Free CCOA Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The Transport layer of the TCP/IP stack is responsible for the reliable transmission of data between

hosts.

Protocols: Includes TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

Reliable Data Delivery: TCP ensures data integrity and order through sequencing, error checking, and

acknowledgment.

Flow Control and Congestion Handling: Uses mechanisms like windowing to manage data flow

efficiently.

Connection-Oriented Communication: Establishes a session between sender and receiver for reliable

data transfer.

Other options analysis:

A . Link: Deals with physical connectivity and media access.

B . Internet: Handles logical addressing and routing.

C . Application: Facilitates user interactions and application-specific protocols (like HTTP, FTP).

CCOA Official Review Manual, 1st Edition Reference:

Chapter 4: Network Protocols and Layers: Details the role of the Transport layer in reliable data

transmission.

Chapter 6: TCP/IP Protocol Suite: Explains the functions of each layer.

.

Explanation:

To determine the host IP of the machine vulnerable to CVE-2021-22145 using Greenbone

Vulnerability Manager (GVM), follow these detailed steps:

Step 1: Access Greenbone Vulnerability Manager

Open Firefox on your system.

Go to the GVM login page:

URL: https://10.10.55.4:9392

Enter the credentials:

Username: admin

Password: Secure-gvm!

Click Login to access the dashboard.

Step 2: Navigate to Scan Reports

Once logged in, locate the "Scans" menu on the left panel.

Click on "Reports" under the "Scans" section to view the list of completed vulnerability scans.

Step 3: Identify the Most Recent Scan

Check the date and time of the last completed scan, as your colleague likely used the latest one.

Click on the Report Name or Date to open the detailed scan results.

Step 4: Filter for CVE-2021-22145

In the report view, locate the "Search" or "Filter" box at the top.

Enter the CVE identifier:

CVE-2021-22145

Press Enter to filter the vulnerabilities.

Step 5: Analyze the Results

The system will display any host(s) affected by CVE-2021-22145.

The details will typically include:

Host IP Address

Vulnerability Name

Severity Level

Vulnerability Details

Example Display:

Host IP Vulnerability ID CVE

Severity

192.168.1.100 SomeVulnName

CVE-2021-22145

High

Step 6: Verify the Vulnerability

Click on the host IP to see the detailed vulnerability description.

Check for the following:

Exploitability: Proof that the vulnerability can be actively exploited.

Description and Impact: Details about the vulnerability and its potential impact.

Fixes/Recommendations: Suggested mitigations or patches.

Step 7: Note the Vulnerable Host IP

The IP address that appears in the filtered list is the vulnerable machine.

Example Answe r:

The host IP of the machine vulnerable to CVE-2021-22145 is: 192.168.1.100

Step 8: Take Immediate Actions

Isolate the affected machine to prevent exploitation.

Patch or update the software affected by CVE-2021-22145.

Perform a quick re-scan to ensure that the vulnerability has been mitigated.

Step 9: Generate a Report for Documentation

Export the filtered scan results as a PDF or HTML from the GVM.

Include:

Host IP

CVE ID

Severity and Risk Level

Remediation Steps

Background on CVE-2021-22145:

This CVE is related to a vulnerability in certain software, often associated with improper access

control or authentication bypass.

Attackers can exploit this to gain unauthorized access or escalate privileges.

Site-to-site VPNs establish secure, encrypted connections between two networks over the internet,

typically used to link corporate networks with remote sites or a service provider's network. However,

while these VPNs secure data transmission, they introduce specific risks.

The primary risk associated with a site-to-site VPN with a service provider is the loss of visibility into

user behavior. Here’s why:

Limited Monitoring: Since the traffic is encrypted and routed through the VPN tunnel, the

organization may lose visibility over user activities within the service provider's network.

Blind Spots in Traffic Analysis: Security monitoring tools (like IDS/IPS) that rely on inspecting

unencrypted data may be ineffective once data enters the VPN tunnel.

User Behavior Analytics (UBA) Issues: It becomes challenging to track insider threats or compromised

accounts due to the encapsulation and encryption of network traffic.

Vendor Dependency: The organization might depend on the service provider’s security measures to

detect malicious activity, which may not align with the organization’s security standards.

Other options analysis:

A . Loss of data integrity: VPNs generally ensure data integrity using protocols like IPsec, which

validates packet integrity.

C . Data exfiltration: While data exfiltration can occur, it is typically a consequence of compromised

credentials or insider threats, not a direct result of VPN usage.

D . Denial of service (DoS) attacks: While VPN endpoints can be targeted in a DoS attack, it is not the

primary risk specific to VPN use with a service provider.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 4: Network Security Operations: Discusses risks related to VPNs, including reduced visibility.

Chapter 7: Security Monitoring and Incident Detection: Highlights the importance of maintaining

visibility even when using encrypted connections.

Chapter 8: Incident Response and Recovery: Addresses challenges related to VPN monitoring during

incidents.

The described scenario indicates a Injection (i) attack, where the attacker exploits insufficient input

validation in a web application to manipulate queries. This type of attack falls under the category of

Broken Access Control because:

Improper Input Handling: The application fails to properly sanitize or validate user inputs, allowing

malicious commands to execute.

Direct Database Manipulation: Attackers can bypass normal authentication or gain elevated access by

injecting code.

OWASP Top Ten 2021: Lists Broken Access Control as a critical risk, often leading to data breaches

when input validation is weak.

Other options analysis:

B . Infection: Typically involves malware, which is not relevant here.

C . Buffer overflow: Involves memory management errors, not manipulation.

D . X-Path: Involves XML query manipulation, not databases.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 4: Web Application Security: Discusses Injection as a common form of broken access

control.

Chapter 9: Secure Coding and Development: Stresses the importance of input validation to prevent i.

The most effective approach to tracking vulnerabilities is to regularly perform vulnerability scans and

assessments because:

Proactive Identification: Regular scanning detects newly introduced vulnerabilities from software

updates or configuration changes.

Automated Monitoring: Modern scanning tools (like Nessus or OpenVAS) can automatically identify

vulnerabilities in systems and applications.

Assessment Reports: Provide prioritized lists of discovered vulnerabilities, helping IT teams address

the most critical issues first.

Compliance and Risk Management: Routine scans are essential for maintaining security baselines

and compliance with standards (like PCI-DSS or ISO 27001).

Other options analysis:

A . Wait for external reports: Reactive and risky, as vulnerabilities might remain unpatched.

B . Rely on employee reporting: Inconsistent and unlikely to cover all vulnerabilities.

D . Track only public vulnerabilities: Ignores zero-day and privately disclosed issues.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 6: Vulnerability Management: Emphasizes continuous scanning as a critical part of risk

mitigation.

Chapter 9: Security Monitoring Practices: Discusses automated scanning and vulnerability tracking.

The organization is implementing a new cloud-based real-time backup system to reduce the

likelihood of data loss, which is an example of risk mitigation because:

Reducing Risk Impact: By upgrading from an outdated system, the organization minimizes the

potential consequences of data loss.

Implementing Controls: The new backup system is a proactive control measure designed to decrease

the risk.

Enhancing Recovery Capabilities: Real-time backups ensure that data remains intact and recoverable

even in case of a failure.

Other options analysis:

B . Risk avoidance: Involves eliminating the risk entirely, not just reducing it.

C . Risk transfer: Typically involves shifting the risk to a third party (like insurance), not implementing

technical controls.

D . Risk acceptance: Involves acknowledging the risk without implementing changes.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 5: Risk Management: Clearly differentiates between mitigation, avoidance, transfer, and

acceptance.

Chapter 7: Backup and Recovery Planning: Discusses modern data protection strategies and their risk

implications.

A Security Operation Center (SOC) is tasked with monitoring and analyzing network traffic to detect

anomalies and potential security threats.

Role: SOCs collect and analyze data from firewalls, intrusion detection systems (IDS), and other

network monitoring tools.

Function: Analysts in the SOC identify unusual activity patterns that may indicate intrusions or

malware.

Proactive Threat Detection: Uses log analysis and behavioral analytics to catch threats early.

Incorrect Options:

A . Web application firewall (WAF): Protects against web-based attacks but does not analyze network

traffic in general.

B . Endpoint security: Focuses on individual devices, not network-wide monitoring.

D . Data loss prevention (DLP): Monitors data exfiltration rather than overall network activity.

Exact Extract from CCOA Official Review Manual, 1st Edition:

Refer to Chapter 8, Section "Security Monitoring and Threat Detection," Subsection "Role of the SOC"

- SOCs are integral to identifying potential security threats through network traffic analysis.

The scenario describes a penetration testing approach where the tester is given access to all code,

diagrams, and documentation, which is indicative of a Full Knowledge (also known as White Box)

testing methodology.

Characteristics:

Comprehensive Access: The tester has complete information about the system, including source

code, network architecture, and configurations.

Efficiency: Since the tester knows the environment, they can directly focus on finding vulnerabilities

without spending time on reconnaissance.

Simulates Insider Threats: Mimics the perspective of an insider or a trusted attacker with full access.

Purpose: To thoroughly assess the security posture from an informed perspective and identify

vulnerabilities efficiently.

Other options analysis:

B . Unlimited scope: Scope typically refers to the range of testing activities, not the knowledge level.

C . No knowledge: This describes Black Box testing where no prior information is given.

D . Partial knowledge: This would be Gray Box testing, where some information is provided.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 8: Penetration Testing Methodologies: Differentiates between full, partial, and no-

knowledge testing approaches.

Chapter 9: Security Assessment Techniques: Discusses how white-box testing leverages complete

information for in-depth analysis.

Discretionary Access Control (DAC) allows users or data owners to modify access permissions for

resources they own.

Owner-Based Permissions: The resource owner decides who can access or modify the resource.

Flexibility: Users can grant, revoke, or change permissions as needed.

Common Implementation: File systems where owners set permissions for files and directories.

Risk: Misconfigurations can lead to unauthorized access if not properly managed.

Other options analysis:

A . Mandatory Access Control (MAC): Permissions are enforced by the system, not the user.

B . Role-Based Access Control (RBAC): Access is based on roles, not user discretion.

D . Rule-Based Access Control: Permissions are determined by predefined rules, not user control.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 7: Access Control Models: Clearly distinguishes DAC from other access control methods.

Chapter 9: Secure Access Management: Explains how DAC is implemented and managed.

In the IaaS (Infrastructure as a Service) model, clients are responsible for managing and updating the

operating system because:

Client Responsibility: The provider supplies virtualized computing resources (e.g., VMs), but OS

maintenance remains with the client.

Flexibility: Users can install, configure, and update OSs according to their needs.

Examples: AWS EC2, Microsoft Azure VMs.

Compared to Other Models:

SaaS: The provider manages the entire stack, including the OS.

DBaaS: Manages databases without requiring OS maintenance.

PaaS: The platform is managed, leaving no need for direct OS updates.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 10: Cloud Security and IaaS Management: Discusses client responsibilities in IaaS

environments.

Chapter 9: Cloud Deployment Models: Explains how IaaS differs from SaaS and PaaS.

The act of moving a payment card system to a separate network location is an example of network

segmentation because:

Isolation for Security: Segregates sensitive systems from less secure parts of the network.

PCI DSS Compliance: Payment card data must be isolated to reduce the scope of compliance.

Minimized Attack Surface: Limits exposure in case other parts of the network are compromised.

Enhanced Control: Allows for tailored security measures specific to payment systems.

Other options analysis:

A . Redundancy: Involves having backup systems, not isolating networks.

C . Encryption: Protects data but does not involve network separation.

D . Centricity: Not a recognized concept in network security.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 7: Network Segmentation and Isolation: Emphasizes segmentation for protecting sensitive

data.

Chapter 9: PCI Compliance Best Practices: Discusses network segmentation to secure payment card

environments.

Multi-factor authentication (MFA) significantly mitigates risks associated with compromised

credentials by requiring multiple verification factors, such as:

Something you know (password)

Something you have (authenticator app or token)

Something you are (biometric data)

Even if attackers obtain the password, they would still need additional factors, making unauthorized

access far more challenging.

Incorrect Options:

B . Social engineering: MFA does not directly protect against sophisticated social engineering attacks

where users are tricked into giving away all factors.

C . Malware: MFA does not prevent malware infections on the device.

D . Ransomware: Ransomware attacks typically bypass authentication mechanisms.

Exact Extract from CCOA Official Review Manual, 1st Edition:

Refer to Chapter 4, Section "Identity and Access Management," Subsection "Multi-Factor

Authentication" - MFA specifically addresses the risk of compromised credentials.

Cyber Threat Intelligence (CTI) is primarily focused on understanding the tactics, techniques, and

procedures (TTPs) used by adversaries. The goal is to gain insights into:

Attack Patterns: How cybercriminals or threat actors operate.

Indicators of Compromise (IOCs): Data related to attacks, such as IP addresses or domain names.

Threat Actor Profiles: Understanding motives and methods.

Operational Threat Hunting: Using intelligence to proactively search for threats in an environment.

Decision Support: Assisting SOC teams and management in making informed security decisions.

Other options analysis:

A . Performing root cause analysis for cyber attacks: While CTI can inform such analysis, it is not the

primary purpose.

B . Configuring SIEM systems and endpoints: CTI can support configuration, but that is not its main

function.

C . Recommending best practices for database security: CTI is more focused on threat analysis rather

than specific security configurations.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 6: Threat Intelligence and Analysis: Explains how CTI is used to reveal adversarial TTPs.

Chapter 9: Threat Intelligence in Incident Response: Highlights how CTI helps identify emerging

threats.

To add an extra layer of remote access control to a critical online database, using a proxy server

combined with a VPN is the most effective method.

Proxy Server: Acts as an intermediary, filtering and logging traffic.

VPN: Ensures secure, encrypted connections from remote users.

Layered Security: Integrating both mechanisms protects the database by restricting direct public

access and encrypting data in transit.

Benefit: Even if credentials are compromised, attackers would still need VPN access.

Incorrect Options:

A . Incremental backups: This relates to data recovery, not access control.

C . Implementation of group rights: This is part of internal access control but does not add a remote

protection layer.

D . Encryption of data at rest: Protects stored data but does not enhance remote access security.

Exact Extract from CCOA Official Review Manual, 1st Edition:

Refer to Chapter 4, Section "Remote Access Security," Subsection "Securing Remote Access with

VPNs and Proxies" - VPNs combined with proxies are recommended for robust remote access control.

The Internet Control Message Protocol (ICMP) is used for error reporting and diagnostics in IP

networks.

Control Messages: ICMP messages inform the sender about network issues, such as:

Destination Unreachable: Indicates that the packet could not reach the intended destination.

Echo Request/Reply: Used in ping to test connectivity.

Time Exceeded: Indicates that a packet's TTL (Time to Live) has expired.

Common Usage: Troubleshooting network issues (e.g., ping and traceroute).

Other options analysis:

A . TLS protocol version unsupported: Related to SSL/TLS, not ICMP.

C . 404 not found: An HTTP status code, unrelated to ICMP.

D . Webserver is available: A general statement, not an ICMP message.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 4: Network Protocols and ICMP: Discusses ICMP control messages.

Chapter 7: Network Troubleshooting Techniques: Explains ICMP’s role in diagnostics.

The greatest risk resulting from a DNS cache poisoning attack is the loss of sensitive data. Here’s why:

DNS Cache Poisoning: An attacker corrupts the DNS cache to redirect users from legitimate sites to

malicious ones.

Phishing and Data Theft: Users think they are accessing legitimate websites (like banking portals) but

are unknowingly entering sensitive data into fake sites.

Man-in-the-Middle (MitM) Attacks: Attackers can intercept data traffic, capturing credentials or

personal information.

Data Exfiltration: Once credentials are stolen, attackers can access internal systems, leading to data

loss.

Other options analysis:

A . Reduced system availability: While DNS issues can cause outages, this is secondary to data theft in

poisoning scenarios.

B . Noncompliant operations: While potential, this is not the primary risk.

C . Loss of network visibility: Unlikely since DNS poisoning primarily targets user redirection, not

network visibility.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 4: Network Security Operations: Discusses DNS attacks and their potential consequences.

Chapter 8: Threat Detection and Incident Response: Details how DNS poisoning can lead to data

compromise.

A poorly enforced Bring Your Own Device (BYOD) policy can lead to the rise of Shadow IT, where

employees use unauthorized devices, software, or cloud services without IT department approval.

This often occurs because:

Lack of Policy Clarity: Employees may not be aware of which devices or applications are approved.

Absence of Monitoring: If the organization does not track personal device usage, employees may

introduce unvetted apps or tools.

Security Gaps: Personal devices may not meet corporate security standards, leading to data leaks and

vulnerabilities.

Data Governance Issues: IT departments lose control over data accessed or stored on unauthorized

devices, increasing the risk of data loss or exposure.

Other options analysis:

A . Weak passwords: While BYOD policies might influence password practices, weak passwords are

not directly caused by poor BYOD enforcement.

B . Network congestion: Increased device usage might cause congestion, but this is more of a

performance issue than a security risk.

D . Unapproved social media posts: While possible, this issue is less directly related to poor BYOD

policy enforcement.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 3: Asset and Device Management: Discusses risks associated with poorly managed BYOD

policies.

Chapter 7: Threat Monitoring and Detection: Highlights how Shadow IT can hinder threat detection.

The most effective way to minimize the impact of a control failure is to employ Defense in Depth,

which involves:

Layered Security Controls: Implementing multiple, overlapping security measures to protect assets.

Redundancy: If one control fails (e.g., a firewall), others (like IDS, endpoint protection, and network

monitoring) continue to provide protection.

Minimizing Single Points of Failure: By diversifying security measures, no single failure will

compromise the entire system.

Adaptive Security Posture: Layered defenses allow quick adjustments and contain threats.

Other options analysis:

A . Business continuity plan (BCP): Focuses on maintaining operations after an incident, not directly

on minimizing control failures.

B . Business impact analysis (BIA): Identifies potential impacts but does not reduce failure impact

directly.

D . Information security policy: Guides security practices but does not provide practical mitigation

during a failure.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 7: Defense in Depth Strategies: Emphasizes the importance of layering controls to reduce

failure impacts.

Chapter 9: Incident Response and Mitigation: Explains how defense in depth supports resilience.

The primary purpose of load balancers in cloud networking is to distribute incoming network traffic

across multiple servers, thereby:

Ensuring Availability: By balancing traffic, load balancers prevent server overload and ensure high

availability.

Performance Optimization: Evenly distributing traffic reduces response time and improves user

experience.

Fault Tolerance: If one server fails, the load balancer redirects traffic to healthy servers, maintaining

service continuity.

Scalability: Automatically adjusts to traffic changes by adding or removing servers as needed.

Use Cases: Commonly used for web applications, databases, and microservices in cloud

environments.

Other options analysis:

B . Optimizing database queries: Managed at the database level, not by load balancers.

C . Monitoring network traffic: Load balancers do not primarily monitor but distribute traffic.

D . Load testing applications: Load balancers do not perform testing; they manage live traffic.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 4: Network Traffic Management: Discusses the role of load balancers in cloud environments.

Chapter 7: High Availability and Load Balancing: Explains how load balancers enhance system

resilience.

Exposing the session identifier in a URL is a classic example of an identification and authentication

failure because:

Session Hijacking Risk: Attackers can intercept session IDs when exposed in URLs, especially through

techniques like referrer header leaks or logs.

Session Fixation: If the session ID is predictable or accessible, attackers can force a user to log in with

a known ID.

OWASP Top Ten 2021 - Identification and Authentication Failures (A07): Exposing session identifiers

makes it easier for attackers to impersonate users.

Secure Implementation: Best practices dictate storing session IDs in HTTP-only cookies rather than in

URLs to prevent exposure.

Other options analysis:

A . Cryptographic failures: This risk involves improper encryption practices, not session management.

B . Insecure design and implementation: Broad category, but this specific flaw is more aligned with

authentication issues.

D . Broken access control: Involves authorization flaws rather than authentication or session

handling.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 4: Web Application Security: Covers session management best practices and related

vulnerabilities.

Chapter 8: Application Security Testing: Discusses testing for session-related flaws.