What is the main purpose of a malware analysis report?

To provide actionable information for incident response and mitigation

To provide a detailed history of the malware's development

To document the analyst's personal opinions about the malware

To serve as a marketing document for the security team

An incident response team is investigating a breach where an attacker exfiltrated data. The team has collected memory dumps, disk images, and network logs. They need to determine the root cause and the full scope of the exfiltration. Which analysis approach is most effective?

Examine only the disk images for deleted files.

Correlate findings from memory, disk, and network logs to reconstruct the attack timeline and identify all affected systems.

Analyze only the memory dumps for malware artifacts.

Focus only on the network logs to identify the exfiltration destination.

What is the primary function of a debugger in malware analysis?

To automatically detect and remove malware from a system

To step through the malware's code to understand its logic and behavior

To hash the malware file for identification

To decompile the malware into readable source code

A malware analyst has completed dynamic analysis of a trojan. The analyst must now write a report for the SOC team. Which information is most critical for the SOC to contain the threat?

The programming language used to write the malware

The analyst's recommendation to update antivirus definitions

The C2 server IP addresses and domains observed during analysis

The malware's file size and compilation timestamp

Certified Cybersecurity Operations Analyst

Domain 4Objective 3

Forensic and Malware Analysis CCOA Practice Questions (Page 2)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

9concepts

34%of the exam

Questions 6–10

6foundation · easy
What is the main purpose of a malware analysis report?
Select an answer first
7expert · hard
An incident response team is investigating a breach where an attacker exfiltrated data. The team has collected memory dumps, disk images, and network logs. They need to determine the root cause and the full scope of the exfiltration. Which analysis approach is most effective?
Select an answer first
8application · easy
A malware analyst is performing static analysis on a suspicious executable. The analyst wants to extract readable strings that might reveal URLs, file paths, or commands embedded in the binary. Which tool is most appropriate for this task?
Select an answer first
9foundation · easy
What is the primary function of a debugger in malware analysis?
Select an answer first
10application · medium
A malware analyst has completed dynamic analysis of a trojan. The analyst must now write a report for the SOC team. Which information is most critical for the SOC to contain the threat?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.