A company is deploying a new monitoring tool to detect network-based attacks. They have a mix of encrypted and unencrypted traffic. They need to be able to inspect the content of the unencrypted traffic and also analyze the metadata of the encrypted traffic. Which tool or combination of tools would best meet these requirements?

A packet capture (PCAP) tool that can capture all traffic.

A network traffic analysis (NTA) tool that can analyze flow data and metadata.

A web application firewall (WAF) that can decrypt and inspect all traffic.

A combination of a packet capture tool for deep inspection of unencrypted traffic and an NTA tool for metadata analysis of encrypted traffic.

An analyst is investigating a potential malware infection. The analyst has a PCAP file and notices that an internal host is sending a large number of TCP SYN packets to an external IP address on port 445 (SMB). The external IP is not responding. What does this pattern most likely indicate?

A data exfiltration attempt using SMB.

A port scan or a worm attempting to propagate.

Normal network traffic from a legitimate application.

A denial-of-service (DoS) attack against the external IP.

Which component is essential for a detection use case to be actionable?

A backup of the SIEM configuration

A list of all employees in the organization

A clear definition of the alert trigger conditions

A detailed network topology diagram

Which network traffic characteristic is most indicative of a command-and-control (C2) beacon?

Large file transfers during business hours

High volume of DNS queries to popular domains

Encrypted traffic to a well-known cloud provider

Regular, periodic communication to a single external IP

Certified Cybersecurity Operations Analyst

Domain 4Objective 1

Detection and Analysis CCOA Practice Questions (Page 5)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

8concepts

34%of the exam

Questions 21–25

21application · medium
A company is deploying a new monitoring tool to detect network-based attacks. They have a mix of encrypted and unencrypted traffic. They need to be able to inspect the content of the unencrypted traffic and also analyze the metadata of the encrypted traffic. Which tool or combination of tools would best meet these requirements?
Select an answer first
22application · medium
An analyst is investigating a potential malware infection. The analyst has a PCAP file and notices that an internal host is sending a large number of TCP SYN packets to an external IP address on port 445 (SMB). The external IP is not responding. What does this pattern most likely indicate?
Select an answer first
23foundation · easy
Which component is essential for a detection use case to be actionable?
Select an answer first
24foundation · easy
Which network traffic characteristic is most indicative of a command-and-control (C2) beacon?
Select an answer first
25foundation · easy
Which tool is commonly used for deep packet inspection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Detection and Analysis CCOA Practice Questions (Page 5)

Questions 21–25

An analyst is investigating a potential malware infection. The analyst has a PCAP file and notices that an internal host is sending a large number of TCP SYN packets to an external IP address on port 445 (SMB). The external IP is not responding. What does this pattern most likely indicate?

Which component is essential for a detection use case to be actionable?

Which network traffic characteristic is most indicative of a command-and-control (C2) beacon?

Which tool is commonly used for deep packet inspection?

Keep studying — Domain 4: Incident Detection and Response