Which of the following should be included in a malware analysis report to make it actionable?

The malware's source code if available

A list of all tools used during the analysis without any context

The analyst's personal recommendations for improving the malware's code

Indicators of compromise (IOCs) such as hashes, domains, and IP addresses

A malware analyst is analyzing a new ransomware sample. The analyst needs to identify the encryption algorithm used and extract the encryption key if possible. Which combination of tools is most appropriate for this task?

A network analyzer and a packet capture tool

A sandbox and a memory forensics tool

A hash calculator and a file comparison tool

A forensic analyst is examining a compromised Windows workstation. The investigation reveals that a malicious executable was downloaded from a suspicious URL and executed, creating a scheduled task that runs at logon. Which finding is the most direct indicator of persistence?

The user's report of slow performance

The download of the executable from a suspicious URL

The scheduled task that runs at logon

The execution of the executable

A malware analyst is examining a new, unknown binary. The analyst has limited time and needs to produce actionable IOCs quickly. The binary appears to be packed, and static analysis reveals little. Which approach is most efficient to obtain IOCs?

Run the binary in a sandbox and capture network traffic, file system, and registry changes.

Spend time manually unpacking the binary before performing static analysis.

Submit the binary to an online multi-scanner and wait for results.

Use a debugger to step through the unpacking routine.

Which tool is commonly used to extract indicators of compromise (IOCs) from a malware sample?

A vulnerability scanner like Nessus

A sandbox that reports the malware's behavior and network activity

A packet sniffer like Wireshark

Certified Cybersecurity Operations Analyst

Domain 4Objective 3

Forensic and Malware Analysis CCOA Practice Questions (Page 1)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

9concepts

34%of the exam

Questions 1–5

1foundation · easy
Which of the following should be included in a malware analysis report to make it actionable?
Select an answer first
2application · medium
A malware analyst is analyzing a new ransomware sample. The analyst needs to identify the encryption algorithm used and extract the encryption key if possible. Which combination of tools is most appropriate for this task?
Select an answer first
3application · medium
A forensic analyst is examining a compromised Windows workstation. The investigation reveals that a malicious executable was downloaded from a suspicious URL and executed, creating a scheduled task that runs at logon. Which finding is the most direct indicator of persistence?
Select an answer first
4expert · hard
A malware analyst is examining a new, unknown binary. The analyst has limited time and needs to produce actionable IOCs quickly. The binary appears to be packed, and static analysis reveals little. Which approach is most efficient to obtain IOCs?
Select an answer first
5foundation · easy
Which tool is commonly used to extract indicators of compromise (IOCs) from a malware sample?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.