ISACA CCOA Practice Exams
Last updated on Oct 22,2026- Exam Code: CCOA
- Exam Name: ISACA Certified Cybersecurity Operations Analyst
- Certification Provider: ISACA
- Latest update: Oct 22,2026
Question #81
Which of the following cyber crime tactics involves targets being contacted via text message by an attacker posing as a legitimate entity?
- A . Hacking
- B . Vishing
- C . Smishing
- D . Cyberstalking
Correct Answer: C
C
Explanation:
Smishing (SMS phishing) involves sending malicious text messages posing as legitimate entities to trick individuals into disclosing sensitive information or clicking malicious links.
Social Engineering via SMS: Attackers often impersonate trusted institutions (like banks) to induce fear or urgency.
Tactics: Typically include fake alerts, password reset requests, or promotional offers.
Impact: Users may unknowingly provide login credentials, credit card information, or download malware.
Example: A message claiming to be from a bank asking users to verify their account by clicking a link.
Other options analysis:
C
Explanation:
Smishing (SMS phishing) involves sending malicious text messages posing as legitimate entities to trick individuals into disclosing sensitive information or clicking malicious links.
Social Engineering via SMS: Attackers often impersonate trusted institutions (like banks) to induce fear or urgency.
Tactics: Typically include fake alerts, password reset requests, or promotional offers.
Impact: Users may unknowingly provide login credentials, credit card information, or download malware.
Example: A message claiming to be from a bank asking users to verify their account by clicking a link.
Other options analysis:
Question #81
Which of the following cyber crime tactics involves targets being contacted via text message by an attacker posing as a legitimate entity?
- A . Hacking
- B . Vishing
- C . Smishing
- D . Cyberstalking
Correct Answer: C
C
Explanation:
Smishing (SMS phishing) involves sending malicious text messages posing as legitimate entities to trick individuals into disclosing sensitive information or clicking malicious links.
Social Engineering via SMS: Attackers often impersonate trusted institutions (like banks) to induce fear or urgency.
Tactics: Typically include fake alerts, password reset requests, or promotional offers.
Impact: Users may unknowingly provide login credentials, credit card information, or download malware.
Example: A message claiming to be from a bank asking users to verify their account by clicking a link.
Other options analysis:
C
Explanation:
Smishing (SMS phishing) involves sending malicious text messages posing as legitimate entities to trick individuals into disclosing sensitive information or clicking malicious links.
Social Engineering via SMS: Attackers often impersonate trusted institutions (like banks) to induce fear or urgency.
Tactics: Typically include fake alerts, password reset requests, or promotional offers.
Impact: Users may unknowingly provide login credentials, credit card information, or download malware.
Example: A message claiming to be from a bank asking users to verify their account by clicking a link.
Other options analysis:
Question #83
Which of the following BEST describes JSON web tokens?
- A . They can be used to store user Information and session data.
- B . They can only be used to authenticate users in web applications.
- C . They are signed using a public key and verified using a private key.
- D . They are only used with symmetric encryption.
Correct Answer: A
A
Explanation:
JSON Web Tokens (JWTs) are used to transmit data between parties securely, often for authentication and session management.
Data Storage: JWTs can contain user information and session details within the payload section.
Stateless Authentication: Since the token itself holds the user data, servers do not need to store sessions.
Signed, Not Encrypted: JWTs are typically signed using private keys to ensure integrity but may or may not be encrypted.
Common Usage: API authentication, single sign-on (SSO), and user sessions in web applications.
Other options analysis:
B. Only for authentication: JWTs can also carry claims for authorization or session data.
C. Signed using public key: Usually, JWTs are signed with a private key and verified using a public key.
D. Only symmetric encryption: JWTs can use both symmetric (HMAC) and asymmetric (RSA/EC) algorithms.
CCOA Official Review Manual, 1st Edition
Reference: Chapter 8: Authentication and Token Management: Explains the role of JWTs in secure data transmission.
Chapter 9: API Security: Discusses the use of JWTs for secure API communication.
A
Explanation:
JSON Web Tokens (JWTs) are used to transmit data between parties securely, often for authentication and session management.
Data Storage: JWTs can contain user information and session details within the payload section.
Stateless Authentication: Since the token itself holds the user data, servers do not need to store sessions.
Signed, Not Encrypted: JWTs are typically signed using private keys to ensure integrity but may or may not be encrypted.
Common Usage: API authentication, single sign-on (SSO), and user sessions in web applications.
Other options analysis:
B. Only for authentication: JWTs can also carry claims for authorization or session data.
C. Signed using public key: Usually, JWTs are signed with a private key and verified using a public key.
D. Only symmetric encryption: JWTs can use both symmetric (HMAC) and asymmetric (RSA/EC) algorithms.
CCOA Official Review Manual, 1st Edition
Reference: Chapter 8: Authentication and Token Management: Explains the role of JWTs in secure data transmission.
Chapter 9: API Security: Discusses the use of JWTs for secure API communication.
Question #84
In which phase of the Cyber Kill Chain" would a red team run a network and port scan with Nmap?
- A . Exploitation
- B . Delivery
- C . Reconnaissance
- D . Weaponization
Correct Answer: C
C
Explanation:
During the Reconnaissance phase of the Cyber Kill Chain, attackers gather information about the target system:
Purpose: Identify network topology, open ports, services, and potential vulnerabilities.
Tools: Nmap is commonly used for network and port scanning during this phase.
Data Collection: Results provide insights into exploitable entry points or weak configurations.
Red Team Activities: Typically include passive and active scanning to understand the network landscape.
Incorrect Options:
C
Explanation:
During the Reconnaissance phase of the Cyber Kill Chain, attackers gather information about the target system:
Purpose: Identify network topology, open ports, services, and potential vulnerabilities.
Tools: Nmap is commonly used for network and port scanning during this phase.
Data Collection: Results provide insights into exploitable entry points or weak configurations.
Red Team Activities: Typically include passive and active scanning to understand the network landscape.
Incorrect Options:
Question #85
SIMULATION
The CISO has received a bulletin from law enforcement authorities warning that the enterprise may be at risk of attack from a specific threat actor. Review the bulletin
named CCOA Threat Bulletin.pdf on the Desktop.
Which host IP was targeted during the following time frame: 11:39 PM to 11:43 PM (Absolute) on August 16, 2024?
Correct Answer: Step 1: Understand the Task and Objective
Objective:
Identify the host IP targeted during the specified time frame:
vbnet
11:39 PM to 11:43 PM on August 16, 2024
The relevant file to examine:
nginx
CCOA Threat Bulletin.pdf
File location:
javascript
~/Desktop/CCOA Threat Bulletin.pdf
Step 2: Access and Analyze the Bulletin
Objective:
Identify the host IP targeted during the specified time frame:
vbnet
11:39 PM to 11:43 PM on August 16, 2024
The relevant file to examine:
nginx
CCOA Threat Bulletin.pdf
File location:
javascript
~/Desktop/CCOA Threat Bulletin.pdf
Step 2: Access and Analyze the Bulletin
Question #86
An organization uses containerization for its business application deployments, and all containers run on the same host, so they MUST share the same:
- A . user data.
- B . database.
- C . operating system.
- D . application.
Correct Answer: C
C
Explanation:
In a containerization environment, all containers running on the same host share the same operating system kernel because:
Container Architecture: Containers virtualize at the OS level, unlike VMs, which have separate OS instances.
Shared Kernel: The host OS kernel is shared across all containers, which makes container deployment lightweight and efficient.
Isolation through Namespaces: While processes are isolated, the underlying OS remains the same.
Docker Example: A Docker host running Linux containers will only support other Linux-based containers, as they share the Linux kernel.
Other options analysis:
C
Explanation:
In a containerization environment, all containers running on the same host share the same operating system kernel because:
Container Architecture: Containers virtualize at the OS level, unlike VMs, which have separate OS instances.
Shared Kernel: The host OS kernel is shared across all containers, which makes container deployment lightweight and efficient.
Isolation through Namespaces: While processes are isolated, the underlying OS remains the same.
Docker Example: A Docker host running Linux containers will only support other Linux-based containers, as they share the Linux kernel.
Other options analysis:
Question #87
Which of the following is the GREATEST risk resulting from a Domain Name System (DNS) cache poisoning attack?
- A . Reduced system availability
- B . Noncompliant operations
- C . Loss of network visibility
- D . Loss of sensitive data
Correct Answer: D
D
Explanation:
The greatest risk resulting from a DNS cache poisoning attack is the loss of sensitive data.
Here’s why:
DNS Cache Poisoning: An attacker corrupts the DNS cache to redirect users from legitimate sites to malicious ones.
Phishing and Data Theft: Users think they are accessing legitimate websites (like banking portals) but are unknowingly entering sensitive data into fake sites.
Man-in-the-Middle (MitM) Attacks: Attackers can intercept data traffic, capturing credentials or personal information.
Data Exfiltration: Once credentials are stolen, attackers can access internal systems, leading to data loss.
Other options analysis:
D
Explanation:
The greatest risk resulting from a DNS cache poisoning attack is the loss of sensitive data.
Here’s why:
DNS Cache Poisoning: An attacker corrupts the DNS cache to redirect users from legitimate sites to malicious ones.
Phishing and Data Theft: Users think they are accessing legitimate websites (like banking portals) but are unknowingly entering sensitive data into fake sites.
Man-in-the-Middle (MitM) Attacks: Attackers can intercept data traffic, capturing credentials or personal information.
Data Exfiltration: Once credentials are stolen, attackers can access internal systems, leading to data loss.
Other options analysis:
Question #88
Which of the following is MOST likely to result from misunderstanding the cloud service shared responsibility model?
- A . Falsely assuming that certain risks have been transferred to the vendor
- B . Improperly securing access to the cloud metastructure layer
- C . Misconfiguration of access controls for cloud services
- D . Being forced to remain with the cloud service provider due to vendor lock-In
Correct Answer: A
A
Explanation:
Misunderstanding the cloud service shared responsibility model often leads to the false assumption that the cloud service provider (CSP) is responsible for securing all aspects of the cloud environment.
What is the Shared Responsibility Model? It delineates the security responsibilities of the CSP and the customer.
Typical Misconception: Customers may believe that the provider handles all security aspects, including data protection and application security, while in reality, the customer is usually responsible for securing data and application configurations.
Impact: This misunderstanding can result in unpatched software, unsecured data, or weak access control.
Incorrect Options:
B. Improperly securing access to the cloud metastructure layer: This is a specific security flaw but not directly caused by misunderstanding the shared responsibility model.
C. Misconfiguration of access controls for cloud services: While common, this usually results from poor implementation rather than misunderstanding shared responsibility.
D. Vendor lock-in: This issue arises from contractual or technical dependencies, not from misunderstanding the shared responsibility model.
Exact Extract from CCOA Official Review Manual, 1st Edition:
Refer to Chapter 3, Section "Cloud Security Models," Subsection "Shared Responsibility Model" – Misunderstanding the shared responsibility model often leads to misplaced assumptions about who handles specific security tasks.
A
Explanation:
Misunderstanding the cloud service shared responsibility model often leads to the false assumption that the cloud service provider (CSP) is responsible for securing all aspects of the cloud environment.
What is the Shared Responsibility Model? It delineates the security responsibilities of the CSP and the customer.
Typical Misconception: Customers may believe that the provider handles all security aspects, including data protection and application security, while in reality, the customer is usually responsible for securing data and application configurations.
Impact: This misunderstanding can result in unpatched software, unsecured data, or weak access control.
Incorrect Options:
B. Improperly securing access to the cloud metastructure layer: This is a specific security flaw but not directly caused by misunderstanding the shared responsibility model.
C. Misconfiguration of access controls for cloud services: While common, this usually results from poor implementation rather than misunderstanding shared responsibility.
D. Vendor lock-in: This issue arises from contractual or technical dependencies, not from misunderstanding the shared responsibility model.
Exact Extract from CCOA Official Review Manual, 1st Edition:
Refer to Chapter 3, Section "Cloud Security Models," Subsection "Shared Responsibility Model" – Misunderstanding the shared responsibility model often leads to misplaced assumptions about who handles specific security tasks.
Question #89
168.1.100 SomeVulnName CVE-2021-22145 High
Step 6: Verify the Vulnerability
Click on the host IP to see the detailed vulnerability description.
Check for the following:
Exploitability: Proof that the vulnerability can be actively exploited.
Description and Impact: Details about the vulnerability and its potential impact.
Fixes/Recommendations: Suggested mitigations or patches.
Step 7: Note the Vulnerable Host IP
The IP address that appears in the filtered list is the vulnerable machine.
Example
Correct Answer: The host IP of the machine vulnerable to CVE-2021-22145 is: 192.168.1.100
Step 8: Take Immediate Actions
Isolate the affected machine to prevent exploitation.
Patch or update the software affected by CVE-2021-22145.
Perform a quick re-scan to ensure that the vulnerability has been mitigated.
Step 9: Generate a Report for Documentation
Export the filtered scan results as a PDF or HTML from the GVM.
Include:
Host IP
CVE ID
Severity and Risk Level
Remediation Steps
Background on CVE-2021-22145:
This CVE is related to a vulnerability in certain software, often associated with improper access control or authentication bypass.
Attackers can exploit this to gain unauthorized access or escalate privileges.
Step 8: Take Immediate Actions
Isolate the affected machine to prevent exploitation.
Patch or update the software affected by CVE-2021-22145.
Perform a quick re-scan to ensure that the vulnerability has been mitigated.
Step 9: Generate a Report for Documentation
Export the filtered scan results as a PDF or HTML from the GVM.
Include:
Host IP
CVE ID
Severity and Risk Level
Remediation Steps
Background on CVE-2021-22145:
This CVE is related to a vulnerability in certain software, often associated with improper access control or authentication bypass.
Attackers can exploit this to gain unauthorized access or escalate privileges.
Question #89
168.1.100 SomeVulnName CVE-2021-22145 High
Step 6: Verify the Vulnerability
Click on the host IP to see the detailed vulnerability description.
Check for the following:
Exploitability: Proof that the vulnerability can be actively exploited.
Description and Impact: Details about the vulnerability and its potential impact.
Fixes/Recommendations: Suggested mitigations or patches.
Step 7: Note the Vulnerable Host IP
The IP address that appears in the filtered list is the vulnerable machine.
Example
Correct Answer: The host IP of the machine vulnerable to CVE-2021-22145 is: 192.168.1.100
Step 8: Take Immediate Actions
Isolate the affected machine to prevent exploitation.
Patch or update the software affected by CVE-2021-22145.
Perform a quick re-scan to ensure that the vulnerability has been mitigated.
Step 9: Generate a Report for Documentation
Export the filtered scan results as a PDF or HTML from the GVM.
Include:
Host IP
CVE ID
Severity and Risk Level
Remediation Steps
Background on CVE-2021-22145:
This CVE is related to a vulnerability in certain software, often associated with improper access control or authentication bypass.
Attackers can exploit this to gain unauthorized access or escalate privileges.
Step 8: Take Immediate Actions
Isolate the affected machine to prevent exploitation.
Patch or update the software affected by CVE-2021-22145.
Perform a quick re-scan to ensure that the vulnerability has been mitigated.
Step 9: Generate a Report for Documentation
Export the filtered scan results as a PDF or HTML from the GVM.
Include:
Host IP
CVE ID
Severity and Risk Level
Remediation Steps
Background on CVE-2021-22145:
This CVE is related to a vulnerability in certain software, often associated with improper access control or authentication bypass.
Attackers can exploit this to gain unauthorized access or escalate privileges.