists. Autopsy is for analysis of dead disk images. dd is a raw imaging tool typically used for disks.

Correct answer: True

This is True. By default, Kubernetes employs a flat networking model where all pods can communicate with all other pods across the cluster without NAT. To restrict this traffic and implement micro-segmentation, administrators must explicitly define and apply Network Policies.

Correct answer: Create a suppression rule or exception specifically for the legacy application's IP address.

The best approach is to create a targeted exception (whitelisting or suppression) for the specific known benign source (the legacy app) while keeping the strict rule active for all other sources. Increasing the global threshold would reduce visibility into actual attacks. Disabling the rule leaves the organization vulnerable.

Correct answer: Persistence

The creation of a scheduled task is a classic mechanism for Persistence. It ensures that the malicious code runs automatically upon system reboot or at scheduled intervals, allowing the attacker to maintain access to the compromised system even if the initial process is terminated or the computer is restarted.

Correct answer: Isolate the host from the network using the EDR agent or switch port configuration.

Isolating the host via EDR or network switch (VLAN quarantine) effectively stops communication with the C2 server and prevents lateral movement, while keeping the system powered on. This preserves volatile memory (RAM) evidence that would be lost if the machine were powered off.