A forensic analyst is investigating a ransomware attack. The analyst has a memory dump and a disk image from the affected system. The analyst needs to determine the encryption key used by the ransomware to potentially recover files. Which analysis technique is most likely to reveal the key?

Review the system's event logs for user activity.

Examine the network logs for C2 communication.

Analyze the disk image for deleted files.

Search the memory dump for the encryption key or related artifacts.

A forensic report is being prepared for a case that will go to court. The defense attorney has questioned the integrity of the evidence, claiming the analyst may have altered the disk during the investigation. Which measure would best support the evidence's integrity?

Include the analyst's personal notes about the investigation.

Explain that the analysis was performed on a copy of the evidence.

State that the analyst is certified and experienced.

Provide a detailed chain of custody and cryptographic hashes of all evidence before and after analysis.

A forensic investigator is called to a server that was compromised. The server is critical to business operations and cannot be taken offline for more than a few minutes. The investigator must preserve evidence while minimizing downtime. Which approach best balances evidence preservation and operational continuity?

Skip volatile data collection and only take a full disk image during the next scheduled maintenance.

Copy the entire disk using a hot-swap RAID controller while the server remains online.

Perform live acquisition of volatile data and a logical copy of critical files, then schedule a full disk image during a maintenance window.

Immediately power off the server and remove the hard drive for imaging.

A malware analyst is performing static analysis on a suspicious executable and wants to identify the compiler or packer used. Which tool or technique is most appropriate?

Check the file's hash against a malware database.

Examine the file's PE headers and import table.

Run the executable in a sandbox and observe its behavior.

Use a network analyzer to capture its traffic.

Certified Cybersecurity Operations Analyst

Domain 4Objective 3

Forensic and Malware Analysis CCOA Practice Questions (Page 3)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

9concepts

34%of the exam

Questions 11–15

11expert · hard
A forensic analyst is investigating a ransomware attack. The analyst has a memory dump and a disk image from the affected system. The analyst needs to determine the encryption key used by the ransomware to potentially recover files. Which analysis technique is most likely to reveal the key?
Select an answer first
12expert · hard
A forensic report is being prepared for a case that will go to court. The defense attorney has questioned the integrity of the evidence, claiming the analyst may have altered the disk during the investigation. Which measure would best support the evidence's integrity?
Select an answer first
13expert · hard
A forensic investigator is called to a server that was compromised. The server is critical to business operations and cannot be taken offline for more than a few minutes. The investigator must preserve evidence while minimizing downtime. Which approach best balances evidence preservation and operational continuity?
Select an answer first
14application · medium
A malware analyst is analyzing a document that contains a malicious macro. The analyst wants to extract the macro code without opening the document in a word processor. Which tool is most appropriate?
Select an answer first
15application · medium
A malware analyst is performing static analysis on a suspicious executable and wants to identify the compiler or packer used. Which tool or technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Forensic and Malware Analysis CCOA Practice Questions (Page 3)

Questions 11–15

A forensic analyst is investigating a ransomware attack. The analyst has a memory dump and a disk image from the affected system. The analyst needs to determine the encryption key used by the ransomware to potentially recover files. Which analysis technique is most likely to reveal the key?

A forensic report is being prepared for a case that will go to court. The defense attorney has questioned the integrity of the evidence, claiming the analyst may have altered the disk during the investigation. Which measure would best support the evidence's integrity?

A malware analyst is analyzing a document that contains a malicious macro. The analyst wants to extract the macro code without opening the document in a word processor. Which tool is most appropriate?

A malware analyst is performing static analysis on a suspicious executable and wants to identify the compiler or packer used. Which tool or technique is most appropriate?

Keep studying — Domain 4: Incident Detection and Response