Free Certified Cybersecurity Operations Analyst (CCOA) practice test: 30 questions with answers

Validating the events against normal behaviour decides whether this is a true incident, and isolating the account while keeping the logs contains it without destroying evidence. Disabling a whole business unit, deleting the alert, or waiting for a change window each act before the facts are known, or leave a live compromise running.

Credential dumping tools read secrets from the memory of the local security authority process, so access to it by an unexpected process is a strong indicator. The scheduled backup, wallpaper changes, and browser updates are routine activity that a monitoring rule should not treat as compromise.

Stopping spread limits how many systems are encrypted, and preserving evidence lets the team find the entry point and scope. Restoring before the root cause is known can reinfect the environment, while rebooting or notifying customers early can destroy evidence or cause premature disclosure.

Endpoint process and file access logs tied to the authenticated session show the actions taken with the account after sign-in. The printer, public web server, and building badge logs do not record the internal activity of that session.

A useful use case is specific about the behaviour, the data source, and the expected response, and it has been validated against both malicious and benign activity. Retiring on the first false positive or writing rules only after a breach ignores tuning, and alerting on single events often misses the sequences that matter.

Long random subdomains used in high volume are a common signature of DNS tunneling, where data or commands are encoded in query names. Caching, patch checks, and local discovery produce predictable names and low volumes, so they do not match this pattern.

Firewall rules between zones determine which traffic may cross a boundary, which is what stops an attacker from moving freely between segments. Switch brand, access point density, and link speed affect performance or procurement rather than the reach of an intrusion.

Containers use the host kernel with namespaces and control groups to isolate processes, which is why they are lighter than virtual machines. Each of the other statements is wrong: containers do not run their own kernels, they are routinely used for exposed services, and isolation does not remove vulnerabilities inside images.

SSH on port 22 provides an encrypted remote shell and supports key-based authentication. Telnet and unencrypted HTTP expose the session, and SMB is a file sharing protocol rather than a remote shell.

A committed token is a usable credential for anyone who can read the repository, including automated scanners that harvest secrets. Platform revocation is not guaranteed, and the token is not bound to one workstation, so it can be used from anywhere.

Least privilege means a compromised service can only do what its account allows, which limits what the attacker can change. Disabling the firewall, sharing passwords, and writable system folders each widen what a compromised process can reach or alter.

A virtual machine presents virtual hardware and runs its own guest operating system, while a hypervisor schedules and isolates it on the host. The other descriptions match processes, folders, or switches, none of which is a virtual machine.

A security model such as least privilege constrains each subject to the minimum access its role requires, which bounds the damage a mistake or compromise can cause. Broad access, monitoring alone, and encryption without classification each fail to limit what a subject is allowed to do.

A compromised dependency that is shipped inside a product is a supply chain risk, because the weakness enters through a trusted upstream source. Physical access, retention, and firewall scope are real risks but do not describe how a backdoor arrives through a component.

Ownership is clear when a responsibility matrix names the owner and that owner has the authority to run the control. Marketing copy, network diagrams, and version lists describe the technology, not who is accountable for the control.

Compliance is a floor set by external or internal requirements, and real security depends on controls sized to the organization's risks. A checklist cannot guarantee security, and business owners and audits are both part of the picture rather than substitutes for controls.

Exposure of files through a storage service is primarily a data risk caused by an insecure access setting on a store of sensitive records. The other options describe real risks in other areas, such as supply chain, endpoints, and web applications, that do not explain this exposure.

NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Harden, sanitize, and quarantine describe actions that sit inside those functions rather than being functions of the framework themselves.

Initial access is the stage where an attacker gets a first foothold, commonly through phishing or with credentials stolen elsewhere. Scanning a restored server, collecting inventory data, and running an authorized backup are activities that occur after access or are legitimate operations.

A penetration test is an authorized attempt to bypass defenses within agreed rules, which tests whether controls work in practice. It does not replace ongoing vulnerability management, cannot prove the absence of weaknesses, and is not a training exercise.

MITRE ATT&CK organizes observed adversary behaviour into tactics and techniques that teams use to map coverage and build detections. Release calendars, approved software lists, and budgets are useful operational documents but do not describe adversary behaviour.

Lateral movement is the stage in which an attacker extends its foothold from one host to others, typically with valid credentials or remote administration tools. Reconnaissance and initial access come earlier in the lifecycle, and exfiltration comes after the attacker has reached the data.

Threat intelligence adds context about who attacks, how, and what to look for, which improves detection and prioritization. Feeds need validation before blocking, and intelligence complements rather than replaces internal monitoring of your own environment.

Rules of engagement define the scope, timing, and authorization for the test, which protects both the tester and the organization. The tester's tool preferences and a required list of findings do not govern the engagement, and phishing targets are a specific design choice rather than a general rule.

Offline or immutable backups cannot be encrypted by malware on the live network, and tested recovery procedures show that restoration will work. Writable mounted backups, laptop-only copies, and one building's copy each leave the data exposed to the same attack or disaster.

Tracking requires an owner, a due date, and evidence that the fix or accepted risk is valid, so that closure can be verified rather than assumed. Closing on a single clean scan, deleting old findings, or assigning everything to the analyst each hides or misplaces the remediation work.

An unsupported asset will not receive security fixes, so isolation, access restriction, and a funded replacement or compensating controls are the appropriate measures. Continuing unchanged, removing logs, and exposing the device to the internet each increase exposure.

Timely revocation and asset recovery close the access and physical routes that a former employee could still use. Keeping accounts active, sharing passwords, and deleting logs each leave access open or destroy the records needed for later review.

Full disk encryption keeps the stored data unreadable without the unlock credential, even when the drive is removed from the device. Screen locks, return stickers, and disabled wireless adapters do not protect data that an attacker can read from the stolen drive.

Least-privilege roles limit what each account can do, and encryption protects data in backups and on disk even when the storage is accessed directly. Shared administrator passwords, open listeners, and disabled audit logs each remove accountability or increase the reach of an attacker.