A malware analyst needs to observe the behavior of a suspicious executable in a safe environment. The analyst wants to see what files it creates, what registry keys it modifies, and what network connections it makes. Which approach is most appropriate?

Use a debugger to step through the code without executing it.

Run the executable in a sandbox with monitoring tools and a simulated network.

Run the executable on a production server to see its real impact.

Disassemble the executable and read the assembly code.

During an incident response, an analyst must collect forensic data from a compromised Linux server. The server is still running, and the analyst needs to preserve evidence in a forensically sound manner. Which approach is most appropriate?

Copy the most relevant log files and configuration files to a USB drive.

Power off the server immediately and then remove the hard drive for imaging.

Run a full antivirus scan and then create a compressed archive of the entire filesystem.

Use a trusted live response tool to collect memory and system state, then create a forensic image of the disk.

Why is a sandbox environment used for dynamic malware analysis?

To automatically delete the malware after analysis

To speed up the analysis process by using multiple CPUs

To safely execute the malware and observe its behavior without risking the production environment

To allow the malware to access the internet freely

A forensic analyst has completed the examination of a data breach and must write a report that may be used in legal proceedings. Which practice is most important for the report to be legally defensible?

Summarize the findings without detailing the methods used.

Include personal opinions about the attacker's likely motives.

Document the chain of custody and the tools used during the investigation.

Use technical jargon to demonstrate expertise.

Certified Cybersecurity Operations Analyst

Domain 4Objective 3

Forensic and Malware Analysis CCOA Practice Questions (Page 5)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

9concepts

34%of the exam

Questions 21–24

21application · medium
A malware analyst needs to observe the behavior of a suspicious executable in a safe environment. The analyst wants to see what files it creates, what registry keys it modifies, and what network connections it makes. Which approach is most appropriate?
Select an answer first
22application · medium
During an incident response, an analyst must collect forensic data from a compromised Linux server. The server is still running, and the analyst needs to preserve evidence in a forensically sound manner. Which approach is most appropriate?
Select an answer first
23foundation · easy
Why is a sandbox environment used for dynamic malware analysis?
Select an answer first
24application · medium
A forensic analyst has completed the examination of a data breach and must write a report that may be used in legal proceedings. Which practice is most important for the report to be legally defensible?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.