A security team is implementing the CIS Controls. The team has limited resources and must decide which controls to implement first. The team wants to follow the intent of the CIS Controls' implementation groups. Which approach is most aligned with the CIS guidance?

Implement controls randomly based on team preference

Start with IG3 controls because they are the most advanced

Implement all controls in Implementation Group 1 (IG1) before moving to IG2 and IG3

Implement only the controls that are easiest to configure

A financial services firm is developing a new customer portal. The security team is asked to ensure that the development process follows industry-recognized practices for secure coding. Which approach best aligns with established best practices?

Rely on the development team to manually review code before each release

Integrate static application security testing (SAST) into the CI/CD pipeline

Perform a single penetration test after the application is deployed to production

Disable error messages in production to prevent information leakage

A retail company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The security team is reviewing its network segmentation strategy. Which requirement is a direct PCI DSS control?

Deploying a honeypot to attract attackers

Implementing a zero-trust architecture across the entire enterprise

Conducting annual employee security awareness training

Implementing a firewall between the cardholder data environment and other networks

A company is expanding into a new market and must comply with a local data protection law that is more stringent than its current obligations. The security team must update its asset protection strategy. Which action is the most appropriate first step?

Conduct a gap analysis between the current controls and the new legal requirements

Immediately implement the most restrictive security controls available

Apply the same controls used in the company's home country without review

Ignore the new law until the company is formally notified of a violation

Certified Cybersecurity Operations Analyst

Domain 5Objective 4

Industry Best Practices, Guidance, Frameworks, and Standards CCOA Practice Questions (Page 5)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

4concepts

11%of the exam

Questions 21–25

21expert · hard
A security team is implementing the CIS Controls. The team has limited resources and must decide which controls to implement first. The team wants to follow the intent of the CIS Controls' implementation groups. Which approach is most aligned with the CIS guidance?
Select an answer first
22application · medium
A financial services firm is developing a new customer portal. The security team is asked to ensure that the development process follows industry-recognized practices for secure coding. Which approach best aligns with established best practices?
Select an answer first
23application · medium
A retail company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The security team is reviewing its network segmentation strategy. Which requirement is a direct PCI DSS control?
Select an answer first
24application · medium
A multinational corporation wants to demonstrate to customers that its information security management system meets an internationally recognized standard. The company is prepared to undergo an external audit and achieve formal certification. Which standard should the company pursue?
Select an answer first
25expert · hard
A company is expanding into a new market and must comply with a local data protection law that is more stringent than its current obligations. The security team must update its asset protection strategy. Which action is the most appropriate first step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.