I85PREP
⌘ K
CCOA study materials
CCOA study resources

CCOA (ISACA) practice questions

One question at a time. Build your CCOA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Traffic Analysis and Detection

An analyst is reviewing a packet capture and wants to identify the transport protocol quickly by inspecting a single header field. Which field in the IP header distinguishes TCP from UDP traffic?

  1. The Identification field in the IPv4 header
  2. The Protocol field in the IPv4 header Correct answer.
  3. The Header Checksum field in the IPv4 header
  4. The Time-to-Live field in the IPv4 header

Explanation

The IPv4 Protocol field carries a number identifying the encapsulated transport protocol, with 6 for TCP and 17 for UDP. TTL, checksum, and identification serve other purposes and do not name the payload protocol.

Question 2Network Traffic Analysis and Detection

A capture shows a TCP segment with the SYN flag set and the ACK flag cleared. What does this segment represent in the connection lifecycle?

  1. A reset issued by a firewall
  2. The initial connection request from the client Correct answer.
  3. A mid-stream data retransmission
  4. The final acknowledgment of a graceful close

Explanation

A SYN without ACK is the first step of the TCP three-way handshake, sent by the initiating host. SYN-ACK would indicate the server's reply, and RST would indicate a reset.

Question 3Network Traffic Analysis and Detection

During triage, an analyst notices a host resolving many random-looking subdomains under one parent domain in rapid succession. Which detection concept best explains this pattern?

  1. Normal NTP time synchronization
  2. Routine DHCP lease renewal
  3. DNS tunneling or domain generation algorithm activity Correct answer.
  4. Standard ARP cache refresh

Explanation

High-volume queries for random subdomains under a single parent are characteristic of DNS tunneling or DGA-based beaconing. NTP, ARP, and DHCP produce different, well-defined traffic patterns.

Question 4Network Traffic Analysis and Detection

Which log source most directly provides a record of allowed and denied connections through a perimeter device, including source and destination addresses and ports?

  1. Web server access logs
  2. Firewall connection logs Correct answer.
  3. Endpoint antivirus scan logs
  4. Active Directory authentication logs

Explanation

Firewall logs record connection decisions with five-tuple detail, making them the primary source for perimeter allow/deny visibility. The other sources describe endpoint, identity, or application events rather than network filtering decisions.

Question 5Network Traffic Analysis and Detection

A security team wants to detect beaconing behavior in outbound traffic. Which characteristic is most indicative of command-and-control beaconing?

  1. A single large outbound file transfer during business hours
  2. Regular, periodic connections to the same external endpoint at consistent intervals Correct answer.
  3. Continuous high-bandwidth streaming to a content delivery network
  4. Bursty traffic to many internal hosts during a patch window

Explanation

Beaconing is defined by repeated, roughly periodic callbacks to the same endpoint, often with jitter to evade simple thresholds. Bulk transfers, internal patching bursts, and CDN streaming do not share that periodic single-endpoint pattern.

Question 6Network Traffic Analysis and Detection

Which artifact in a packet capture best supports identifying the operating system of a remote host during passive fingerprinting?

  1. The Ethernet frame preamble
  2. The application payload encryption type
  3. The destination MAC address
  4. The initial TTL and TCP options in the SYN-ACK Correct answer.

Explanation

Passive OS fingerprinting relies on stack-specific traits such as initial TTL, window size, and TCP option ordering in handshake packets. MAC addresses, preamble bits, and payload encryption do not reveal the remote operating system.

Question 7Network Traffic Analysis and Detection

What is the primary purpose of a network security monitoring sensor placed at a network tap?

  1. To assign IP addresses to endpoints dynamically
  2. To encrypt traffic between network segments
  3. To block malicious packets inline before they reach hosts
  4. To capture and inspect copies of traffic without disrupting the flow Correct answer.

Explanation

A tap provides passive copies of traffic so a sensor can analyze it without affecting production flow. Blocking is an inline prevention function, while address assignment and encryption are unrelated services.

Question 8Network Traffic Analysis and Detection

An analyst needs to correlate a suspicious external IP address with historical connection records after the fact. Which data source is most appropriate?

  1. NetFlow records retained by the network team Correct answer.
  2. A live memory dump of a single workstation
  3. The local ARP table on one switch
  4. A packet capture limited to the last five minutes

Explanation

Flow records provide historical metadata about who talked to whom, when, and how much, which supports retroactive correlation. Short-lived captures and single-host artifacts lack the retention and breadth needed.

Question 9Network Traffic Analysis and Detection

A capture shows a host sending an oversized ICMP echo request with a payload that, when reassembled, exceeds the maximum IP packet size. Which technique is this most consistent with?

  1. ARP spoofing
  2. Ping of death fragmentation abuse Correct answer.
  3. DNS cache poisoning
  4. TCP SYN flood

Explanation

Crafting fragmented ICMP packets whose reassembled size exceeds the allowable maximum targets a reassembly flaw, historically called the ping of death. SYN floods, ARP spoofing, and DNS cache poisoning use entirely different mechanisms.

Question 10Network Traffic Analysis and Detection

An analyst observes a TCP stream where the client sends data with sequence numbers that suddenly jump far ahead, and the server responds with duplicate ACKs for the same expected sequence. What is the most likely explanation?

  1. The connection completed a normal three-way handshake
  2. The client is negotiating a larger window scale
  3. The server is performing a graceful shutdown
  4. A segment was lost and the receiver is signaling a gap Correct answer.

Explanation

Duplicate ACKs for the same expected sequence indicate the receiver is missing a segment and requesting retransmission. Handshake completion, shutdown, and window scaling produce different flag and option patterns.

Question 11Network Traffic Analysis and Detection

A workstation begins sending ARP replies claiming that the default gateway's IP maps to its own MAC address. Which detection is most directly relevant?

  1. Unexpected NTP stratum changes
  2. Anomalous TLS certificate issuance
  3. A spike in DNS query volume
  4. Gratuitous ARP replies inconsistent with the legitimate gateway mapping Correct answer.

Explanation

ARP spoofing manifests as unsolicited or conflicting ARP replies binding a gateway IP to an attacker MAC. DNS volume, TLS issuance, and NTP stratum are unrelated to link-layer address binding.

Question 12Network Traffic Analysis and Detection

Which signature approach best detects exploitation attempts where the attacker varies payload encoding to evade simple pattern matching?

  1. Exact byte-string matching on a known exploit payload
  2. Protocol-aware anomaly detection that models expected field values and lengths Correct answer.
  3. Port-based filtering that trusts traffic on port 443
  4. Blocklisting the attacker's source IP address

Explanation

Encoding variations defeat fixed byte strings, so modeling expected protocol structure and field constraints catches deviations regardless of encoding. Exact strings, port trust, and IP blocklists are all easily bypassed.

Question 13Network Traffic Analysis and Detection

An analyst sees a long-lived outbound TLS session to an unfamiliar external host carrying steady low-volume traffic during off-hours. Which combination of indicators most strengthens a covert-channel hypothesis?

  1. Consistent packet sizing, regular timing, and destination with no business relationship Correct answer.
  2. High jitter, random destinations, and large bursts
  3. Frequent DNS failures and short TCP resets
  4. Periodic DHCP renewals and ARP broadcasts

Explanation

Covert channels often show uniform packet sizes, metronomic timing, and destinations lacking legitimate business justification. Randomness, failures, and local broadcast traffic point away from a sustained tunnel.

Question 14Network Traffic Analysis and Detection

A capture reveals repeated TCP connections from an internal host to many external hosts on port 445, each lasting only seconds. Which hypothesis is most consistent with this behavior?

  1. Outbound SMB scanning or worm propagation Correct answer.
  2. Legitimate NTP synchronization
  3. Normal DNS resolution
  4. Standard SMTP mail relay

Explanation

Many short-lived outbound connections to port 445 across numerous hosts indicate scanning or worm-like propagation seeking SMB services. DNS, NTP, and SMTP use different ports and traffic profiles.

Question 15Network Traffic Analysis and Detection

Which field in a NetFlow record is most useful for identifying the application protocol when deep packet inspection is unavailable?

  1. Source MAC address
  2. Destination port number Correct answer.
  3. Flow start sysUpTime
  4. Ingress interface index

Explanation

Without payload inspection, the destination port is the primary hint for the application protocol, though it can be spoofed. MAC address, interface index, and timestamps describe topology and timing rather than application identity.

Question 16Network Traffic Analysis and Detection

An analyst wants to detect HTTP requests where the User-Agent string is abnormally short and the request targets a raw IP address with no Host header. Which detection strategy fits best?

  1. Scheduled packet capture rotation
  2. Content-based rules inspecting HTTP header fields and request targets Correct answer.
  3. Port allowlisting for web traffic
  4. Volume-based thresholds on total bytes per flow

Explanation

Header-field and request-target inspection directly surfaces malformed or tool-generated HTTP, such as missing Host headers and terse User-Agents. Volume thresholds, port allowlists, and capture rotation do not examine those fields.

Question 17Network Traffic Analysis and Detection

A host repeatedly sends TCP RST packets in response to legitimate traffic from many peers, disrupting sessions. Which detection interpretation is most appropriate?

  1. Routine DNS resolution failure
  2. Expected behavior during a three-way handshake
  3. Possible RST injection or session teardown attack Correct answer.
  4. Normal connection establishment

Explanation

Unsolicited or excessive RSTs terminating many legitimate sessions suggest RST injection aimed at disrupting connections. Handshakes use SYN and ACK, and DNS failures are unrelated to TCP resets.

Question 18Network Traffic Analysis and Detection

Which indicator most reliably distinguishes a DNS tunneling channel from ordinary high-volume DNS traffic?

  1. Frequent A record lookups for internal service names
  2. Unusually long encoded subdomain labels and high entropy in query names Correct answer.
  3. A high count of queries to popular public resolvers
  4. Occasional NXDOMAIN responses for mistyped domains

Explanation

Tunneling encodes data in long, high-entropy labels, which differs from normal name structure even when query volume is high. Popular resolvers, internal lookups, and occasional NXDOMAINs are common benign patterns.

Question 19Network Traffic Analysis and Detection

An analyst is building a detection for credential spraying against a web login endpoint. Which network-visible pattern best supports that detection?

  1. Large uploads to the login endpoint
  2. Many authentication attempts across different usernames from few sources in a short window Correct answer.
  3. A single successful login followed by normal browsing
  4. Repeated DNS lookups for the login domain

Explanation

Spraying tries a few passwords across many accounts, producing many username variations from limited sources in a short period. Single logins, DNS lookups, and large uploads do not reflect that pattern.

Question 20Network Traffic Analysis and Detection

A capture shows a host sending a SYN to a target, receiving SYN-ACK, then sending RST instead of ACK, repeatedly across many ports. What activity does this most likely represent?

  1. A legitimate web session
  2. A completed three-way handshake
  3. A TCP SYN stealth scan Correct answer.
  4. A UDP port sweep

Explanation

Completing the handshake and then resetting, repeated across ports, is characteristic of a SYN scan that avoids fully opening connections. A completed handshake would proceed to data exchange, and UDP sweeps lack TCP flags.

Question 21Network Traffic Analysis and Detection

An analyst must decide whether a suspicious flow used a self-signed certificate. Which capture-derived artifact directly answers this?

  1. The TLS Certificate message in the handshake, including issuer and signature fields Correct answer.
  2. The TCP window size in the SYN
  3. The Ethernet preamble and frame check sequence
  4. The IP identification values across fragments

Explanation

Certificate details are carried in the TLS handshake Certificate message, where issuer and signature fields reveal self-signing. Window size, IP identification, and Ethernet framing do not describe certificate trust.

Question 22Network Traffic Analysis and Detection

A detection engineer wants to reduce false positives from an alert that fires on any outbound connection to rare destinations. Which refinement best preserves detection value while lowering noise?

  1. Correlating rare destinations with periodic timing and uniform packet sizes Correct answer.
  2. Raising the threshold to ignore all low-volume flows
  3. Removing the alert entirely
  4. Excluding all encrypted traffic from inspection

Explanation

Combining rarity with behavioral traits like periodicity and uniform sizing targets genuine covert channels while filtering incidental rare connections. Removing the rule, ignoring low-volume flows, or excluding encrypted traffic discards meaningful signal.

Question 23Network Traffic Analysis and Detection

An analyst observes a TCP stream where the client and server both advertise a zero window for extended periods while exchanging small keepalive segments. Which interpretation is most defensible?

  1. The connection has been cleanly terminated
  2. The hosts are performing OS fingerprinting
  3. The traffic is a DNS tunneling channel
  4. The endpoints are flow-controlled and stalled, possibly indicating a slow-read or resource exhaustion condition Correct answer.

Explanation

A zero window means the receiver cannot accept more data, so the sender stalls and keepalives maintain the session; prolonged stalls can signal slow readers or resource pressure. Clean termination uses FIN or RST, and fingerprinting and DNS tunneling do not produce zero-window stalls.

Question 24Network Traffic Analysis and Detection

A packet capture shows fragments where the first fragment's offset is zero but later fragments overlap previously delivered data ranges. Which conclusion is best supported?

  1. The overlap proves the traffic is benign retransmission
  2. The overlap confirms the host is using IPv6
  3. The overlap indicates a normal three-way handshake
  4. The overlap may be an evasion attempt to confuse reassembly and must be normalized before inspection Correct answer.

Explanation

Overlapping fragments can cause different systems to reassemble different payloads, a classic IDS evasion technique, so normalization is required before analysis. Benign retransmission, handshakes, and IPv6 use do not explain overlapping fragment offsets.

Question 25Network Traffic Analysis and Detection

A SOC wants to detect data exfiltration over HTTPS without decrypting payloads. Which combination of flow-level features is most informative?

  1. TCP initial sequence number randomness
  2. Source MAC vendor and ingress interface
  3. Ethernet frame check sequence errors
  4. Outbound-to-inbound byte ratio, session duration, and destination rarity over time Correct answer.

Explanation

Asymmetric byte ratios favoring outbound data, long durations, and rare destinations collectively indicate exfiltration without payload decryption. Link-layer fields and sequence-number traits carry no volume or destination context.

Question 26Network Traffic Analysis and Detection

A network security monitor receives a copy of traffic from a switch port that mirrors all frames sent to and from a suspect workstation. Which capability does this SPAN configuration provide to the analyst?

  1. NetFlow summaries for all VLANs on the switch
  2. Automatic decryption of the workstation's TLS sessions
  3. Full packet capture of the workstation's unicast conversations Correct answer.
  4. Layer 2 loop prevention across the mirrored segment

Explanation

A SPAN (mirror) port copies frames ingressing or egressing the monitored port, so the sensor can reconstruct the workstation's unicast conversations at the packet level. It does not aggregate flow records for other VLANs, prevent switching loops, or decrypt TLS.

Question 27Network Traffic Analysis and Detection

An analyst needs to review only the HTTP headers and payload of a specific TCP conversation from a large pcap. Which Wireshark capability most directly supports isolating and reconstructing that stream?

  1. Statistics > Protocol Hierarchy
  2. Capture > Options with a BPF filter
  3. View > Coloring Rules
  4. Follow TCP Stream on the selected packet Correct answer.

Explanation

Follow TCP Stream reassembles the selected conversation and displays client and server payloads in order, which is the direct way to read HTTP headers and body content. Protocol Hierarchy summarizes protocol distribution, capture filters limit what is recorded, and coloring rules only change display.

Question 28Network Traffic Analysis and Detection

Which protocol and port combination is used by a NetFlow v5 exporter to send flow records to a collector by default?

  1. UDP 514
  2. TCP 443
  3. UDP 2055 Correct answer.
  4. TCP 2055

Explanation

NetFlow v5 exporters commonly send flow records over UDP to port 2055, although the port is configurable. TCP 443 is HTTPS, UDP 514 is syslog, and NetFlow records are not normally transported over TCP.

Question 29Network Traffic Analysis and Detection

A sensor is placed at a choke point and configured to alert when an internal host initiates more than 100 failed TCP connection attempts to distinct external addresses within one minute. Which activity is this detection primarily intended to identify?

  1. Horizontal port scanning across many hosts Correct answer.
  2. ARP cache poisoning
  3. Vertical port scanning of one host
  4. DNS zone transfer abuse

Explanation

Many failed connection attempts to distinct external addresses in a short window indicate horizontal scanning, where the attacker probes the same or a few ports across many hosts. Vertical scanning targets many ports on one host, while DNS zone transfer and ARP poisoning have different traffic signatures.

Question 30Network Traffic Analysis and Detection

A flow record shows an internal host transferred 4.2 GB to an external IP over TCP 443 between 02:00 and 02:40, while the same host's normal daily egress is under 200 MB. Which analytic approach best prioritizes this flow for investigation?

  1. Alert on any TCP 443 flow that occurs outside business hours
  2. Compare the host's egress volume against its historical baseline Correct answer.
  3. Inspect only flows with a destination port above 1024
  4. Block all external IP addresses not on an allowlist

Explanation

Baseline comparison highlights the large deviation from the host's normal egress, which is a strong signal of possible exfiltration. Alerting on all off-hours HTTPS or blocking non-allowlisted IPs produces excessive noise, and port-based filtering misses the volume anomaly.

Question 31Network Traffic Analysis and Detection

During review of a pcap, an analyst observes a series of TCP segments where the PSH flag is set on every segment and the ACK number never advances beyond the initial value. Which condition does this most likely indicate?

  1. The receiver is applying TCP window scaling
  2. The segments are part of a SYN flood
  3. The sender is transmitting data that the receiver is not acknowledging Correct answer.
  4. The connection is being gracefully closed by both endpoints

Explanation

A stagnant ACK number while the sender continues to push data means the receiver is not acknowledging new bytes, which can indicate a stalled or one-way data path. Graceful close uses FIN and ACK, SYN floods consist of SYNs without established data transfer, and window scaling affects window size rather than ACK progression.

Question 32Network Traffic Analysis and Detection

A pcap contains a series of DNS responses where the same query name returns TXT records with base64-like strings that vary on every request, and the response sizes are consistently near 200 bytes. Which DNS tunneling indicator does this pattern most strongly support?

  1. Use of TCP instead of UDP for DNS transport
  2. High-entropy TXT record payloads returned for repeated queries Correct answer.
  3. Queries sent to the local resolver instead of an external server
  4. Responses with a TTL of zero

Explanation

Tunneling tools often encode data in TXT records, producing high-entropy, variable payloads for the same name. Transport protocol, resolver choice, and TTL values are not specific to tunneling and can appear in benign configurations.

Question 33Network Traffic Analysis and Detection

An IDS signature is written to match the byte pattern of a known exploit payload, but the attacker begins encoding the payload with a different scheme on each attempt. Which signature strategy best improves detection without relying on one exact byte sequence?

  1. Exact-match signatures for each observed encoding
  2. Rate limiting of connections to the affected host
  3. Protocol-aware anomaly detection on the affected service Correct answer.
  4. Port-based filtering of the affected service

Explanation

Protocol-aware anomaly detection models valid service behavior and flags deviations, which survives payload encoding changes. Enumerating encodings is brittle, and port filtering or rate limiting do not detect the exploitation itself.

Question 34Network Traffic Analysis and Detection

An analyst observes a workstation resolving a long random-looking subdomain of a rarely used domain, followed immediately by an outbound TCP connection to the resolved IP. Which combination of artifacts should the analyst correlate to investigate possible DNS-based command and control?

  1. The TLS certificate issuer and the HTTP User-Agent
  2. The switch port statistics and the interface error counters
  3. The workstation's ARP table and its DHCP lease
  4. The DNS query name and the subsequent connection destination Correct answer.

Explanation

Correlating the unusual DNS query with the immediate outbound connection links name resolution to the suspected C2 channel. ARP, DHCP, certificate issuer, User-Agent, and port statistics do not directly connect the DNS lookup to the subsequent connection.

Question 35Network Traffic Analysis and Detection

A sensor captures repeated TCP connections from one internal host to many external hosts on port 22, each completing a full three-way handshake and then sending a small amount of data before closing. Which detection approach best characterizes this behavior?

  1. Signature matching for the SSH protocol banner
  2. Behavioral analytics flagging many short-lived SSH sessions to distinct external hosts Correct answer.
  3. Threshold alerting on total outbound bytes per hour
  4. Port-based blocking of outbound TCP 22

Explanation

Many short-lived SSH sessions to distinct external hosts is a behavioral pattern consistent with automated SSH client activity or credential testing, which behavioral analytics can surface. Banner signatures, byte thresholds, and port blocking do not characterize the fan-out pattern.

Question 36Network Traffic Analysis and Detection

A capture shows an internal host sending SMB traffic to an external IP address on TCP 445. Which interpretation is most appropriate for a network detection analyst?

  1. SMB is normally internal, so external SMB egress warrants investigation Correct answer.
  2. TCP 445 is used only for DNS zone transfers
  3. External SMB is expected for domain controller replication
  4. SMB over the internet is the standard method for file sharing

Explanation

SMB is typically confined to internal networks, so SMB egress to an external address is unusual and can indicate misconfiguration or malicious tooling. Internet file sharing does not normally use SMB, TCP 445 is not a DNS port, and domain controller replication occurs internally.

Question 37Network Traffic Analysis and Detection

An analyst wants to identify HTTP requests that use the CONNECT method to an external host on port 443. Which field in the HTTP request should the analyst inspect?

  1. The User-Agent header
  2. The Host header only
  3. The Content-Length header
  4. The request method and the request target Correct answer.

Explanation

CONNECT requests are identified by the method token and the authority-form request target, which together specify the tunnel destination. The Host header, Content-Length, and User-Agent do not define the method or target.

Question 38Network Traffic Analysis and Detection

A detection engineer observes that an alert fires on every outbound connection to a destination never seen before, producing a high false-positive rate. Which refinement best preserves detection of novel command and control while reducing noise?

  1. Increase the sensor capture buffer
  2. Add a threshold on connection frequency and duration to the rare destination Correct answer.
  3. Remove the alert entirely
  4. Restrict the alert to business hours only

Explanation

Thresholding on frequency and duration focuses the alert on sustained or repeated contact typical of C2 rather than one-off legitimate connections. Removing the alert loses coverage, time restrictions do not address the underlying noise, and buffer size affects capture completeness, not alert precision.

Question 39Network Traffic Analysis and Detection

A pcap shows a host receiving a SYN-ACK for a connection it never initiated, followed by the host sending a RST. Which explanation best fits this sequence?

  1. The host is negotiating TCP window scaling
  2. The SYN-ACK is unsolicited, possibly from a spoofed or scanned source Correct answer.
  3. The host is performing a graceful shutdown
  4. The host is completing a normal three-way handshake

Explanation

A SYN-ACK without a prior SYN is unsolicited, and the receiving host resets the half-open connection with RST. A normal handshake requires an initial SYN, graceful shutdown uses FIN, and window scaling is negotiated in the SYN options.

Question 40Network Traffic Analysis and Detection

An analyst must determine whether a suspicious TLS session used a certificate that was not issued by a trusted CA. Which capture-derived artifact directly supports this determination without decrypting the session?

  1. The TCP initial sequence number
  2. The TLS record version field
  3. The client's SNI extension
  4. The server certificate presented during the TLS handshake Correct answer.

Explanation

The server certificate in the handshake includes the issuer and signature chain, which can be checked against trusted CAs. Record version, SNI, and initial sequence number do not establish certificate trust.

Question 41Endpoint and Host-Based Investigation

During host triage, an analyst wants a volatile record of processes that were running at the moment of collection. Which artifact provides that information?

  1. A Windows event log exported to CSV
  2. A prefetch file parsed from disk
  3. A registry hive copied after shutdown
  4. A memory image captured from the live system Correct answer.

Explanation

Process listings and other runtime state exist only in volatile memory, so a live memory capture preserves what was executing at acquisition time. Disk artifacts such as prefetch and event logs may record past execution but cannot reconstruct the full running process table. Collecting the registry after shutdown also loses volatile state.

Question 42Endpoint and Host-Based Investigation

An investigator needs to identify which user account launched a suspicious process on a Windows endpoint. Which artifact most directly ties process execution to a user context?

  1. The pagefile.sys contents at the time of seizure
  2. The contents of the Recycle Bin
  3. The system's BIOS firmware version
  4. Security event log entries with process creation auditing enabled Correct answer.

Explanation

When process creation auditing is enabled, Security event ID 4688 records the new process along with the account and logon session that created it. That gives a direct execution-to-user linkage. The other artifacts do not associate process launches with user accounts.

Question 43Endpoint and Host-Based Investigation

Which Linux artifact records the most recent successful and failed logon attempts for auditing purposes?

  1. /etc/fstab
  2. /var/log/wtmp and /var/log/btmp Correct answer.
  3. /proc/cpuinfo
  4. /etc/hostname

Explanation

On Linux, wtmp records successful logins and btmp records failed login attempts, making them central to logon auditing. Files such as fstab, cpuinfo, and hostname describe configuration or hardware and carry no authentication history. Investigators parse these binary logs with tools like last and lastb.

Question 44Endpoint and Host-Based Investigation

A responder suspects a rootkit has hidden a process on a Linux host. Which approach best helps confirm the discrepancy?

  1. Inspect the system's timezone configuration
  2. Compare the process list from live tools against the process entries visible in /proc Correct answer.
  3. Check the output of the date command
  4. Review the contents of /etc/resolv.conf

Explanation

A userland rootkit can hook tools like ps so they omit malicious processes, while the /proc filesystem still exposes kernel-visible process directories. Comparing the two views reveals hidden processes. The other options describe network or time configuration and cannot expose process hiding.

Question 45Endpoint and Host-Based Investigation

Which Windows registry location is commonly examined to identify programs configured to run automatically at user logon?

  1. NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run Correct answer.
  2. SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  3. SYSTEM\MountedDevices
  4. SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts

Explanation

The per-user Run key inside NTUSER.DAT lists programs that launch automatically when that user logs on, a frequent persistence mechanism. Tcpip parameters, font registration, and MountedDevices hold network, font, and drive-letter data respectively and do not define logon autostarts.

Question 46Endpoint and Host-Based Investigation

An analyst finds a Windows service whose binary path points to a file in a user-writable temp directory. What is the most significant investigative implication?

  1. The service may represent a persistence mechanism that executes attacker-controlled code with high privileges Correct answer.
  2. The service path proves the system was never rebooted
  3. The service cannot start because temp directories are read-only
  4. The service is guaranteed to be a legitimate vendor component

Explanation

Services typically run under privileged accounts, so a service binary in a user-writable location is a strong indicator of privilege escalation or persistence. Legitimate vendors rarely install service binaries in temp directories. The finding does not prove the system was never rebooted.

Question 47Endpoint and Host-Based Investigation

Which artifact best supports determining when a file was first created versus last modified on an NTFS volume?

  1. The contents of the hosts file
  2. The current screen resolution
  3. The system's display language setting
  4. The $STANDARD_INFORMATION and $FILE_NAME attribute timestamps in the MFT Correct answer.

Explanation

NTFS stores timestamps in both $STANDARD_INFORMATION and $FILE_NAME attributes within MFT records, and comparing them can reveal creation versus modification and possible timestamp manipulation. Language, hosts file, and display settings carry no file timing data.

Question 48Endpoint and Host-Based Investigation

An investigator wants to determine which USB mass storage devices were previously connected to a Windows host. Which registry location is most relevant?

  1. SYSTEM\CurrentControlSet\Control\TimeZoneInformation
  2. SYSTEM\CurrentControlSet\Enum\USBSTOR Correct answer.
  3. SOFTWARE\Classes\Applications
  4. SOFTWARE\Microsoft\Windows\CurrentVersion\Themes

Explanation

The USBSTOR key under Enum records USB mass storage devices that have been attached, including device identifiers and often serial numbers. Themes, timezone, and application class registrations do not track removable device history.

Question 49Endpoint and Host-Based Investigation

Which of the following best describes the purpose of collecting a triage image of a host's disk before performing remediation?

  1. To remove malware from the system automatically
  2. To satisfy licensing requirements for the operating system
  3. To improve system performance during incident response
  4. To preserve evidence and enable later verification of findings Correct answer.

Explanation

A triage image preserves the state of the endpoint so findings can be validated and evidence retained for later analysis or legal purposes. Imaging does not remediate malware, improve performance, or address licensing. Remediation should follow, not replace, evidence preservation.

Question 50Endpoint and Host-Based Investigation

A macOS investigation requires identifying applications that were launched, even if their logs have rotated. Which artifact is most useful?

  1. The /etc/hosts file
  2. The output of the sw_vers command
  3. The system's wallpaper settings
  4. The unified log archive captured with log collect Correct answer.

Explanation

The unified log on macOS records application and system activity, and log collect archives it for later review when live logs may rotate. The hosts file, wallpaper settings, and sw_vers output provide address mapping, appearance, and version data rather than launch history.