CCOA Practice Exam — CCOA：Certified Cybersecurity Operations Analyst

1. The question bank is cloud‑connected and updates automatically; no manual re‑acquisition is required.

2. Start practicing right after activating the question bank. It supports simultaneous use on websites and mini‑programs, with one‑click bilingual switching for each question.

3. Functions include online practice, mock tests, note‑taking, wrong‑question recording, etc., valid for one year.

4. Recommended practice order: Turn on review mode to browse questions → Complete sequential practice → Take mock exams for pre‑test self‑assessment.

5. Activation codes can be purchased by clicking Buy Now on the right or via our official Tmall flagship store.

6. For inquiries, contact customer service through mini‑program, WeChat, WhatsApp or LINE.

Exam information

I. Basic Exam Information

- Exam Name: ISACA Certified Cybersecurity Operations Analyst™ (CCOA™)

- Launch & Update Date: Launched in January 2025 by ISACA; the latest exam outline was updated in September 2025.

- Exam Languages: Only English is available globally at present. No Chinese version has been announced. Candidates in Mainland China may only take the exam in English for the time being.

- Registration Eligibility: The exam is open to all candidates with no mandatory work experience requirements.

• Recommended for professionals with 2-3 years of hands-on experience in cybersecurity operations, SOC (Security Operations Center) roles, or related technical positions

• Agree to and abide by the ISACA Code of Professional Ethics

• Note: There are no pre-requisite credentials for CCOA; candidates may register without holding other certifications

- Exam Fees: USD 399 for ISACA members; USD 499 for non-members. A USD 50 credential application fee is required after passing the exam. A 6-month exam extension can be purchased for USD 75 if needed.

- Exam Duration: 4 hours (240 minutes), covering all 140 exam questions (115 multiple-choice + 25 performance-based)

- Exam Format: ISACA offers two standard exam modes worldwide: remote-proctored online exam (video proctoring via PSI) and in-person computer-based testing (CBT).

Available exam modes by region:

• Hong Kong: In-person CBT only

• Taiwan: In-person CBT and online exam

• Macau: In-person CBT only

• Mainland China: In-person CBT arranged by ISACA-authorized partners

• Overseas regions: Free to choose between remote proctoring and in-person CBT

- Exam Questions: 115 scenario-based multiple-choice questions and 25 performance-based lab questions (simulating real-world cybersecurity operations scenarios). All questions are scored with no unscored pre-test items.

- Scoring Details:

• A preliminary pass/fail result is provided immediately after the exam

• Official exam results will be sent via email within 10 working days

• Passing standard: 450 out of 800 (200-800 point scale)

- Exam Eligibility Validity: After successful registration, candidates must schedule and complete the exam within 12 months. Eligibility will expire if overdue, and re-registration and payment will be required.

II. Detailed Exam Content (Latest Exam Outline)

The CCOA exam covers five core knowledge domains with a total weight of 100%. It assesses the professional competencies and practical capabilities of cybersecurity operations analysts.

1. Technology Essentials (25%): Computer and cloud networking components, database management, virtualization and containerization, command-line interfaces (Linux/Windows), programming and scripting fundamentals, security tools and technologies, DevOps/SecDevOps principles

2. Cybersecurity Principles and Risk (20%): Cybersecurity governance frameworks, compliance requirements (GDPR, CCPA, PIPL), risk assessment methodologies, security roles and responsibilities, security policies and procedures, business continuity and disaster recovery planning

3. Adversarial Tactics, Techniques, and Procedures (10%): Threat landscape analysis, MITRE ATT&CK framework, attack vectors and methodologies, threat intelligence integration, penetration testing techniques, vulnerability exploitation methods

4. Incident Detection and Response (34%): Incident preparedness planning, security monitoring tools (SIEM, EDR/XDR), log analysis and correlation, indicators of compromise (IOCs) identification, incident containment/eradication/recovery, digital forensics fundamentals, malware analysis techniques

5. Securing Assets (11%): Security control design and implementation, identity and access management (IAM), vulnerability management programs, patch management processes, data protection strategies, endpoint security hardening

Core Assessment Focus

Technical proficiency in cybersecurity operations, threat detection and analysis capabilities, incident response planning and execution, security tool utilization (SIEM, EDR, Wireshark), vulnerability management, cross-team collaboration for security incidents, practical application of cybersecurity principles in real-world scenarios.

III. Registration Process

1. Registration Process for Non-Mainland China Candidates

1. Visit the official ISACA website: https://www.isaca.org, create and log in to your MyISACA account

2. Select the CCOA exam for registration and fill in relevant personal information

3. Complete exam fee payment (USD 399 for members / USD 499 for non-members)

4. Upon successful payment, your 12-month exam eligibility period will take effect

5. Schedule your exam time and location via PSI (remote proctoring or in-person CBT is optional)

6. Prepare valid identification documents and attend the exam at the scheduled time. For performance-based questions, ensure you have a stable internet connection and meet the technical requirements for the lab environment

2. Registration Process for Mainland China Candidates

1. Register via the official ISACA China website: https://www.isaca.org.cn or ISACA-authorized partners such as ZhongShen Audit Online and Saihu Academy

2. Submit personal information and complete registration with assistance from authorized institutions

3. Pay the exam fee (USD 399 for members / USD 499 for non-members). All registration formalities will be handled uniformly by the institution

4. Upon successful registration, your 12-month exam eligibility period will take effect

5. Follow the links or guidelines provided by the institution to schedule your exam time and test center on the PSI platform. In-person CBT is the primary option in Mainland China

6. Present valid identification documents (ID card or passport) on exam day. Familiarize yourself with the lab environment requirements beforehand for performance-based questions

IV. Supplementary Notes

1. Credential Validity: The CCOA credential is valid for 3 years. To maintain active status, holders must earn 60 Continuing Professional Education (CPE) credits within the validity period and pay annual maintenance fees (USD 45 for members / USD 85 for non-members)

2. Retake Policy: Candidates who fail the exam must wait 30 days before retaking it. A 90-day waiting period is required after two consecutive failures. Retake fees are identical to the initial exam fees

3. Credential Application Period: You must submit the CCOA credential application within 5 years upon passing the exam, pay the USD 50 application fee, and meet all other certification requirements. Otherwise, you will need to retake the exam

4. Differences from Other Cybersecurity Credentials: CCOA focuses on hands-on cybersecurity operations and technical skills, ideal for SOC analysts, security operations professionals, and cybersecurity technicians. CISM (Certified Information Security Manager) concentrates on security management and governance for IT managers. CISSP (Certified Information Systems Security Professional) covers comprehensive security domains for senior security professionals. CCAK (Certificate of Cloud Auditing Knowledge) specializes in cloud auditing for IT auditors and risk management practitioners

Wish all candidates every success in the exam!

Sample questions

CCOA · Q1

Question #1 A penetration tester has been hired and given access to all code, diagrams, and documentation. Which type of testing is being conducted?

A.
Full knowledge
B.
Partial knowledge
C.
No knowledge
D.
Unlimited scope

Answer: A

This question assesses core CCOA competency in classifying penetration testing engagements based on pre-provisioned information access, a key component of penetration test planning and audit governance covered in the CCOA body of knowledge. Per standardized cybersecurity testing frameworks integrated into CCOA curriculum, penetration tests are categorized by the level of internal information shared with the tester prior to the engagement to align with specific threat simulation and audit goals. The scenario states the tester is given complete access to all source code, network diagrams, and system documentation, which directly aligns with the full knowledge testing classification. This type of testing enables comprehensive evaluation of both external and internal vulnerabilities, including logic flaws, misconfigurations, and hidden attack paths that would not be detectable with limited pre-engagement information, and is commonly used for internal audit and secure development validation use cases addressed in CCOA training. Option Analysis: A. Full knowledge: Correct. As defined in CCOA penetration testing governance domains, full knowledge (also referred to as white box) testing provides the tester with unrestricted access to all internal system artifacts, including source code, architecture diagrams, configuration documentation, and authorized credentials as required. This exactly matches the access described in the question scenario. B. Partial knowledge: Incorrect. Partial knowledge (gray box) testing only provides the tester with a limited set of pre-engagement information, such as standard user credentials or high-level network overviews, rather than full access to all code, diagrams, and documentation. This classification does not fit the scenario provided. C. No knowledge: Incorrect. No knowledge (black box) testing provides no pre-engagement internal information to the tester, requiring them to perform open source intelligence and network reconnaissance to identify target assets, which is the opposite of the access granted in the question. D. Unlimited scope: Incorrect. Scope refers to the defined boundaries of allowed testing activity, such as which IP ranges, applications, and systems the tester is permitted to assess, rather than the level of pre-provisioned information. The question does not address test boundaries, so this option is unrelated to the classification being evaluated. Key Concepts: 1. Penetration Testing Knowledge Classification: A core CCOA domain concept that categorizes penetration tests into three tiers (full, partial, no knowledge) based on pre-engagement information provided to testers, enabling audit teams to select the appropriate testing model for specific risk assessment objectives. 2. Test Scope vs. Information Access: This key CCOA principle distinguishes between test scope (the allowed boundaries of testing activity) and information access (pre-shared internal data), two separate planning dimensions that are often misclassified by less experienced audit professionals. 3. White Box Testing Alignment: CCOA curriculum establishes that full knowledge testing is equivalent to white box testing, which is designed to support deep internal system vulnerability assessment, including evaluation of source code logic, internal access controls, and hidden attack surfaces. References: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment, https://csrc.nist.gov/publications/detail/sp/800-115/final ISACA Penetration Testing and Vulnerability Assessment Guide

CCOA · Q2

Question #2 Which of the following is the MOST effective approach for tracking vulnerabilities in an organization’s systems and applications?

A.
Wait for external security researchers to report vulnerabilities.
B.
Track only those vulnerabilities that have been publicly disclosed.
C.
Implement regular vulnerability scanning and assessments.
D.
Rely on employees to report any vulnerabilities they encounter.

Answer: C

The suggested answer C aligns with core Certified Cyber Operations Auditor (CCOA) vulnerability management and risk assessment domain requirements, which mandate proactive, structured processes to maintain full visibility of organizational security flaws. Regular vulnerability scanning and assessments deliver continuous, comprehensive coverage of all assets across on-premise, cloud, and custom application environments, identifying both publicly disclosed common vulnerabilities and exposures (CVEs) and internal, unique flaws such as misconfigurations and custom code defects. This approach directly addresses the question's requirement for effective vulnerability tracking by providing consistent, auditable, and timely data that supports prioritization, remediation, and compliance reporting, eliminating gaps present in reactive or unstructured alternative approaches. Option Analysis: A. Wait for external security researchers to report vulnerabilities. Incorrect. Per CCOA due diligence requirements, relying solely on external researcher reports is a reactive, uncontrollable approach that leaves unreported vulnerabilities exploitable for unknown periods. External researchers only identify a small fraction of total organizational vulnerabilities, and there is no guarantee of timely disclosure, so this approach fails to meet minimum vulnerability tracking standards. B. Track only those vulnerabilities that have been publicly disclosed. Incorrect. CCOA domain guidance notes that publicly disclosed vulnerabilities represent less than 30% of total risk for most organizations, as this excludes zero-day flaws, custom application defects, and internal misconfigurations that are not listed in public CVE databases. Limiting tracking to public disclosures creates critical unaddressed risk gaps and fails to meet audit requirements for comprehensive vulnerability management. C. Implement regular vulnerability scanning and assessments. Correct. This approach aligns 100% with CCOA's Vulnerability Management Lifecycle framework, which requires repeated, systematic assessment of all assets to identify new vulnerabilities as systems are updated, new assets are deployed, and new threats emerge. It combines automated scanning for known CVEs, manual penetration testing for custom code flaws, and configuration audits to deliver full attack surface visibility, with standardized tracking data that supports remediation workflows and audit evidence collection. D. Rely on employees to report any vulnerabilities they encounter. Incorrect. Per CCOA guidance, employee vulnerability reporting is an optional supplementary control, not a primary tracking method. Most employees lack specialized security training to identify the majority of vulnerabilities, and reporting is inconsistent and unstructured, so this approach delivers incomplete, unreliable vulnerability data that cannot support effective risk mitigation. Key Concepts: 1. Vulnerability Management Lifecycle: A core CCOA domain framework that defines the continuous process of identifying, classifying, prioritizing, remediating, and verifying security flaws, with regular scanning and assessments serving as the mandatory primary input for the identification phase. 2. Proactive Risk Mitigation: CCOA guidance prioritizes proactive controls that identify and address vulnerabilities before they are exploited, over reactive controls that only respond to flaws after they have been discovered by external parties, as proactive controls reduce residual risk by an average of 70% for most organizations. 3. Attack Surface Visibility: A core CCOA audit requirement that mandates organizations maintain full, up-to-date awareness of all assets and their associated vulnerabilities, which can only be achieved through regular, structured assessments rather than partial, unstructured data sources. References: NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Proactive Mitigation for Information Technology Vulnerabilities, https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final CIS Control 7: Vulnerability Management

CCOA · Q3

Question #3 A nation-state that is employed to cause financial damage on an organization is BEST categorized as:

A.
a threat actor.
B.
an attack vector.
C.
a risk.
D.
a vulnerability.

Answer: A

This question aligns with the Certified Cybersecurity Operations Analyst (CCOA) core domain of Threat Intelligence and Classification, which requires candidates to correctly categorize adversarial entities to support effective risk assessment and incident response. The scenario describes a sovereign nation-state entity with explicit intent to cause financial harm to a target organization. Per CCOA body of knowledge guidelines, entities that execute or intend to execute malicious acts against organizational assets are formally classified as threat actors, making option A the only accurate and precise choice for this scenario. Correct classification of nation-state actors is a critical CCOA skill, as these high-resourced adversaries require tailored defensive and response protocols that differ from lower-tier threat types. Option Analysis: A. Correct. Per CCOA threat taxonomy standards, a threat actor is defined as any individual, group, or sovereign entity that carries out or intends to carry out malicious actions against organizational assets to achieve a stated adversarial goal, including financial damage. Nation-state actors are a formally recognized category of advanced persistent threat actors in the CCOA curriculum, so this option directly matches the scenario description. B. Incorrect. An attack vector is the specific method or path a threat actor uses to exploit vulnerabilities and gain access to target systems, such as phishing emails, unpatched software, or unsecured remote access protocols. A nation-state is the entity that leverages attack vectors, not the vector itself, so this option is misaligned with CCOA-defined terminology. C. Incorrect. Risk, as defined in CCOA risk management domains, is the combination of the likelihood of a negative security event occurring and the potential impact of that event. A nation-state threat actor is a contributing input to risk calculation, not risk itself, so this option is incorrect. D. Incorrect. A vulnerability is a gap, flaw, or weakness in an organization's security controls, systems, or processes that can be exploited by a threat actor to cause harm. A nation-state is an external entity that exploits vulnerabilities, not a vulnerability itself, so this option does not fit the scenario. Key Concepts: 1. Threat Actor Taxonomy: CCOA core content requires candidates to categorize threat actors by type (including nation-state, organized crime, hacktivist, and script kiddie) and associated motivation to support accurate threat attribution and targeted response planning. 2. Foundational Cybersecurity Terminology Distinction: CCOA exams test mastery of differentiated definitions for core risk and threat terms (threat actor, attack vector, vulnerability, risk) to ensure analysts can communicate accurately about security events during daily operations. 3. Nation-State Threat Attributes: CCOA curriculum identifies nation-state actors as highly resourced, persistent adversaries often tasked with strategic goals including financial damage, intellectual property theft, and operational disruption of target public and private sector organizations. References: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments, https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final MITRE ATT&CK® Groups (Threat Actor) Classification, https://attack.mitre.org/groups/

CCOA · Q4

Question #4 The PRIMARY function of open source intelligence (OSINT) is:

A.
encoding stolen data prior to exfiltration to subvert data loss prevention (DLP) controls.
B.
initiating active probes for open ports with the aim of retrieving service version information.
C.
leveraging publicly available sources to gather information on an enterprise or on individuals.
D.
delivering remote access malware packaged as an executable file via social engineering tactics.

Answer: C

For the All CCOA Questions certification, which covers cybersecurity audit, threat intelligence, and risk assessment domains, open source intelligence (OSINT) is a core passive intelligence gathering methodology. The primary function of OSINT as defined in the CCOA body of knowledge is to collect, process, and analyze information from legally accessible, public, unclassified sources to support audit planning, threat surface mapping, risk assessment, and due diligence activities. Option C directly aligns with this core definition, as it explicitly states the use of publicly available sources to gather information on enterprises or individuals, which is the foundational, primary purpose of OSINT across all approved use cases covered in the CCOA curriculum. Option Analysis: A. Incorrect. Encoding stolen data prior to exfiltration to evade DLP controls is an adversarial post-exploitation tactic associated with data exfiltration, not OSINT. This activity falls under the CCOA adversarial tactics domain and has no connection to open source intelligence functions. B. Incorrect. Initiating active probes for open ports to retrieve service version information is active reconnaissance, specifically port scanning, which requires direct interaction with target systems. OSINT is a form of passive reconnaissance that does not involve direct contact with targets, so this is not a function of OSINT per CCOA reconnaissance classification guidelines. C. Correct. This option directly matches the standard definition of OSINT recognized in the CCOA body of knowledge. OSINT exclusively leverages publicly available sources including public corporate filings, social media profiles, public DNS records, government databases, and published news content to gather actionable information about target enterprises or individuals, with no direct interaction with the target, which is its primary function. D. Incorrect. Delivering remote access malware via social engineering is an adversarial initial access tactic, part of the CCOA social engineering and malware domain, and has no relation to the core function of OSINT. Key Concepts: 1. OSINT Core Classification: Per CCOA intelligence domain guidelines, OSINT is categorized as passive reconnaissance, meaning it does not involve any direct interaction with target assets, reducing risk of detection or disruption to target operations during audits or assessments. 2. Reconnaissance Type Distinction: CCOA requires candidates to distinguish between passive intelligence gathering (including OSINT) and active intelligence gathering (including port scanning, vulnerability scanning) to ensure audit teams adhere to defined rules of engagement and compliance requirements during assessments. 3. OSINT Use Cases for Auditors: CCOA curriculum identifies OSINT as a critical pre-audit tool to identify exposed organizational assets, public-facing risk points, and publicly disclosed security incidents prior to conducting on-site or active audit activities, improving audit efficiency and coverage. References: NIST Special Publication 800-150: Guide to Cyber Threat Information Sharing, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-150.pdf OSINT Foundation: What is OSINT, https://osintfoundation.org/what-is-osint/

CCOA · Q5

Question #5 Which of the following has been defined when a disaster recovery plan (DRP) requires daily backups?

A.
Maximum tolerable downtime (MTD)
B.
Recovery time objective (RTO)
C.
Recovery point objective (RPO)
D.
Mean time to failure (MTTF)

Answer: C

This question assesses knowledge of business continuity and disaster recovery (BC/DR) core metrics as defined in the All CCOA Questions certification domain. The scenario specifies a DRP requirement for daily backups, which directly maps to a defined tolerance for data loss. Daily backups mean the most recent restorable data will be no more than 24 hours old, so the organization has formalized that a maximum of 24 hours of data loss is acceptable for the covered systems. This alignment of backup frequency to acceptable data loss is the exact use case for the recovery point objective (RPO) metric, which is the correct answer. Option Analysis: A. Maximum tolerable downtime (MTD) is incorrect. MTD defines the absolute maximum length of time a business function can be offline before the organization suffers permanent, irreversible harm to its operations or viability. It measures acceptable downtime, not acceptable data loss, so it is not defined by backup frequency requirements. B. Recovery time objective (RTO) is incorrect. RTO is the target timeframe within which a system or business function must be restored to full operational status after a disruption. It measures the speed of recovery, not the age of restorable data, so backup frequency does not set RTO values. C. Recovery point objective (RPO) is correct. As defined in the CCOA BC/DR domain, RPO quantifies the maximum amount of data, measured in units of time, that an organization can afford to lose following a disaster event. A daily backup requirement explicitly sets a 24-hour RPO, which directly matches the control defined in the question scenario. D. Mean time to failure (MTTF) is incorrect. MTTF is an asset reliability metric that calculates the average expected operational lifespan of a non-repairable component before it experiences a critical failure. It is unrelated to DRP recovery objectives or backup scheduling requirements. Key Concepts: 1. Recovery Point Objective (RPO): A core BC/DR metric that quantifies acceptable data loss in time units, which directly dictates required backup frequency for covered systems and data sets. 2. Recovery Time Objective (RTO): A BC/DR metric that quantifies the maximum acceptable duration of system downtime following a disruption, separate from data loss thresholds. 3. Maximum Tolerable Downtime (MTD): The absolute maximum period a business function can be non-operational before the organization faces permanent material harm that threatens its long-term viability. References: NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems, https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final Disaster Recovery of Workloads on AWS: AWS Whitepaper, https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-concepts.html

FAQ

How many practice questions are available for CCOA?

This question bank includes 116 CCOA practice questions covering single and multiple choice, each with answers and explanations.

Are CCOA practice questions available in Chinese and English?

Yes, CCOA practice questions are provided in both Chinese and English.

Can I try CCOA practice questions for free?

Yes. Free sample questions are available on this page, and the full question bank is available after signing up on Zhangxuetu.

Try practice questions Get the question bank

CCOA Practice Exam — CCOA：Certified Cybersecurity Operations Analyst

Exam information

Sample questions

FAQ

Related exams