Detection and Analysis CCOA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is implementing detection use cases for a new cloud-based application. They want to detect account takeover (ATO) attempts. The application logs authentication events, and the team has access to network flow logs. Which detection use case would be most effective in detecting ATO while minimizing false positives?

   • AAlert on any login that occurs outside of business hours.
   • BAlert on any failed login attempt from a new IP address.
   • CAlert on a successful login from an IP address that is not in the user's typical geolocation and is followed by a change of password or email.
   • DAlert on any login from a Tor exit node.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing an alert about a suspicious file that was downloaded on a user's workstation. The analyst checks the file hash against a threat intelligence platform and finds no matches. The analyst also notices that the file is digitally signed by a reputable software vendor. What should the analyst do next?

   • ARun the file in a sandbox to observe its behavior.
   • BAllow the file to run because it is signed by a reputable vendor.
   • CClose the alert as a false positive because the file is signed and not on any threat list.
   • DSearch the internet for the file name to see if it is known.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An analyst is reviewing a large dataset of authentication logs to detect a potential brute-force attack. Which analytical method is most appropriate for identifying this pattern?

   • ASorting log entries by timestamp to view the most recent events first
   • BCounting the number of failed login attempts per user account over a short time window
   • CFiltering logs to show only successful logins from a specific IP address
   • DCalculating the average login duration for all users
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of deep packet inspection (DPI) in threat identification?

   • ATo analyze the content of packets beyond header information
   • BTo summarize network traffic for capacity planning
   • CTo block all traffic from unknown IP addresses
   • DTo encrypt network traffic for secure transmission
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's security team is deploying a new monitoring solution to detect lateral movement within their network. They have a mix of on-premises servers and cloud-based workloads. They need a tool that can collect and aggregate logs from both environments, and also provide the ability to query and analyze the data in real time. Which type of tool should they choose?

   • AA packet capture (PCAP) tool that records all network traffic.
   • BA security information and event management (SIEM) solution that supports both on-premises and cloud log sources.
   • CA host-based intrusion detection system (HIDS) installed on each server.
   • DA network traffic analysis (NTA) tool that focuses on flow data.
   Reveal Solution Discussion Select an answer first