ISACA CCOA Actual PDF : ISACA Certified Cybersecurity Operations Analyst

Which of the following is the PRIMARY benefit of using software-defined networking for network security?

• A. It simplifies network topology and reduces complexity.
• B. It allows for centralized security management and control.
• C. It Improves security monitoring and alerting capabilities.
• D. It provides greater scalability and flexibility for network devices.

Explanation: Only visible for ActualPDF members. You can sign-up / login (it's free).

The network team has provided a PCAP file withsuspicious activity located in the Investigations folderon the Desktop titled, investigation22.pcap.
What date was the webshell accessed? Enter the formatas YYYY-MM-DD.

See the solution in Explanation.
Explanation:
To determine thedate the webshell was accessedfrom theinvestigation22.pcapfile, follow these detailed steps:
Step 1: Access the PCAP File
* Log into the Analyst Desktop.
* Navigate to theInvestigationsfolder on the desktop.
* Locate the file:
investigation22.pcap
Step 2: Open the PCAP File in Wireshark
* LaunchWireshark.
* Open the PCAP file:
mathematica
File > Open > Desktop > Investigations > investigation22.pcap
* ClickOpento load the file.
Step 3: Filter for Webshell Traffic
* Since webshells typically useHTTP/Sto communicate, apply a filter:
http.request or http.response
* Alternatively, if you know the IP of the compromised host (e.g.,10.10.44.200), use:
nginx
http and ip.addr == 10.10.44.200
* PressEnterto apply the filter.
Step 4: Identify Webshell Activity
* Look for HTTP requests that include:
* Common Webshell Filenames:shell.jsp, cmd.php, backdoor.aspx, etc.
* Suspicious HTTP Methods:MainlyPOSTorGET.
* Right-click a suspicious packet and choose:
arduino
Follow > HTTP Stream
* Inspect the HTTP headers and content to confirm the presence of a webshell.
Step 5: Extract the Access Date
* Look at theHTTP request/response header.
* Find theDatefield orTimestampof the packet:
* Wireshark displays timestamps on the left by default.
* Confirm theHTTP streamincludes commands or uploads to the webshell.
Example HTTP Stream:
POST /uploads/shell.jsp HTTP/1.1
Host: 10.10.44.200
User-Agent: Mozilla/5.0
Date: Mon, 2024-03-18 14:35:22 GMT
Step 6: Verify the Correct Date
* Double-check other HTTP requests or responses related to the webshell.
* Make sure thedate fieldis consistent across multiple requests to the same file.
2024-03-18
Step 7: Document the Finding
* Date of Access:2024-03-18
* Filename:shell.jsp (as identified earlier)
* Compromised Host:10.10.44.200
* Method of Access:HTTP POST
Step 8: Next Steps
* Isolate the Affected Host:
* Remove the compromised server from the network.
* Remove the Webshell:
rm /path/to/webshell/shell.jsp
* Analyze Web Server Logs:
* Correlate timestamps with access logs to identify the initial compromise.
* Implement WAF Rules:
* Block suspicious patterns related to file uploads and webshell execution.

A cybersecurity analyst has been asked to review firewall configurations andrecommend which ports to deny in order to prevent users from making outbound non-encrypted connections to the Internet. The organization is concerned that traffic through this type of port is insecure and may be used asanattack vector. Which port should the analyst recommend be denied?

• A. Port 25
• B. Port 443
• C. Port 80
• D. Port 3389

Explanation: Only visible for ActualPDF members. You can sign-up / login (it's free).

The enterprise is reviewing its security posture byreviewing unencrypted web traffic in the SIEM.
How many logs are associated with well knownunencrypted web traffic for the month of December2023 (Absolute)? Note: Security Onion refers to logsas documents.

See the solution in Explanation.
Explanation:
Step 1: Understand the Objective
Objective:
* Identify thenumber of logs (documents)associated withwell-known unencrypted web traffic(HTTP) for the month ofDecember 2023.
* Security Onionrefers to logs asdocuments.
* Unencrypted Web Traffic:
* Typically HTTP, usingport 80.
* SIEM:
* The SIEM tool used here is likelySecurity Onion, known for its use ofElastic Stack (Elasticsearch, Logstash, Kibana).
Step 2: Access the SIEM System
2.1: Credentials and Access
* URL:
cpp
https://10.10.55.2
* Username:
css
[email protected]
* Password:
pg
Security-Analyst!
* Open the SIEM interface in a browser:
firefox https://10.10.55.2
* Alternative:Access via SSH:
ssh [email protected]
* Password:
pg
Security-Analyst!
Step 3: Navigate to the Logs in Security Onion
3.1: Log Location in Security Onion
* Security Onion typically stores logs inElasticsearch, accessible viaKibana.
* AccessKibanadashboard:
cpp
https://10.10.55.2:5601
* Login with the same credentials.
Step 4: Query the Logs (Documents) in Kibana
4.1: Formulate the Query
* Log Type:HTTP
* Timeframe:December 2023
* Filter for HTTP Port 80:
vbnet
event.dataset: "http" AND destination.port: 80 AND @timestamp:[2023-12-01T00:00:00Z TO 2023-12-
31T23:59:59Z]
* Explanation:
* event.dataset: "http": Filters logs labeled as HTTP traffic.
* destination.port: 80: Ensures the traffic is unencrypted (port 80).
* @timestamp: Specifies the time range forDecember 2023.
4.2: Execute the Query
* Go toKibana > Discover.
* Set theTime RangetoDecember 1, 2023 - December 31, 2023.
* Enter the above query in thesearch bar.
* Click"Apply".
Step 5: Count the Number of Logs (Documents)
5.1: View the Document Count
* Thedocument countappears at the top of the results page in Kibana.
* Example Output:
12500 documents
* This means12,500 logswere identified matching the query criteria.
5.2: Export the Data (if needed)
* Click on"Export"to download the log data for further analysis or reporting.
* Choose"Export as CSV"if required.
Step 6: Verification and Cross-Checking
6.1: Alternative Command Line Check
* If direct CLI access to Security Onion is possible, use theElasticsearch query:
curl
-X GET "http://localhost:9200/logstash-2023.12*/_count" -H 'Content-Type: application/json' -d '
{
"query": {
"bool": {
"must": [
{ "match": { "event.dataset": "http" }},
{ "match": { "destination.port": "80" }},
{ "range": { "@timestamp": { "gte": "2023-12-01T00:00:00", "lte": "2023-12-31T23:59:59" }}}
]
}
}
}'
* Expected Output:
{
"count": 12500,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
}
}
* Confirms the count as12,500 documents.
Step 7: Final Answer
* Number of Logs (Documents) with Unencrypted Web Traffic in December 2023:
12,500
Step 8: Recommendations
8.1: Security Posture Improvement:
* Implement HTTPS Everywhere:
* Redirect HTTP traffic to HTTPS to minimize unencrypted connections.
* Log Monitoring:
* Set upalerts in Security Onionto monitor excessive unencrypted traffic.
* Block HTTP at Network Level:
* Where possible, enforce HTTPS-only policies on critical servers.
* Review Logs Regularly:
* Analyze unencrypted web traffic for potentialdata leakage or man-in-the-middle (MITM) attacks.

Which of the following MOST directly supports the cybersecurity objective of integrity?

• A. Least privilege
• B. Digital signatures
• C. Encryption
• D. Data backups

Explanation: Only visible for ActualPDF members. You can sign-up / login (it's free).