Detection and Analysis CCOA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is investigating a potential data exfiltration incident. The analyst has captured a PCAP file and notices a large amount of outbound traffic from an internal host to an external IP address on port 53 (DNS). The traffic is not typical DNS queries. What should the analyst do to confirm if this is data exfiltration?

   • ACompare the DNS traffic to a baseline of normal DNS activity for that host.
   • BUse a packet analyzer to decode the DNS payload and look for encoded data.
   • CCheck the internal host's firewall logs to see if the traffic was initiated by a known process.
   • DBlock the external IP address to stop the potential exfiltration.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of an Indicator of Attack (IoA)?

   • AA user account attempting to access multiple systems in a short time
   • BA domain name used for command-and-control communication
   • CAn unusual registry key created on a workstation
   • DA file hash of a known malware sample
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary function of a SIEM tool in a security operations center?

   • ATo collect, aggregate, and analyze security data from multiple sources
   • BTo replace the need for antivirus software
   • CTo provide a user interface for configuring firewalls
   • DTo block malicious network traffic in real time
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the key difference between an Indicator of Compromise (IoC) and an Indicator of Attack (IoA)?

   • AIoCs are network-based, while IoAs are host-based
   • BIoCs are evidence of a past compromise, while IoAs indicate ongoing or imminent malicious activity
   • CIoCs are always malicious IPs, while IoAs are always malware hashes
   • DIoCs are used for prevention, while IoAs are used for detection
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst is reviewing an alert from the SIEM that indicates a possible malware infection on a workstation. The alert was triggered by an endpoint detection and response (EDR) tool. The analyst also sees a firewall log showing outbound traffic from that workstation to a suspicious IP address. However, the analyst notices that the EDR alert is a low-severity 'PUP' (potentially unwanted program) detection. What should the analyst do first?

   • AEscalate the incident to the incident response team immediately based on the firewall log.
   • BDisable the workstation's network access to prevent any potential data exfiltration.
   • CClose the alert as a false positive because the EDR tool flagged it as a PUP.
   • DInvestigate the process associated with the PUP detection and correlate it with the outbound traffic to determine if the communication is malicious.
   Reveal Solution Discussion Select an answer first