A security analyst is documenting a security incident. The analyst needs to create a report that will be shared with the company's legal team. Which information is most important to include in the report?

The cost of the incident response efforts.

The technical specifications of the affected systems.

The timeline of the incident and the actions taken by the response team.

The names of the employees involved in the incident.

What should be included in an incident report to stakeholders?

Only the technical details of the malware

A summary of the incident, actions taken, and current status

The personal opinions of the analysts

The names of all employees involved

What is the primary purpose of maintaining a chain of custody for digital evidence?

To ensure the evidence is stored on the fastest available storage

To make the evidence available to all employees

To encrypt the evidence to prevent unauthorized access

To document the evidence's integrity and admissibility in legal proceedings

Why is it important to coordinate with management during an incident response?

To avoid following the incident response plan

To ensure they are aware of the incident and can make strategic decisions

To hide the incident from external parties

To ask them to perform technical analysis

Certified Cybersecurity Operations Analyst

Domain 4Objective 2

Incident Response and Handling CCOA Practice Questions (Page 5)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

34%of the exam

Questions 21–25

21application · medium
A security analyst is documenting a security incident. The analyst needs to create a report that will be shared with the company's legal team. Which information is most important to include in the report?
Select an answer first
22foundation · easy
What should be included in an incident report to stakeholders?
Select an answer first
23foundation · easy
What is the primary purpose of maintaining a chain of custody for digital evidence?
Select an answer first
24foundation · easy
Which phase of the incident handling lifecycle involves removing the root cause of the incident from the environment?
Select an answer first
25foundation · easy
Why is it important to coordinate with management during an incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.