ISACA CCOA Practice Exams
Last updated on Oct 22,2026- Exam Code: CCOA
- Exam Name: ISACA Certified Cybersecurity Operations Analyst
- Certification Provider: ISACA
- Latest update: Oct 22,2026
Question #89
168.1.100 SomeVulnName CVE-2021-22145 High
Step 6: Verify the Vulnerability
Click on the host IP to see the detailed vulnerability description.
Check for the following:
Exploitability: Proof that the vulnerability can be actively exploited.
Description and Impact: Details about the vulnerability and its potential impact.
Fixes/Recommendations: Suggested mitigations or patches.
Step 7: Note the Vulnerable Host IP
The IP address that appears in the filtered list is the vulnerable machine.
Example
Correct Answer: The host IP of the machine vulnerable to CVE-2021-22145 is: 192.168.1.100
Step 8: Take Immediate Actions
Isolate the affected machine to prevent exploitation.
Patch or update the software affected by CVE-2021-22145.
Perform a quick re-scan to ensure that the vulnerability has been mitigated.
Step 9: Generate a Report for Documentation
Export the filtered scan results as a PDF or HTML from the GVM.
Include:
Host IP
CVE ID
Severity and Risk Level
Remediation Steps
Background on CVE-2021-22145:
This CVE is related to a vulnerability in certain software, often associated with improper access control or authentication bypass.
Attackers can exploit this to gain unauthorized access or escalate privileges.
Step 8: Take Immediate Actions
Isolate the affected machine to prevent exploitation.
Patch or update the software affected by CVE-2021-22145.
Perform a quick re-scan to ensure that the vulnerability has been mitigated.
Step 9: Generate a Report for Documentation
Export the filtered scan results as a PDF or HTML from the GVM.
Include:
Host IP
CVE ID
Severity and Risk Level
Remediation Steps
Background on CVE-2021-22145:
This CVE is related to a vulnerability in certain software, often associated with improper access control or authentication bypass.
Attackers can exploit this to gain unauthorized access or escalate privileges.
Question #92
Which of the following BEST enables an organization to identify potential security threats by monitoring and analyzing network traffic for unusual activity?
- A . Web application firewall (WAP)
- B . Endpoint security
- C . Security operation center (SOC)
- D . Data loss prevention (DLP)
Correct Answer: C
C
Explanation:
A Security Operation Center (SOC) is tasked with monitoring and analyzing network traffic to detect anomalies and potential security threats.
Role: SOCs collect and analyze data from firewalls, intrusion detection systems (IDS), and other network monitoring tools.
Function: Analysts in the SOC identify unusual activity patterns that may indicate intrusions or malware.
Proactive Threat Detection: Uses log analysis and behavioral analytics to catch threats early.
Incorrect Options:
C
Explanation:
A Security Operation Center (SOC) is tasked with monitoring and analyzing network traffic to detect anomalies and potential security threats.
Role: SOCs collect and analyze data from firewalls, intrusion detection systems (IDS), and other network monitoring tools.
Function: Analysts in the SOC identify unusual activity patterns that may indicate intrusions or malware.
Proactive Threat Detection: Uses log analysis and behavioral analytics to catch threats early.
Incorrect Options:
Question #92
Which of the following BEST enables an organization to identify potential security threats by monitoring and analyzing network traffic for unusual activity?
- A . Web application firewall (WAP)
- B . Endpoint security
- C . Security operation center (SOC)
- D . Data loss prevention (DLP)
Correct Answer: C
C
Explanation:
A Security Operation Center (SOC) is tasked with monitoring and analyzing network traffic to detect anomalies and potential security threats.
Role: SOCs collect and analyze data from firewalls, intrusion detection systems (IDS), and other network monitoring tools.
Function: Analysts in the SOC identify unusual activity patterns that may indicate intrusions or malware.
Proactive Threat Detection: Uses log analysis and behavioral analytics to catch threats early.
Incorrect Options:
C
Explanation:
A Security Operation Center (SOC) is tasked with monitoring and analyzing network traffic to detect anomalies and potential security threats.
Role: SOCs collect and analyze data from firewalls, intrusion detection systems (IDS), and other network monitoring tools.
Function: Analysts in the SOC identify unusual activity patterns that may indicate intrusions or malware.
Proactive Threat Detection: Uses log analysis and behavioral analytics to catch threats early.
Incorrect Options:
Question #94
Which of the following security practices is MOST effective in reducing system risk through system hardening?
- A . Having more than one user to complete a task
- B . Permitting only the required access
- C . Giving users only the permissions they need
- D . Enabling only the required capabilities
Correct Answer: D
D
Explanation:
System hardening involves disabling unnecessary features and enabling only required capabilities to reduce the attack surface:
Minimizing Attack Vectors: Reduces potential entry points by disabling unused services and ports.
Configuration Management: Ensures only essential features are active, reducing system complexity.
Best Practice: Hardening is part of secure system configuration management to mitigate vulnerabilities.
Incorrect Options:
D
Explanation:
System hardening involves disabling unnecessary features and enabling only required capabilities to reduce the attack surface:
Minimizing Attack Vectors: Reduces potential entry points by disabling unused services and ports.
Configuration Management: Ensures only essential features are active, reducing system complexity.
Best Practice: Hardening is part of secure system configuration management to mitigate vulnerabilities.
Incorrect Options:
Question #95
Which of the following should be completed FIRST in a data loss prevention (OLP) system implementation project?
- A . Deployment scheduling
- B . Data analysis
- C . Data Inventory
- D . Resource allocation
Correct Answer: C
C
Explanation:
The first step in a Data Loss Prevention (DLP) implementation is to perform a data inventory because:
Identification of Sensitive Data: Knowing what data needs protection is crucial before deploying DLP solutions.
Classification and Prioritization: Helps in categorizing data based on sensitivity and criticality.
Mapping Data Flows: Identifies where sensitive data resides and how it moves within the organization.
Foundation for Policy Definition: Enables the creation of effective DLP policies tailored to the organization’s needs.
Other options analysis:
C
Explanation:
The first step in a Data Loss Prevention (DLP) implementation is to perform a data inventory because:
Identification of Sensitive Data: Knowing what data needs protection is crucial before deploying DLP solutions.
Classification and Prioritization: Helps in categorizing data based on sensitivity and criticality.
Mapping Data Flows: Identifies where sensitive data resides and how it moves within the organization.
Foundation for Policy Definition: Enables the creation of effective DLP policies tailored to the organization’s needs.
Other options analysis:
Question #96
Which of the following should be the ULTIMATE outcome of adopting enterprise governance of information and technology in cybersecurity?
- A . Business resilience
- B . Risk optimization
- C . Resource optimization
- D . Value creation
Correct Answer: D
D
Explanation:
The ultimate outcome of adopting enterprise governance of information and technology in cybersecurity is value creation because:
Strategic Alignment: Ensures that cybersecurity initiatives support business objectives.
Efficient Use of Resources: Enhances operational efficiency by integrating security practices seamlessly.
Risk Optimization: Minimizes the risk impact on business operations while maintaining productivity.
Business Enablement: Strengthens trust with stakeholders by demonstrating robust governance and security.
Other options analysis:
D
Explanation:
The ultimate outcome of adopting enterprise governance of information and technology in cybersecurity is value creation because:
Strategic Alignment: Ensures that cybersecurity initiatives support business objectives.
Efficient Use of Resources: Enhances operational efficiency by integrating security practices seamlessly.
Risk Optimization: Minimizes the risk impact on business operations while maintaining productivity.
Business Enablement: Strengthens trust with stakeholders by demonstrating robust governance and security.
Other options analysis:
Question #97
Which of the following tactics is associated with application programming interface (API) requests that may result in bypassing access control checks?
- A . Insecure direct object reference
- B . Input injection
- C . Forced browsing
- D . Broken access control
Correct Answer: D
D
Explanation:
API requests that bypass access control checks typically fall under the category of Broken Access Control. This vulnerability occurs when the API fails to enforce restrictions on authenticated users, allowing them to access data or functionality they are not authorized to use.
Example: An API endpoint that does not properly verify user roles might allow a standard user to perform admin actions.
Related Issues: Insecure direct object references (IDOR), where APIs expose objects without sufficient authorization checks, often lead to broken access control.
Impact: Attackers can exploit this to gain unauthorized access, modify data, or escalate privileges.
Incorrect Options:
D
Explanation:
API requests that bypass access control checks typically fall under the category of Broken Access Control. This vulnerability occurs when the API fails to enforce restrictions on authenticated users, allowing them to access data or functionality they are not authorized to use.
Example: An API endpoint that does not properly verify user roles might allow a standard user to perform admin actions.
Related Issues: Insecure direct object references (IDOR), where APIs expose objects without sufficient authorization checks, often lead to broken access control.
Impact: Attackers can exploit this to gain unauthorized access, modify data, or escalate privileges.
Incorrect Options:
Question #98
SOAP and REST are Iwo different approaches related to:
- A . machine learning (ML) design.
- B . cloud-based anomaly detection.
- C . SG/6G networks.
- D . application programming Interface (API) design.
Correct Answer: D
D
Explanation:
SOAP (Simple Object Access Protocol) and REST (Representational State Transfer) are two common approaches used in API design:
SOAP: A protocol-based approach with strict rules, typically using XML.
REST: A more flexible, resource-based approach that often uses JSON.
Usage: Both methods facilitate communication between applications, especially in web services.
Key Difference: SOAP is more structured and secure for enterprise environments, while REST is lightweight and widely used in modern web applications.
Incorrect Options:
D
Explanation:
SOAP (Simple Object Access Protocol) and REST (Representational State Transfer) are two common approaches used in API design:
SOAP: A protocol-based approach with strict rules, typically using XML.
REST: A more flexible, resource-based approach that often uses JSON.
Usage: Both methods facilitate communication between applications, especially in web services.
Key Difference: SOAP is more structured and secure for enterprise environments, while REST is lightweight and widely used in modern web applications.
Incorrect Options:
Question #99
Which of the following is a network port for service message block (SMS)?
- A . 445
- B . 143
- C . 389
- D . 22
Correct Answer: A
A
Explanation:
Port 445 is used by Server Message Block (SMB) protocol:
SMB Functionality: Allows file sharing, printer sharing, and access to network resources.
Protocol: Operates over TCP, typically on Windows systems.
Security Concerns: Often targeted for attacks like EternalBlue, which was exploited by the WannaCry ransomware.
Common Vulnerabilities: SMBv1 is outdated and vulnerable; it is recommended to use SMBv2 or SMBv3.
Incorrect Options:
B. 143: Used by IMAP for email retrieval.
C. 389: Used by LDAP for directory services.
D. 22: Used by SSH for secure remote access.
Exact Extract from CCOA Official Review Manual, 1st Edition:
Refer to Chapter 5, Section "Common Network Ports and Services," Subsection "SMB and Network File Sharing" – Port 445 is commonly used for SMB file sharing on Windows networks.
A
Explanation:
Port 445 is used by Server Message Block (SMB) protocol:
SMB Functionality: Allows file sharing, printer sharing, and access to network resources.
Protocol: Operates over TCP, typically on Windows systems.
Security Concerns: Often targeted for attacks like EternalBlue, which was exploited by the WannaCry ransomware.
Common Vulnerabilities: SMBv1 is outdated and vulnerable; it is recommended to use SMBv2 or SMBv3.
Incorrect Options:
B. 143: Used by IMAP for email retrieval.
C. 389: Used by LDAP for directory services.
D. 22: Used by SSH for secure remote access.
Exact Extract from CCOA Official Review Manual, 1st Edition:
Refer to Chapter 5, Section "Common Network Ports and Services," Subsection "SMB and Network File Sharing" – Port 445 is commonly used for SMB file sharing on Windows networks.
Question #99
Which of the following is a network port for service message block (SMS)?
- A . 445
- B . 143
- C . 389
- D . 22
Correct Answer: A
A
Explanation:
Port 445 is used by Server Message Block (SMB) protocol:
SMB Functionality: Allows file sharing, printer sharing, and access to network resources.
Protocol: Operates over TCP, typically on Windows systems.
Security Concerns: Often targeted for attacks like EternalBlue, which was exploited by the WannaCry ransomware.
Common Vulnerabilities: SMBv1 is outdated and vulnerable; it is recommended to use SMBv2 or SMBv3.
Incorrect Options:
B. 143: Used by IMAP for email retrieval.
C. 389: Used by LDAP for directory services.
D. 22: Used by SSH for secure remote access.
Exact Extract from CCOA Official Review Manual, 1st Edition:
Refer to Chapter 5, Section "Common Network Ports and Services," Subsection "SMB and Network File Sharing" – Port 445 is commonly used for SMB file sharing on Windows networks.
A
Explanation:
Port 445 is used by Server Message Block (SMB) protocol:
SMB Functionality: Allows file sharing, printer sharing, and access to network resources.
Protocol: Operates over TCP, typically on Windows systems.
Security Concerns: Often targeted for attacks like EternalBlue, which was exploited by the WannaCry ransomware.
Common Vulnerabilities: SMBv1 is outdated and vulnerable; it is recommended to use SMBv2 or SMBv3.
Incorrect Options:
B. 143: Used by IMAP for email retrieval.
C. 389: Used by LDAP for directory services.
D. 22: Used by SSH for secure remote access.
Exact Extract from CCOA Official Review Manual, 1st Edition:
Refer to Chapter 5, Section "Common Network Ports and Services," Subsection "SMB and Network File Sharing" – Port 445 is commonly used for SMB file sharing on Windows networks.