Detection and Analysis CCOA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which monitoring tool is specifically designed to capture and analyze network packets?

   • ASplunk
   • BMetasploit
   • CNessus
   • DWireshark
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which analytical approach is best suited for detecting a previously unknown malware infection that exhibits unusual network behavior?

   • AManually inspecting every packet in the capture
   • BComparing current network traffic to a baseline of normal behavior
   • CReviewing firewall logs for blocked connection attempts
   • DMatching traffic against a database of known malware signatures
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC analyst is investigating an alert that was triggered by a SIEM correlation rule. The rule is designed to detect a specific attack pattern. The analyst finds that the alert was triggered by a series of events that match the rule, but upon further investigation, the events are found to be part of a legitimate business process. What should the analyst do?

   • AEscalate the alert to the incident response team for further investigation.
   • BIgnore the alert and move on to the next one.
   • CModify the correlation rule to exclude the specific legitimate business process.
   • DDisable the correlation rule to prevent future false positives.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of threat intelligence in incident response?

   • ATo replace the need for log analysis
   • BTo provide context about adversaries and their tactics, techniques, and procedures (TTPs)
   • CTo provide a legal framework for prosecution
   • DTo automatically patch vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing an alert about a suspicious email that was received by a user. The email contains a link to a website that is known to host malware. The analyst wants to determine if the user clicked the link. Which data source would provide the most direct evidence?

   • AThe web proxy logs, which show the user's browsing history.
   • BThe email gateway logs, which show the email was delivered.
   • CThe user's workstation logs, which show process execution.
   • DThe threat intelligence feed, which provides information about the malicious URL.
   Reveal Solution Discussion Select an answer first