Which of the following is a common delivery method for malicious payloads?

Exploiting a vulnerability in a web server

Phishing emails with malicious attachments

Establishing a command and control channel

Creating a backdoor for remote access

What is the main purpose of the exploitation stage in a cyber attack?

To deliver the malicious payload to the target

To establish persistence by installing malware

To trigger a vulnerability to gain initial access to the target system

To communicate with the compromised system remotely

Which of the following is a common technique used to establish command and control?

Creating a scheduled task for persistence

Using HTTP requests to a malicious server

Sending a phishing email with a malicious attachment

Scanning the network for open ports

A security team is responding to a ransomware attack. The team has identified that the attacker used a C2 channel to deploy the ransomware, which then encrypted files on the network. The team is now trying to determine the attacker's primary objective. Which stage of the cyber attack lifecycle is the attacker in, and what is the primary objective?

Installation, to establish persistence

Command and Control, to maintain communication

Actions on Objectives, to disrupt operations

Exploitation, to gain initial access

Certified Cybersecurity Operations Analyst

Domain 3Objective 5

Cyber Attack Stages CCOA Practice Questions (Page 3)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

10%of the exam

Questions 11–15

11foundation · easy
Which of the following is a common delivery method for malicious payloads?
Select an answer first
12foundation · easy
What is the main purpose of the exploitation stage in a cyber attack?
Select an answer first
13foundation · easy
Which of the following is a common technique used to establish command and control?
Select an answer first
14application · medium
A user receives a phishing email with a link to a malicious website. The user clicks the link, and the website exploits a vulnerability in the user's browser to execute code on the user's machine. In which stage of the cyber attack lifecycle is the attacker operating when the code executes?
Select an answer first
15expert · hard
A security team is responding to a ransomware attack. The team has identified that the attacker used a C2 channel to deploy the ransomware, which then encrypted files on the network. The team is now trying to determine the attacker's primary objective. Which stage of the cyber attack lifecycle is the attacker in, and what is the primary objective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Cyber Attack Stages CCOA Practice Questions (Page 3)

Questions 11–15

Which of the following is a common delivery method for malicious payloads?

What is the main purpose of the exploitation stage in a cyber attack?

Which of the following is a common technique used to establish command and control?

A user receives a phishing email with a link to a malicious website. The user clicks the link, and the website exploits a vulnerability in the user's browser to execute code on the user's machine. In which stage of the cyber attack lifecycle is the attacker operating when the code executes?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures