Which of the following Is a PRIMARY function of a network intrusion detection system (IDS)?
Answer(s): B
The primary function of a Network Intrusion Detection System (IDS) is to analyze network traffic to detect potentially malicious activity by:Traffic Monitoring: Continuously examining inbound and outbound data packets.Signature and Anomaly Detection: Comparing packet data against known attack patterns or baselines.Alerting: Generating notifications when suspicious patterns are detected.Passive Monitoring: Unlike Intrusion Prevention Systems (IPS), IDS does not block or prevent traffic.Other options analysis:A . Dropping traffic: Function of an IPS, not an IDS.C . Filtering traffic: Typically handled by firewalls, not IDS.D . Preventing execution: IDS does not actively block or mitigate threats.CCOA Official Review Manual, 1st Edition
Chapter 8: Network Monitoring and Intrusion Detection: Describes IDS functions and limitations.Chapter 7: Security Operations and Monitoring: Covers the role of IDS in network security.
Which of the following BEST describes static application security testing (SAST)?
Static Application Security Testing (SAST) involves analyzing source code or compiled code to identify vulnerabilities without executing the program.Code Analysis: Identifies coding flaws, such as injection, buffer overflows, or insecure function usage.Early Detection: Can be integrated into the development pipeline to catch issues before deployment.Automation: Tools like SonarQube, Checkmarx, and Fortify are commonly used.Scope: Typically focuses on source code, bytecode, or binary code.Other options analysis:A . Vulnerability scanning: Typically involves analyzing deployed applications or infrastructure.C . Attack simulation: Related to dynamic testing (e.g., DAST), not static analysis.D . Configuration management: Involves maintaining and controlling software configurations, not code analysis.CCOA Official Review Manual, 1st Edition
Chapter 9: Application Security Testing: Discusses SAST as a critical part of secure code development.Chapter 7: Secure Coding Practices: Highlights the importance of static analysis during the SDLC.
Which of the following is the PRIMARY risk associated with cybercriminals eavesdropping on unencrypted network traffic?
Answer(s): C
The primary risk associated with cybercriminals eavesdropping on unencrypted network traffic is data exposure because:Interception of Sensitive Data: Unencrypted traffic can be easily captured using tools like Wireshark or tcpdump.Loss of Confidentiality: Attackers can view clear-text data, including passwords, personal information, or financial details.Common Attack Techniques: Includes packet sniffing and Man-in-the-Middle (MitM) attacks.Mitigation: Encrypt data in transit using protocols like HTTPS, SSL/TLS, or VPNs.Other options analysis:A . Data notification: Not relevant in the context of eavesdropping.B . Data exfiltration: Usually involves transferring data out of the network, not just observing it.D . Data deletion: Unrelated to passive eavesdropping.CCOA Official Review Manual, 1st Edition
Chapter 4: Network Security Operations: Highlights the risks of unencrypted traffic.Chapter 8: Threat Detection and Monitoring: Discusses eavesdropping techniques and mitigation.
Which of the following has been established when a business continuity manager explains that a critical system can be unavailable up to 4 hours before operation is significantly impaired?
Answer(s): D
The Recovery Time Objective (RTO) is the maximum acceptable time that a system can be down before significantly impacting business operations.Context: If the critical system can be unavailable for up to 4 hours, the RTO is 4 hours.Objective: To define how quickly systems must be restored after a disruption to minimize operational impact.Disaster Recovery Planning: RTO helps design recovery strategies and prioritize resources.Other options analysis:A . Maximum tolerable downtime (MTD): Represents the absolute maximum time without operation, not the target recovery time.B . Service level agreement (SLA): Defines service expectations but not recovery timelines.C . Recovery point objective (RPO): Defines data loss tolerance, not downtime tolerance.CCOA Official Review Manual, 1st Edition
Chapter 5: Business Continuity and Disaster Recovery: Explains RTO and its role in recovery planning.Chapter 7: Recovery Strategy Planning: Highlights RTO as a key metric.
Which of the following Is a control message associated with the Internet Control Message Protocol (ICMP)?
The Internet Control Message Protocol (ICMP) is used for error reporting and diagnostics in IP networks.Control Messages: ICMP messages inform the sender about network issues, such as:Destination Unreachable: Indicates that the packet could not reach the intended destination.Echo Request/Reply: Used in ping to test connectivity.Time Exceeded: Indicates that a packet's TTL (Time to Live) has expired.Common Usage: Troubleshooting network issues (e.g., ping and traceroute).Other options analysis:A . TLS protocol version unsupported: Related to SSL/TLS, not ICMP.C . 404 not found: An HTTP status code, unrelated to ICMP.D . Webserver is available: A general statement, not an ICMP message.CCOA Official Review Manual, 1st Edition
Chapter 4: Network Protocols and ICMP: Discusses ICMP control messages.Chapter 7: Network Troubleshooting Techniques: Explains ICMP's role in diagnostics.
Post your Comments and Discuss ISACA CCOA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCOA content, but please register or login to continue.