A company is implementing a security program and wants to use a framework that provides a common language for communicating cybersecurity risk to executives and board members. The framework should be high-level and not prescriptive about specific technologies. Which framework best fits this need?

NIST Cybersecurity Framework (CSF)

A security architect is designing a defense-in-depth strategy for a new application. The architect must ensure that if one control fails, another will still protect the asset. The architect also needs to align this strategy with a recognized framework. Which combination of actions best implements defense-in-depth?

Implement network segmentation, host-based firewalls, and application-level authentication

Rely solely on a strong perimeter firewall

Deploy a single multifactor authentication solution for all users

Use encryption for data at rest and in transit only

A small business wants to harden its Windows workstations but lacks a dedicated security team. The IT administrator is looking for a practical, prioritized set of configuration recommendations from a recognized body. Which resource should the administrator consult?

The NIST Cybersecurity Framework

The CIS Benchmarks for Microsoft Windows

The ISO 27001 standard document

The PCI DSS requirements document

A government contractor handles controlled unclassified information (CUI) and must align its security controls with NIST SP 800-171. The contractor is implementing access controls for its systems. Which practice is most directly aligned with NIST SP 800-171 requirements?

Limiting system access to authorized users and processes

Allowing all employees access to all systems by default

Using a single shared administrative account for all administrators

Disabling audit logging to improve system performance

Certified Cybersecurity Operations Analyst

Domain 5Objective 4

Industry Best Practices, Guidance, Frameworks, and Standards CCOA Practice Questions (Page 4)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

4concepts

11%of the exam

Questions 16–20

16application · medium
A company is implementing a security program and wants to use a framework that provides a common language for communicating cybersecurity risk to executives and board members. The framework should be high-level and not prescriptive about specific technologies. Which framework best fits this need?
Select an answer first
17expert · hard
A security architect is designing a defense-in-depth strategy for a new application. The architect must ensure that if one control fails, another will still protect the asset. The architect also needs to align this strategy with a recognized framework. Which combination of actions best implements defense-in-depth?
Select an answer first
18foundation · easy
Which standard is specifically designed to provide a common set of security requirements for protecting cardholder data?
Select an answer first
19application · medium
A small business wants to harden its Windows workstations but lacks a dedicated security team. The IT administrator is looking for a practical, prioritized set of configuration recommendations from a recognized body. Which resource should the administrator consult?
Select an answer first
20application · medium
A government contractor handles controlled unclassified information (CUI) and must align its security controls with NIST SP 800-171. The contractor is implementing access controls for its systems. Which practice is most directly aligned with NIST SP 800-171 requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Industry Best Practices, Guidance, Frameworks, and Standards CCOA Practice Questions (Page 4)

Questions 16–20

A company is implementing a security program and wants to use a framework that provides a common language for communicating cybersecurity risk to executives and board members. The framework should be high-level and not prescriptive about specific technologies. Which framework best fits this need?

Which standard is specifically designed to provide a common set of security requirements for protecting cardholder data?

A small business wants to harden its Windows workstations but lacks a dedicated security team. The IT administrator is looking for a practical, prioritized set of configuration recommendations from a recognized body. Which resource should the administrator consult?

A government contractor handles controlled unclassified information (CUI) and must align its security controls with NIST SP 800-171. The contractor is implementing access controls for its systems. Which practice is most directly aligned with NIST SP 800-171 requirements?

Keep studying — Domain 5: Securing Assets