10 free, exam-style Certified Cybersecurity Operations Analyst (CCOA) practice questions with answers and explanations. No signup required. Work through them below, then take the full free CCOA practice test to study every exam domain.
These 10 free CCOA questions are organized by exam domain, so you can see how each part of the Certified Cybersecurity Operations Analyst blueprint is tested. Reveal the answer and explanation under each question.
During a threat-hunting exercise, an analyst uses Wireshark to examine captured network traffic and observes a single internal host sending TCP SYN packets to ports 22, 80, 443, 445, 3389, and 8080 on multiple internal servers within a 10-second window, with no corresponding SYN-ACK responses. What does this activity MOST likely indicate?
Correct answer: B - A network reconnaissance scan attempting to identify open services on internal hosts
An analyst investigating a suspected data exfiltration incident needs to examine the contents of HTTP communication between an internal workstation and an external server captured in a PCAP file. Which Wireshark technique is MOST effective for reconstructing and reading the full HTTP request and response exchange?
Correct answer: C - Right-clicking an HTTP packet and selecting Follow > TCP Stream to view the full session
According to ISACA, what is the ULTIMATE goal of an organization's cybersecurity governance program?
Correct answer: C - Creating value for the organization and its stakeholders
An organization's data center houses a server worth $600,000. A risk assessment determines that a specific threat event would damage 30% of the server's value and is expected to occur twice per year. What is the Annualized Loss Expectancy (ALE) for this risk?
Correct answer: B - $360,000
An analyst observes that an attacker has gained initial access through a phishing email, then used PowerShell to download additional tools, created a scheduled task for persistence, and is now executing Mimikatz to extract credentials from memory. In the MITRE ATT&CK framework, which tactic does the Mimikatz activity MOST directly map to?
Correct answer: C - Credential Access
A security analyst has completed an incident investigation involving a ransomware attack that encrypted 40 file servers. The incident response team is now conducting the post-incident review. What is the PRIMARY objective of this phase?
Correct answer: C - Deriving improvements to the incident response process based on lessons learned
An analyst receives an alert about a compromised workstation that is actively communicating with a known command-and-control server. The analyst must collect forensic evidence before containment. Which data source should the analyst acquire FIRST?
Correct answer: B - Volatile memory (RAM) using a memory acquisition tool
A SOC analyst notices that a workstation is making HTTPS connections to the same external IP address at exactly 60-second intervals, each transferring approximately 200 bytes of data. No user activity correlates with the connections. What should the analyst investigate this activity as?
Correct answer: C - Command-and-control beaconing from a potentially compromised endpoint
An organization restricts access to its cloud-based HR system based on the employee's department, the sensitivity classification of the data being requested, the geographic location of the login attempt, and the time of day. Which access control model does this BEST represent?
Correct answer: D - Mandatory Access Control (MAC)
A vulnerability scanner identifies a Critical-severity CVE on an internet-facing web server. The analyst notes that the CVSS Base Score is 9.8, but the organization has implemented a WAF in front of the server and the application only processes non-sensitive public data. Which CVSS metric component should the analyst use to reflect these organizational factors when reporting risk to management?
Correct answer: C - Environmental Metrics, because they tailor the score to the organization's specific context
Practice hundreds more CCOA questions with instant scoring, weak-area drills, and full exam simulations.