An incident responder is handling a malware infection on a server that is part of a critical business application. The responder needs to contain the infection while preserving evidence for a forensic investigation. Which action should the responder take?

Disconnect the server from the network and leave it powered on.

Reimage the server from a known-good backup.

Run a malware removal tool on the server.

Power off the server to stop the malware from running.

Which factor is most important when prioritizing incidents for response?

The number of security tools available

The severity and impact of the incident

The time of day the incident occurred

The name of the analyst on duty

A security analyst detects a worm that is spreading across the internal network. The worm is exploiting a vulnerability in a legacy application that is used by the finance department. The analyst needs to contain the worm while minimizing disruption to the finance department's operations. Which containment strategy is most appropriate?

Shut down the legacy application server.

Apply a patch to the legacy application on all finance computers.

Segment the network to isolate the finance department from the rest of the network.

Disconnect all finance department computers from the network.

What is the purpose of the 'lessons learned' phase in the incident handling lifecycle?

To identify improvements for future incident response

To contain the incident quickly

A company's security team detects a possible insider threat. An employee with administrative privileges has been accessing sensitive files outside of normal working hours. The employee is a senior manager who is essential to a major project. The team must contain the threat while minimizing disruption to the project. Which containment action is most appropriate?

Monitor the employee's activities more closely and set up alerts for any further suspicious behavior.

Confront the employee and ask for an explanation.

Restrict the employee's access to only the files necessary for the project and increase logging.

Immediately revoke the employee's administrative privileges and disable their account.

Certified Cybersecurity Operations Analyst

Domain 4Objective 2

Incident Response and Handling CCOA Practice Questions (Page 2)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

34%of the exam

Questions 6–10

6application · medium
An incident responder is handling a malware infection on a server that is part of a critical business application. The responder needs to contain the infection while preserving evidence for a forensic investigation. Which action should the responder take?
Select an answer first
7foundation · easy
Which factor is most important when prioritizing incidents for response?
Select an answer first
8application · medium
A security analyst detects a worm that is spreading across the internal network. The worm is exploiting a vulnerability in a legacy application that is used by the finance department. The analyst needs to contain the worm while minimizing disruption to the finance department's operations. Which containment strategy is most appropriate?
Select an answer first
9foundation · easy
What is the purpose of the 'lessons learned' phase in the incident handling lifecycle?
Select an answer first
10expert · hard
A company's security team detects a possible insider threat. An employee with administrative privileges has been accessing sensitive files outside of normal working hours. The employee is a senior manager who is essential to a major project. The team must contain the threat while minimizing disruption to the project. Which containment action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Incident Response and Handling CCOA Practice Questions (Page 2)

Questions 6–10

An incident responder is handling a malware infection on a server that is part of a critical business application. The responder needs to contain the infection while preserving evidence for a forensic investigation. Which action should the responder take?

Which factor is most important when prioritizing incidents for response?

What is the purpose of the 'lessons learned' phase in the incident handling lifecycle?

Keep studying — Domain 4: Incident Detection and Response