In the incident response process, what is the primary goal of the containment phase?

To limit the damage and prevent further spread of the incident

To restore systems to normal operation

To collect evidence for legal proceedings

To identify the root cause of the incident

A company has confirmed that a malware infection has spread to several workstations. The incident response team needs to stop the spread and remove the malware. Which incident response phase should they perform next?

Lessons learned, by documenting what happened and how to improve

Eradication, by deleting the malware files from the workstations

Containment, by isolating the affected workstations from the network

Recovery, by restoring the workstations from backups

Which endpoint security technique focuses on detecting and responding to advanced threats by continuously monitoring endpoint activity?

Endpoint Detection and Response (EDR)

A security analyst notices unusual outbound traffic from a workstation to an external IP address at 3:00 AM. The analyst needs to determine if this is a security incident. Which monitoring and auditing technique should the analyst use first?

Search the external IP address on threat intelligence websites

Run a full antivirus scan on the workstation

Immediately disconnect the workstation from the network to contain the potential threat

Review the workstation's event logs and the network firewall logs for the time of the traffic

Certified Cybersecurity Operations Analyst

Domain 5Objective 2

Controls and Techniques CCOA Practice Questions (Page 3)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

11%of the exam

Questions 11–15

11foundation · easy
Which technology creates a secure, encrypted tunnel over an untrusted network?
Select an answer first
12foundation · easy
In the incident response process, what is the primary goal of the containment phase?
Select an answer first
13application · medium
A company has confirmed that a malware infection has spread to several workstations. The incident response team needs to stop the spread and remove the malware. Which incident response phase should they perform next?
Select an answer first
14foundation · easy
Which endpoint security technique focuses on detecting and responding to advanced threats by continuously monitoring endpoint activity?
Select an answer first
15application · medium
A security analyst notices unusual outbound traffic from a workstation to an external IP address at 3:00 AM. The analyst needs to determine if this is a security incident. Which monitoring and auditing technique should the analyst use first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.