A security analyst is trying to attribute a series of attacks to a specific group. The attacks share TTPs with a known group, but the malware used is a new variant. The C2 infrastructure is different from previous attacks. Which approach is most appropriate for attribution?

Attribute the attacks to the known group based on TTP similarity alone.

Refuse to attribute the attacks because attribution is impossible.

Conclude that the attacks are from a new, unknown group.

Use a combination of TTPs, malware analysis, and infrastructure data to assess attribution with moderate confidence.

Certified Cybersecurity Operations Analyst

Domain 3Objective 2

Threat Actors / Agents CCOA Practice Questions (Page 5)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

10%of the exam

Questions 21–23

21foundation · medium
Which threat actor category is most likely to be motivated by political or social causes and typically targets organizations to promote a specific agenda?
Select an answer first
22application · medium
A regional utility company discovers a sophisticated malware implant in its industrial control system network. The implant uses a custom, previously unknown backdoor and communicates with command-and-control servers using encrypted, non-standard protocols. The company has no known political or ideological adversaries. Which threat actor type is most likely responsible?
Select an answer first
23expert · hard
A security analyst is trying to attribute a series of attacks to a specific group. The attacks share TTPs with a known group, but the malware used is a new variant. The C2 infrastructure is different from previous attacks. Which approach is most appropriate for attribution?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Threat Actors / Agents CCOA Practice Questions (Page 5)

Questions 21–23

Which threat actor category is most likely to be motivated by political or social causes and typically targets organizations to promote a specific agenda?

A security analyst is trying to attribute a series of attacks to a specific group. The attacks share TTPs with a known group, but the malware used is a new variant. The C2 infrastructure is different from previous attacks. Which approach is most appropriate for attribution?

Keep studying — Domain 3: Adversarial Tactics, Techniques, and Procedures