A manufacturing company has a set of legacy workstations that run a custom application. The application is not compatible with the latest operating system, and the vendor no longer provides patches. Which endpoint security technique would most effectively protect these workstations from malware while maintaining the application's functionality?

Patch management that installs the latest updates from the vendor

Application whitelisting that allows only the custom application and its required processes to run

Antivirus software with the latest signature updates

Endpoint detection and response (EDR) that monitors for suspicious behavior

A company is implementing a new policy to protect customer data. The policy must specify who can access the data and under what conditions. Which type of administrative control should the company document?

A monitoring procedure that outlines how to review access logs

An access control policy that defines roles, permissions, and approval processes for accessing customer data

An encryption standard that specifies the algorithm to use for data at rest

A firewall rule that restricts network access to the customer database

Certified Cybersecurity Operations Analyst

Domain 5Objective 2

Controls and Techniques CCOA Practice Questions (Page 5)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

11%of the exam

Questions 21–25

21foundation · easy
Which document provides detailed, step-by-step instructions for performing a specific security task?
Select an answer first
22application · medium
A company wants to implement a security control to ensure that employees read and acknowledge the acceptable use policy before accessing the network. Which type of security control is this?
Select an answer first
23application · medium
A manufacturing company has a set of legacy workstations that run a custom application. The application is not compatible with the latest operating system, and the vendor no longer provides patches. Which endpoint security technique would most effectively protect these workstations from malware while maintaining the application's functionality?
Select an answer first
24application · medium
A company is implementing a new policy to protect customer data. The policy must specify who can access the data and under what conditions. Which type of administrative control should the company document?
Select an answer first
25foundation · easy
A company needs to verify that a downloaded file has not been altered. Which technique should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Controls and Techniques CCOA Practice Questions (Page 5)

Questions 21–25

Which document provides detailed, step-by-step instructions for performing a specific security task?

A company wants to implement a security control to ensure that employees read and acknowledge the acceptable use policy before accessing the network. Which type of security control is this?

A company is implementing a new policy to protect customer data. The policy must specify who can access the data and under what conditions. Which type of administrative control should the company document?

A company needs to verify that a downloaded file has not been altered. Which technique should be used?

Keep studying — Domain 5: Securing Assets