A security analyst is called to a workstation where a user reports unusual pop-ups and slow performance. The analyst suspects malware and needs to preserve evidence for potential legal action. Which action should the analyst take FIRST?

Run an antivirus scan to identify and remove the malware immediately.

Reboot the system to clear any temporary malicious processes.

Capture a memory dump and record the system time and date.

Disconnect the workstation from the network to prevent further spread.

A forensic investigator is handling a case involving a terminated employee. The employee's laptop has been collected, but the employee's lawyer claims the laptop was accessed by IT staff before the investigation, potentially altering evidence. Which action is most important to address this claim?

Ignore the claim because the laptop is company property.

Rely on the employee's password to prove no tampering occurred.

Wipe the laptop to remove any potential tampering.

Document all access to the laptop, including by IT staff, and include this in the chain of custody.

What type of information is typically observed during dynamic malware analysis?

The compiler used to build the malware

Network connections made by the malware

The strings embedded in the binary

What is the primary purpose of maintaining a chain of custody during a digital forensic investigation?

To encrypt all collected evidence so that only authorized investigators can access it

To prioritize which evidence should be collected first based on volatility

To ensure that the forensic examiner is certified and qualified to perform the analysis

To document every person who handled the evidence and ensure the evidence's integrity is preserved for legal proceedings

A malware analyst receives a suspicious binary from an incident. The analyst needs to quickly determine if the file is known malware and identify its family without executing it. Which approach is most appropriate?

Run the binary in a sandbox and observe its network traffic.

Submit the file to an online multi-scanner for a second opinion.

Compute the file's hash and compare it against known malware databases.

Disassemble the binary and analyze its assembly code.

Certified Cybersecurity Operations Analyst

Domain 4Objective 3

Forensic and Malware Analysis CCOA Practice Questions (Page 4)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

9concepts

34%of the exam

Questions 16–20

16application · medium
A security analyst is called to a workstation where a user reports unusual pop-ups and slow performance. The analyst suspects malware and needs to preserve evidence for potential legal action. Which action should the analyst take FIRST?
Select an answer first
17expert · hard
A forensic investigator is handling a case involving a terminated employee. The employee's laptop has been collected, but the employee's lawyer claims the laptop was accessed by IT staff before the investigation, potentially altering evidence. Which action is most important to address this claim?
Select an answer first
18foundation · easy
What type of information is typically observed during dynamic malware analysis?
Select an answer first
19foundation · easy
What is the primary purpose of maintaining a chain of custody during a digital forensic investigation?
Select an answer first
20application · medium
A malware analyst receives a suspicious binary from an incident. The analyst needs to quickly determine if the file is known malware and identify its family without executing it. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.