During a penetration test, an analyst successfully exploits a vulnerability in a web server and gains a low-privileged shell. The analyst's next step is to use a local vulnerability to gain root access on the same host. Which post-exploitation action is the analyst performing, and which exploit category does this action fall under?

Persistence; client-side exploit.

Privilege escalation; local exploit.

Lateral movement; remote exploit.

Exfiltration; denial-of-service exploit.

A security administrator is configuring a new endpoint protection policy. The administrator wants to ensure that if a user opens a malicious PDF that exploits a vulnerability in the PDF reader, the malware cannot access other parts of the operating system or user files. Which mitigation technique is designed to contain the impact of a client-side exploit?

Running the PDF reader in a sandbox

Applying the latest patches to the PDF reader

What is the most accurate definition of an exploit in the context of cybersecurity?

A weakness in a system that could be accidentally triggered by normal user activity.

A security control that prevents unauthorized access to a system.

A type of malware that replicates itself across networks without any user interaction.

A piece of code or technique that takes advantage of a vulnerability to cause unintended behavior in a system.

A security analyst at a financial firm notices that multiple employees in the accounting department have received emails containing a PDF attachment. The emails appear to come from the CEO and urge the recipients to review an urgent invoice. The analyst suspects the PDF contains an exploit. Which classification best describes this exploit delivery method, and what is the most effective immediate control to reduce the risk to other employees?

Local exploit delivered via drive-by download; disable JavaScript in the browser.

Client-side exploit delivered via phishing; implement email gateway filtering and user awareness training.

Remote exploit delivered via direct network exploitation; block the sender's IP address at the firewall.

Denial-of-service exploit delivered via phishing; increase email server bandwidth.

Which mitigation technique randomizes memory addresses to make it harder for an attacker to predict the location of code or data?

DEP (Data Execution Prevention)

ASLR (Address Space Layout Randomization)

Certified Cybersecurity Operations Analyst

Domain 3Objective 6

Exploit Techniques CCOA Practice Questions (Page 3)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

6concepts

10%of the exam

Questions 11–15

11application · medium
During a penetration test, an analyst successfully exploits a vulnerability in a web server and gains a low-privileged shell. The analyst's next step is to use a local vulnerability to gain root access on the same host. Which post-exploitation action is the analyst performing, and which exploit category does this action fall under?
Select an answer first
12application · medium
A security administrator is configuring a new endpoint protection policy. The administrator wants to ensure that if a user opens a malicious PDF that exploits a vulnerability in the PDF reader, the malware cannot access other parts of the operating system or user files. Which mitigation technique is designed to contain the impact of a client-side exploit?
Select an answer first
13foundation · easy
What is the most accurate definition of an exploit in the context of cybersecurity?
Select an answer first
14application · medium
A security analyst at a financial firm notices that multiple employees in the accounting department have received emails containing a PDF attachment. The emails appear to come from the CEO and urge the recipients to review an urgent invoice. The analyst suspects the PDF contains an exploit. Which classification best describes this exploit delivery method, and what is the most effective immediate control to reduce the risk to other employees?
Select an answer first
15foundation · easy
Which mitigation technique randomizes memory addresses to make it harder for an attacker to predict the location of code or data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Exploit Techniques CCOA Practice Questions (Page 3)

Questions 11–15

What is the most accurate definition of an exploit in the context of cybersecurity?

Which mitigation technique randomizes memory addresses to make it harder for an attacker to predict the location of code or data?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures