Which activity is characteristic of a penetration test but NOT of a vulnerability assessment?

Generating a report that lists vulnerabilities by severity

Enumerating software versions on target systems

Scanning network ports to identify open services

Attempting to exploit a discovered vulnerability to gain access

Which element is typically included in a penetration testing report to help the organization prioritize remediation efforts?

The exact steps to reproduce the test for future audits

The tester's personal recommendations for new security tools

A list of all employees' passwords discovered during the test

A risk rating for each identified vulnerability

Certified Cybersecurity Operations Analyst

Domain 3Objective 7

Penetration Testing CCOA Practice Questions (Page 5)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

10%of the exam

Questions 21–25

21application · medium
A company wants to assess the security of its network by simulating a real-world attack. The goal is to identify vulnerabilities and demonstrate their impact. Which type of assessment is MOST appropriate?
Select an answer first
22application · medium
A security team is planning a penetration test of a web application. The team wants to follow a methodology that focuses specifically on web application security and is widely recognized in the industry. Which methodology should the team choose?
Select an answer first
23foundation · easy
Which activity is characteristic of a penetration test but NOT of a vulnerability assessment?
Select an answer first
24foundation · easy
Which element is typically included in a penetration testing report to help the organization prioritize remediation efforts?
Select an answer first
25foundation · easy
Which tool is a framework commonly used to execute exploits against a target system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Penetration Testing CCOA Practice Questions (Page 5)

Questions 21–25

A company wants to assess the security of its network by simulating a real-world attack. The goal is to identify vulnerabilities and demonstrate their impact. Which type of assessment is MOST appropriate?

A security team is planning a penetration test of a web application. The team wants to follow a methodology that focuses specifically on web application security and is widely recognized in the industry. Which methodology should the team choose?

Which activity is characteristic of a penetration test but NOT of a vulnerability assessment?

Which element is typically included in a penetration testing report to help the organization prioritize remediation efforts?

Which tool is a framework commonly used to execute exploits against a target system?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures