An analyst is using OSINT to track a threat actor's activities. They find a paste site containing what appears to be a list of compromised credentials from their organization. What is the most appropriate immediate action?

Verify the credentials against internal systems and force password resets for affected accounts.

Ignore the paste because paste sites are often hoaxes.

Immediately lock all user accounts to prevent unauthorized access.

Post a response on the paste site to discredit the information.

A financial services company wants to share and receive threat intelligence about fraud campaigns targeting the banking sector. They are considering joining an industry-specific Information Sharing and Analysis Center (ISAC). What is the primary benefit of joining this ISAC?

Access to a vetted community of peers sharing sector-specific threat intelligence.

A free replacement for all commercial threat intelligence feeds.

Guaranteed immunity from legal liability when sharing breach data.

Direct access to classified government intelligence not available elsewhere.

An organization wants to improve its threat detection by using internal sources. They have a SIEM that collects logs from firewalls, servers, and endpoints. Which practice best utilizes these internal sources for threat intelligence?

Export all logs to an external vendor for analysis, since internal analysis is too complex.

Rely solely on the SIEM's default correlation rules, as they are comprehensive.

Use logs only for compliance reporting, not for threat detection.

Create custom detection rules based on observed attacker behaviors in the logs.

An analyst is assessing a threat intelligence source that claims to provide early warnings of zero-day exploits. The source has been accurate in the past, but its recent reports have been delayed and sometimes vague. The analyst needs to decide whether to rely on this source for a critical vulnerability assessment. What should they do?

Rely on the source because of its past accuracy.

Use the source as a secondary reference and corroborate with other sources.

Ignore the source's reports and rely on internal analysis only.

Stop using the source entirely because of recent performance.

A security team is building a threat intelligence dashboard. They want to include sources that provide both strategic and operational value. Which set of sources would be most appropriate?

Internal logs and network telemetry only

Government alerts, ISACs, and internal incident reports

Social media and public forums only

Commercial feeds and OSINT only

Certified Cybersecurity Operations Analyst

Domain 3Objective 3

Threat Intelligence Sources CCOA Practice Questions (Page 1)

Part of the Domain 3: Adversarial Tactics, Techniques, and Procedures domain, which accounts for 10% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

10%of the exam

Questions 1–5

1application · medium
An analyst is using OSINT to track a threat actor's activities. They find a paste site containing what appears to be a list of compromised credentials from their organization. What is the most appropriate immediate action?
Select an answer first
2application · medium
A financial services company wants to share and receive threat intelligence about fraud campaigns targeting the banking sector. They are considering joining an industry-specific Information Sharing and Analysis Center (ISAC). What is the primary benefit of joining this ISAC?
Select an answer first
3application · medium
An organization wants to improve its threat detection by using internal sources. They have a SIEM that collects logs from firewalls, servers, and endpoints. Which practice best utilizes these internal sources for threat intelligence?
Select an answer first
4expert · hard
An analyst is assessing a threat intelligence source that claims to provide early warnings of zero-day exploits. The source has been accurate in the past, but its recent reports have been delayed and sometimes vague. The analyst needs to decide whether to rely on this source for a critical vulnerability assessment. What should they do?
Select an answer first
5application · medium
A security team is building a threat intelligence dashboard. They want to include sources that provide both strategic and operational value. Which set of sources would be most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.