What is the primary purpose of the reporting phase in a penetration test?

To clean up all traces of the test from the target systems

To document findings and provide actionable remediation recommendations

To exploit any remaining vulnerabilities

To obtain legal authorization for the test

A security analyst is asked to assess the effectiveness of the organization's patch management process. The goal is to identify which systems are missing critical patches and to produce a prioritized list for remediation. The analyst is NOT authorized to attempt exploitation. Which type of assessment should the analyst perform?

Vulnerability scan using an automated scanner

Penetration test following the PTES methodology

Which activity is an example of ACTIVE reconnaissance?

Checking the target's DNS records using a public DNS lookup service

Sending ICMP echo requests to the target's network to map live hosts

Searching for the target's domain registration records in WHOIS

Reviewing the target's job postings to identify technology stack

Certified Cybersecurity Operations Analyst

Domain 3Objective 7

Penetration Testing CCOA Practice Questions (Page 2)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

10%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of the reporting phase in a penetration test?
Select an answer first
7application · medium
During a penetration test, a tester discovers a web application that is vulnerable to SQL injection. The tester wants to demonstrate the impact by extracting data from the database. Which tool is specifically designed for this purpose?
Select an answer first
8application · medium
A security analyst is asked to assess the effectiveness of the organization's patch management process. The goal is to identify which systems are missing critical patches and to produce a prioritized list for remediation. The analyst is NOT authorized to attempt exploitation. Which type of assessment should the analyst perform?
Select an answer first
9foundation · easy
Which activity is an example of ACTIVE reconnaissance?
Select an answer first
10foundation · easy
Which technique is used to identify a specific vulnerability in a web application by sending crafted input to see how the application responds?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Penetration Testing CCOA Practice Questions (Page 2)

Questions 6–10

What is the primary purpose of the reporting phase in a penetration test?

During a penetration test, a tester discovers a web application that is vulnerable to SQL injection. The tester wants to demonstrate the impact by extracting data from the database. Which tool is specifically designed for this purpose?

Which activity is an example of ACTIVE reconnaissance?

Which technique is used to identify a specific vulnerability in a web application by sending crafted input to see how the application responds?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures