A penetration tester has completed an assessment and is writing the final report. The report must help the client prioritize remediation efforts based on the severity of each finding. Which element is MOST important to include for each vulnerability?

A risk rating based on CVSS and business impact

The number of hours spent on testing

The tester's personal recommendations

What is the purpose of privilege escalation in post-exploitation?

To gain higher-level permissions on the compromised system

To remove all traces of the attack from logs

To scan the network for additional vulnerabilities

To hide the attacker's presence from the system

A penetration tester has gained access to a domain controller in a client's network. The tester's objective is to simulate a data breach by accessing sensitive files on a file server. The tester wants to move from the domain controller to the file server without being detected. Which post-exploitation technique should the tester use?

Data exfiltration from the domain controller

Persistence by installing a backdoor

Privilege escalation on the domain controller

Lateral movement using Pass-the-Hash

Certified Cybersecurity Operations Analyst

Domain 3Objective 7

Penetration Testing CCOA Practice Questions (Page 1)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

10%of the exam

Questions 1–5

1application · medium
A penetration tester is performing active reconnaissance on a target network. The tester wants to identify open ports and services running on a specific host. Which tool is BEST suited for this task?
Select an answer first
2application · medium
A penetration tester has completed an assessment and is writing the final report. The report must help the client prioritize remediation efforts based on the severity of each finding. Which element is MOST important to include for each vulnerability?
Select an answer first
3foundation · easy
Which post-exploitation activity involves moving from one compromised system to another within the network?
Select an answer first
4foundation · easy
What is the purpose of privilege escalation in post-exploitation?
Select an answer first
5expert · hard
A penetration tester has gained access to a domain controller in a client's network. The tester's objective is to simulate a data breach by accessing sensitive files on a file server. The tester wants to move from the domain controller to the file server without being detected. Which post-exploitation technique should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Penetration Testing CCOA Practice Questions (Page 1)

Questions 1–5

A penetration tester is performing active reconnaissance on a target network. The tester wants to identify open ports and services running on a specific host. Which tool is BEST suited for this task?

A penetration tester has completed an assessment and is writing the final report. The report must help the client prioritize remediation efforts based on the severity of each finding. Which element is MOST important to include for each vulnerability?

Which post-exploitation activity involves moving from one compromised system to another within the network?

What is the purpose of privilege escalation in post-exploitation?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures