In a Man-in-the-Middle (MitM) attack, what is the attacker's primary action?

Exploiting a vulnerability in a web application to execute malicious code

Intercepting and potentially altering communications between two parties

Flooding a network with traffic to cause a denial of service

Sending fraudulent emails to trick users into revealing credentials

A company's website is under a DDoS attack that is overwhelming their on-premises infrastructure. The company needs to maintain availability for customers while the attack is ongoing. Which solution is most effective?

Use a cloud-based DDoS protection service that can absorb and filter attack traffic

Increase the bandwidth of the on-premises internet connection

Block all incoming traffic from the attack's source IPs

Shut down the website until the attack stops

A company's HR department receives an email that appears to be from the CEO, asking for W-2 forms of all employees. The email is sent to a single HR manager and uses the CEO's actual email address (not a lookalike). The HR manager is suspicious because the CEO usually communicates via phone. Which social engineering attack is this, and what is the best response?

Whaling; immediately comply with the CEO's request

Spear phishing; verify the request through a different communication channel before sending any data

Phishing; delete the email without further action

Vishing; call the CEO to confirm

Certified Cybersecurity Operations Analyst

Domain 3Objective 4

Attack Types CCOA Practice Questions (Page 6)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

10%of the exam

Questions 26–30

26application · medium
An employee accidentally sends a spreadsheet containing customer PII to an external recipient instead of an internal colleague. The employee did not intend any harm. Which type of insider threat is this?
Select an answer first
27foundation · easy
In a Man-in-the-Middle (MitM) attack, what is the attacker's primary action?
Select an answer first
28application · medium
A company's website becomes unresponsive during a product launch. The security team finds that a single IP address is sending a massive number of TCP SYN packets to the web server, overwhelming its connection queue. Which type of attack is this?
Select an answer first
29expert · hard
A company's website is under a DDoS attack that is overwhelming their on-premises infrastructure. The company needs to maintain availability for customers while the attack is ongoing. Which solution is most effective?
Select an answer first
30expert · hard
A company's HR department receives an email that appears to be from the CEO, asking for W-2 forms of all employees. The email is sent to a single HR manager and uses the CEO's actual email address (not a lookalike). The HR manager is suspicious because the CEO usually communicates via phone. Which social engineering attack is this, and what is the best response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Attack Types CCOA Practice Questions (Page 6)

Questions 26–30

An employee accidentally sends a spreadsheet containing customer PII to an external recipient instead of an internal colleague. The employee did not intend any harm. Which type of insider threat is this?

In a Man-in-the-Middle (MitM) attack, what is the attacker's primary action?

A company's website becomes unresponsive during a product launch. The security team finds that a single IP address is sending a massive number of TCP SYN packets to the web server, overwhelming its connection queue. Which type of attack is this?

A company's website is under a DDoS attack that is overwhelming their on-premises infrastructure. The company needs to maintain availability for customers while the attack is ongoing. Which solution is most effective?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures