A security team observes that a known cybercriminal group has started using cloud-based infrastructure and AI-generated phishing emails. Previously, the group used traditional malware and manual phishing. Which trend does this illustrate?

Decrease in threat actor sophistication

Increase in hacktivist activity

Evolution of threat actor tactics and techniques

Shift from cybercriminal to nation-state actors

A security team observes a rise in attacks where threat actors use legitimate cloud services for command-and-control and data exfiltration. This is a shift from traditional dedicated malware infrastructure. Which trend does this represent?

Use of legitimate services to evade detection

Decrease in threat actor sophistication

Shift from cybercriminal to nation-state actors

Increase in hacktivist activity

A security team is investigating a breach and finds malware that is a modified version of a known open-source tool. The attack targeted a specific industry and used a unique encryption key. The team is trying to attribute the attack. Which factor is most important for attribution?

The use of a modified open-source tool

The combination of all available evidence, including TTPs, infrastructure, and victimology

The targeting of a specific industry

Certified Cybersecurity Operations Analyst

Domain 3Objective 2

Threat Actors / Agents CCOA Practice Questions (Page 2)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

10%of the exam

Questions 6–10

6application · medium
A security team observes that a known cybercriminal group has started using cloud-based infrastructure and AI-generated phishing emails. Previously, the group used traditional malware and manual phishing. Which trend does this illustrate?
Select an answer first
7application · medium
A security team observes a rise in attacks where threat actors use legitimate cloud services for command-and-control and data exfiltration. This is a shift from traditional dedicated malware infrastructure. Which trend does this represent?
Select an answer first
8expert · hard
A security team is investigating a breach and finds malware that is a modified version of a known open-source tool. The attack targeted a specific industry and used a unique encryption key. The team is trying to attribute the attack. Which factor is most important for attribution?
Select an answer first
9foundation · medium
Which type of threat actor is most commonly associated with using readily available tools and techniques to launch attacks primarily for personal notoriety or to prove a point, often without deep technical expertise?
Select an answer first
10foundation · medium
Which threat actor category typically possesses the highest level of technical capability and resources, often including zero-day exploits and advanced persistent threat (APT) techniques?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Threat Actors / Agents CCOA Practice Questions (Page 2)

Questions 6–10

A security team observes that a known cybercriminal group has started using cloud-based infrastructure and AI-generated phishing emails. Previously, the group used traditional malware and manual phishing. Which trend does this illustrate?

A security team observes a rise in attacks where threat actors use legitimate cloud services for command-and-control and data exfiltration. This is a shift from traditional dedicated malware infrastructure. Which trend does this represent?

A security team is investigating a breach and finds malware that is a modified version of a known open-source tool. The attack targeted a specific industry and used a unique encryption key. The team is trying to attribute the attack. Which factor is most important for attribution?

Which type of threat actor is most commonly associated with using readily available tools and techniques to launch attacks primarily for personal notoriety or to prove a point, often without deep technical expertise?

Which threat actor category typically possesses the highest level of technical capability and resources, often including zero-day exploits and advanced persistent threat (APT) techniques?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures