Isaca CCOA Exam Questions - Navigate Your Path to Success

Correct : A

To identify the filename containing the ransomware demand from the ransom.pcap file, follow these detailed steps:

Step 1: Access the PCAP File

Log into the Analyst Desktop.

Navigate to the Investigations folder located on the desktop.

Locate the file:

ransom.pcap

Step 2: Open the PCAP File in Wireshark

Launch Wireshark.

Open the PCAP file:

mathematica

File > Open > Desktop > Investigations > ransom.pcap

Click Open to load the file.

Step 3: Apply Relevant Filters

Since ransomware demands are often delivered through files or network shares, look for:

Common Protocols:

SMB (for network shares)

HTTP/HTTPS (for download or communication)

Apply a general filter to capture suspicious file transfers:

kotlin

http or smb or ftp-data

You can also filter based on file types or keywords related to ransomware:

frame contains 'README' or frame contains 'ransom'

Step 4: Identify Potential Ransomware Files

Look for suspicious file transfers:

Check HTTP GET/POST or SMB file write operations.

Analyze File Names:

Ransom notes commonly use filenames such as:

README.txt

DECRYPT_INSTRUCTIONS.html

HELP_DECRYPT.txt

Right-click on any suspicious packet and select:

arduino

Follow > TCP Stream

Inspect the content to see if it contains a ransom note or instructions.

Step 5: Extract the File

If you find a packet with a file transfer, extract it:

mathematica

File > Export Objects > HTTP or SMB

Save the suspicious file to analyze its contents.

Step 6: Example Packet Details

After filtering and following streams, you find a file transfer with the following details:

makefile

GET /uploads/README.txt HTTP/1.1

Host: 10.10.44.200

User-Agent: Mozilla/5.0

After exporting, open the file and examine the content:

pg

Your files have been encrypted!

To recover them, you must pay in Bitcoin.

Read this file carefully for payment instructions.

Answe r:

README.txt

Step 7: Confirm and Document

File Name: README.txt

Transmission Protocol: HTTP or SMB

Content: Contains ransomware demand and payment instructions.

Step 8: Immediate Actions

Isolate Infected Systems:

Disconnect compromised hosts from the network.

Preserve the PCAP and Extracted File:

Store them securely for forensic analysis.

Analyze the Ransomware Note:

Look for:

Bitcoin addresses

Contact instructions

Identifiers for ransomware family

Step 9: Report the Incident

Include the following details:

Filename: README.txt

Method of Delivery: HTTP (or SMB)

Ransomware Message: Payment in Bitcoin

Submit the report to your incident response team for further action.

Correct : A

A supply chain attack occurs when a threat actor compromises a third-party vendor or partner that an organization relies on. The attack is then propagated to the organization through trusted connections or software updates.

Reason for Lack of Indicators of Compromise (IoCs):

The attack often occurs upstream (at a vendor), so the compromised organization may not detect any direct signs of breach.

Trusted Components: Malicious code or backdoors may be embedded in trusted software updates or services.

Real-World Example: The SolarWinds breach, where attackers compromised the software build pipeline, affecting numerous organizations without direct IoCs on their systems.

Why Not the Other Options:

B . Zero-day attack: Typically leaves some traces or unusual behavior.

C . injection attack: Usually detectable through web application monitoring.

D . Man-in-the-middle attack: Often leaves traces in network logs.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 6: Advanced Threats and Attack Techniques: Discusses the impact of supply chain attacks.

Chapter 9: Incident Response Planning: Covers the challenges of detecting supply chain compromises.