Certified Cybersecurity Operations Analyst (CCOA)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1Incident Detection and Response

   A SIEM alert shows repeated failed sign-ins against a service account, followed by a successful sign-in from an unfamiliar country. What should the analyst do first?

   1. ADisable every user account in the affected business unit as a precaution until the investigation is complete
   2. BDelete the alert from the queue, because the successful sign-in shows that the attack has already failed
   3. CReset the domain administrator password and wait for the next scheduled change window before taking any further action
   4. DCompare the events with the account's normal activity and, if they are suspicious, isolate the account while preserving the logs
   Show answer and explanationHide answer

   Correct answer: D

   Validating the events against normal behaviour decides whether this is a true incident, and isolating the account while keeping the logs contains it without destroying evidence. Disabling a whole business unit, deleting the alert, or waiting for a change window each act before the facts are known, or leave a live compromise running.

2. Question 2Technology Essentials

   Which networking control is most relevant when segmenting a network to limit lateral movement?

   1. AThe brand of the switches installed in each rack on the data center floor
   2. BThe number of hosts that can be connected to each access point in the building
   3. CFirewall rules that restrict traffic between network zones according to business need
   4. DThe speed of the internet link that connects the head office to the cloud provider
   Show answer and explanationHide answer

   Correct answer: C

   Firewall rules between zones determine which traffic may cross a boundary, which is what stops an attacker from moving freely between segments. Switch brand, access point density, and link speed affect performance or procurement rather than the reach of an intrusion.

3. Question 3Cybersecurity Principles and Risks

   Which principle best describes the purpose of a security model such as least privilege?

   1. ALimiting each subject's access to what is necessary for its role and the tasks it performs
   2. BGiving all users broad access so that work is never blocked by permission problems at any stage
   3. CRecording every action so that users are aware they can be investigated after the fact at any point
   4. DEncrypting every file so that the organization does not have to classify its data in the first place
   Show answer and explanationHide answer

   Correct answer: A

   A security model such as least privilege constrains each subject to the minimum access its role requires, which bounds the damage a mistake or compromise can cause. Broad access, monitoring alone, and encryption without classification each fail to limit what a subject is allowed to do.

4. Question 4Adversarial Tactics, Techniques, and Procedures

   Which two techniques are commonly used by threat actors during initial access? (Choose two.)

   1. APhishing emails with a malicious attachment that are sent to targeted employees in the company
   2. BScanning a patched server for known weaknesses after it has been restored from its backup image
   3. CCollecting asset data from the company's approved configuration database for internal planning
   4. DEncrypting files for an authorized backup job that is scheduled in the maintenance window each week
   5. EAbusing valid credentials that were obtained from an earlier data breach at a third-party service
   Show answer and explanationHide answer

   Correct answer: A, E

   Initial access is the stage where an attacker gets a first foothold, commonly through phishing or with credentials stolen elsewhere. Scanning a restored server, collecting inventory data, and running an authorized backup are activities that occur after access or are legitimate operations.

5. Question 5Securing Assets

   Which control best supports recovery after a ransomware event?

   1. ATested offline or immutable backups, with documented recovery procedures for critical systems
   2. BKeeping backups mounted and writable on the same network segment as the production systems
   3. CRelying on file history on each user's laptop as the only copy of the business data held there
   4. DStoring a single backup copy in the same building as the production environment for quick access
   Show answer and explanationHide answer

   Correct answer: A

   Offline or immutable backups cannot be encrypted by malware on the live network, and tested recovery procedures show that restoration will work. Writable mounted backups, laptop-only copies, and one building's copy each leave the data exposed to the same attack or disaster.