Which external party might need to be coordinated with during a data breach incident?

The organization's social media followers

An incident involves a malware infection on a single workstation with no evidence of lateral movement. How should this be prioritized compared to a ransomware attack affecting the entire file server?

Both should be prioritized equally

The ransomware attack should be prioritized higher due to its larger impact

The workstation infection should be prioritized higher because it is easier to contain

The workstation infection should be prioritized higher because it was detected first

Which action is an example of implementing containment to stop the spread of an incident?

Notifying the public about the incident

Disabling a compromised user account

Deleting all logs from the affected system

A security analyst is documenting a security incident. The analyst needs to communicate the status to the company's management team. Which type of information is most important to include in the status update to management?

The technical details of the malware and the indicators of compromise.

The names of the attackers and their motivations.

The list of all affected systems and their IP addresses.

The current impact on business operations and the estimated time to resolution.

A security operations center receives multiple incident reports. Incident A: A phishing email has been sent to all employees, but no one has clicked the link. Incident B: A server has been infected with ransomware, and the backup system is also affected. Incident C: A user has reported a lost laptop that contains unencrypted sensitive data. The team has limited resources. Which incident should be handled first?

Incident B: The ransomware infection.

All incidents should be handled simultaneously.

Incident A: The phishing email.

Certified Cybersecurity Operations Analyst

Domain 4Objective 2

Incident Response and Handling CCOA Practice Questions (Page 4)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

34%of the exam

Questions 16–20

16foundation · easy
Which external party might need to be coordinated with during a data breach incident?
Select an answer first
17foundation · easy
An incident involves a malware infection on a single workstation with no evidence of lateral movement. How should this be prioritized compared to a ransomware attack affecting the entire file server?
Select an answer first
18foundation · easy
Which action is an example of implementing containment to stop the spread of an incident?
Select an answer first
19application · medium
A security analyst is documenting a security incident. The analyst needs to communicate the status to the company's management team. Which type of information is most important to include in the status update to management?
Select an answer first
20expert · hard
A security operations center receives multiple incident reports. Incident A: A phishing email has been sent to all employees, but no one has clicked the link. Incident B: A server has been infected with ransomware, and the backup system is also affected. Incident C: A user has reported a lost laptop that contains unencrypted sensitive data. The team has limited resources. Which incident should be handled first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.