A penetration tester has completed an assessment and is writing the final report. The client has requested that the report include a clear roadmap for remediation, prioritizing the most critical vulnerabilities. Which approach is BEST for prioritizing remediation?

Prioritize based on the order in which vulnerabilities were discovered

Prioritize based on the ease of exploitation

Prioritize based on CVSS scores only

Prioritize based on a combination of CVSS score and business impact

A penetration tester has completed passive reconnaissance and identified a web application that uses a specific content management system (CMS). The tester wants to identify known vulnerabilities in the CMS version. Which tool or technique is MOST appropriate for this task?

Searching the CVE database for the CMS version

Using a password brute-forcing tool

Nmap with service version detection

A penetration testing team has completed an assessment and is preparing the final report. The client's management wants a high-level summary of the overall security posture, while the IT team needs detailed technical steps to remediate each finding. Which report structure BEST satisfies both audiences?

A verbal presentation without a written report

A technical report with only the exploit details

A single report with an executive summary and a technical appendix

Which penetration testing methodology is specifically focused on web application security and is widely used for testing web applications?

OSSTMM (Open Source Security Testing Methodology Manual)

PTES (Penetration Testing Execution Standard)

OWASP (Open Web Application Security Project)

Certified Cybersecurity Operations Analyst

Domain 3Objective 7

Penetration Testing CCOA Practice Questions (Page 4)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

10%of the exam

Questions 16–20

16expert · hard
A penetration tester has completed an assessment and is writing the final report. The client has requested that the report include a clear roadmap for remediation, prioritizing the most critical vulnerabilities. Which approach is BEST for prioritizing remediation?
Select an answer first
17application · medium
A penetration tester has completed passive reconnaissance and identified a web application that uses a specific content management system (CMS). The tester wants to identify known vulnerabilities in the CMS version. Which tool or technique is MOST appropriate for this task?
Select an answer first
18application · medium
A penetration tester is performing active reconnaissance on a target web server. The tester wants to identify the web server software and its version. Which technique is MOST appropriate?
Select an answer first
19expert · hard
A penetration testing team has completed an assessment and is preparing the final report. The client's management wants a high-level summary of the overall security posture, while the IT team needs detailed technical steps to remediate each finding. Which report structure BEST satisfies both audiences?
Select an answer first
20foundation · easy
Which penetration testing methodology is specifically focused on web application security and is widely used for testing web applications?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Penetration Testing CCOA Practice Questions (Page 4)

Questions 16–20

A penetration tester has completed an assessment and is writing the final report. The client has requested that the report include a clear roadmap for remediation, prioritizing the most critical vulnerabilities. Which approach is BEST for prioritizing remediation?

A penetration tester has completed passive reconnaissance and identified a web application that uses a specific content management system (CMS). The tester wants to identify known vulnerabilities in the CMS version. Which tool or technique is MOST appropriate for this task?

A penetration tester is performing active reconnaissance on a target web server. The tester wants to identify the web server software and its version. Which technique is MOST appropriate?

Which penetration testing methodology is specifically focused on web application security and is widely used for testing web applications?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures