In the full course
What you get
- 400 exam-style questions, each with a full explanation
- 20 performance-based tasks, marked with partial credit
- 200 flashcards, filtered by domain
- The full study guide, 24 chapters
- Timed mock exams matched to the real exam length
- A readiness score weighted by the official exam blueprint
Get full access to CCOA - Certified Cybersecurity Operations Analyst
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
More free samples
Marked, and passed
Real feedback from people who passed
“What I liked most was seeing my domain scores after each practice session. I knew exactly that I was weak on Access Control and could drill just that area. Passed CISA with a comfortable margin.”
“I failed my CISSP on the first attempt with another platform. Switched to CertCrush, focused on my weak domains using the tracking feature, and passed three months later. The explanations for wrong answers are genuinely useful, not just 'A is correct because A is correct'.”
“Honestly wasn't expecting much but this is probably the best ten bucks I've spent on exam prep. Did 20–30 questions every morning before work for 6 weeks. Passed with a comfortable margin. The timed exam mode is what really got me comfortable with the pressure.”
CCOA is ISACA's hands-on certification for security operations analysts, covering alert triage, threat detection, incident response and asset hardening. The four-hour exam mixes 115 multiple-choice questions with 25 performance-based tasks worked inside real tools. This course follows the five official domains at their published weights.
Practice content last updated · Independently written and aligned to ISACA’s published exam objectives.
About the CCOA - Certified Cybersecurity Operations Analyst Exam
The Certified Cybersecurity Operations Analyst (CCOA) is ISACA's first credential aimed at the people who sit at the SOC console rather than the audit desk. Where CISA, CISM and CRISC test governance and management, CCOA tests whether you can triage an alert, read a packet capture, follow an intrusion through logs and contain it. The exam runs four hours and carries 140 items: 115 multiple-choice questions and 25 performance-based tasks completed in a live environment with tools such as Wireshark and Security Onion. ISACA scores it on a scaled range of 200 to 800, and 450 passes. The weighting is where most candidates misjudge their revision. Incident Detection and Response alone is 34 percent of the paper, and Technology Essentials is another 25 percent, so those two domains are close to six items in every ten. Adversarial Tactics, Techniques, and Procedures, the domain that sounds hardest, is worth 10 percent. Candidates who pour their study time into MITRE ATT&CK matrices and skim networking fundamentals, log formats and command-line basics tend to run out of road in the technology section. CCOA suits analysts with roughly two to three years in a security operations role, and anyone weighing it against CompTIA CySA+ for the same jobs. It also suits people who already hold an ISACA certification and want a technical credential on the same CPE cycle. This course covers all five domains in the official proportions, so the practice you do reflects the paper you sit.
Exam Domains Covered
- Technology Essentials25%
- Cybersecurity Principles and Risk20%
- Adversarial Tactics, Techniques, and Procedures10%
- Incident Detection and Response34%
- Securing Assets11%
Exam Format & Details
140 items in four hours: 115 multiple-choice questions and 25 performance-based tasks worked in a live environment with open-source tooling. ISACA reports a scaled score from 200 to 800, and 450 is the pass mark. The voucher is $399 for ISACA members and $499 for non-members, booked through ISACA.
Why Practice Questions Matter
CCOA punishes shallow recall in a specific way: the performance-based tasks give you nothing to eliminate. You either know which Wireshark display filter isolates the traffic or you do not. Multiple-choice practice cannot replace lab time, but it closes the knowledge gaps the lab exposes, and it is the fastest way through Technology Essentials, which is a quarter of the paper and largely definitional. Working questions at the official domain weights also shows you where you are weak before exam day does, which matters on a four-hour paper you would rather not sit twice.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real CCOA - Certified Cybersecurity Operations Analyst exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the CCOA - Certified Cybersecurity Operations Analyst exam, not actual exam content.
Q1.Which Windows Security event ID should an analyst pivot to when asked to prove when a rogue account first appeared on a host?
- A.4624
- B.4688
- C.4720
- D.7045
Domain: Technology Essentials
Q2.Parsing /etc/passwd with awk -F: on the third field returns two names: root and backup-svc. What conclusion follows?
- A.backup-svc is an unprivileged service identity created by a package installer
- B.backup-svc is a second root account and must be investigated
- C.UID 0 is a reserved value that prevents the account from logging in
- D.backup-svc can only reach root privileges if it is also listed in the sudoers file
Domain: Technology Essentials
Q3.The same server is scanned twice in one afternoon. The uncredentialed scan returns 12 findings and the credentialed scan returns 140. What best explains the gap?
- A.The credentialed scan produced 128 false positives that the uncredentialed scan correctly avoided
- B.The credentialed scan logged in and read the installed packages, registry and configuration instead of inferring from banners
- C.The uncredentialed scan was configured with a lower cadence
- D.The host was patched between the two scans
Domain: Securing Assets
Q4.A standard requires disk encryption on all laptops, but a fleet of manufacturing terminals physically cannot support it and must stay in service. What is the correct handling?
- A.Leave the terminals as they are and note the gap informally within the team
- B.Raise a documented exception with the risk stated, a named owner and a review date, for the risk owner to decide
- C.Amend the standard to remove the encryption requirement so the estate is compliant
- D.Have the security manager approve the deviation and close the matter
Domain: Cybersecurity Principles and Risk
Q5.STIX and TAXII are frequently named together. Which description of each is correct?
- A.STIX is the transport protocol and TAXII is the description format
- B.STIX is the format for describing threat information and TAXII is the protocol that transports it
- C.STIX is an open-source sharing platform and TAXII is its database schema
- D.Both are commercial indicator feeds sold by threat intelligence vendors
Domain: Adversarial Tactics, Techniques, and Procedures
Q6.After an analyst closes a Follow TCP Stream window, Wireshark has written something into the filter bar. What is it, and why is it useful?
- A.tcp.stream eq N, which re-selects every packet belonging to that one conversation
- B.An ip.addr filter for both endpoints, which is equivalent to selecting the stream
- C.A frame contains filter built from the first readable string in the stream
- D.Nothing, because Wireshark clears the filter bar when the follow window closes
Domain: Incident Detection and Response
Q7.Staff at a manufacturer sign in to their employer's identity system and are then admitted to a parts supplier's web application without creating an account there. Which description fits this arrangement?
- A.Federation, with the manufacturer acting as identity provider and the supplier as service provider
- B.Single sign-on within one organisation's own application estate
- C.Credential synchronisation, which copies each password into the supplier's directory
- D.A shared service account held jointly by both organisations
Domain: Securing Assets
Q8.Which Windows security event ID records the installation of a new service?
- A.4624
- B.4688
- C.7045
- D.1102
Domain: Incident Detection and Response
Q9.An executable was downloaded over unencrypted HTTP and the whole transfer is present in the capture. Which action recovers the file itself so it can be hashed and recorded?
- A.File then Export Objects then HTTP, then select the listed object and save it
- B.File then Export Specified Packets
- C.Statistics then Endpoints
- D.Analyze then Expert Information
Domain: Incident Detection and Response
Q10.A workstation is confirmed compromised and is still powered on and connected. Following the fixed containment order, what do you do first?
- A.Capture the contents of memory
- B.Cut the host off the network before touching anything
- C.Power the host down and image the disk
- D.Reboot the host into safe mode to stop the malware running
Domain: Incident Detection and Response
CCOA - Certified Cybersecurity Operations Analyst guides & exam news
ISACA CCOA Explained: Exam Domains, Cost and Is It Worth It in 2026?
ISACA's CCOA is a new hands-on cert for SOC analysts, built around performance-based questions and open-source tools. Here is what the exam covers, what it costs, how it compares to CySA+, and whether it is worth taking in 2026.
ISACA CISA Practice Questions: 25 Exam-Style Examples With Answers and Explanations (2026)
Twenty-five CISA practice questions written to the real domain weightings, with the reasoning behind every answer. Covers all five job practice domains, plus the exam format, pass mark and the auditor mindset ISACA actually tests.
ISACA Cybersecurity Fundamentals Is Being Retired: What Replaces It and Should You Buy It Before 1 December 2026?
ISACA stops selling the Cybersecurity Fundamentals Certificate on 1 December 2026 and sunsets the programme on 1 June 2027. Here is what happens to the certificate you already hold, what the CCS replacement looks like, and whether buying the exam now is worth it.
Frequently Asked Questions
Does the CCOA - Certified Cybersecurity Operations Analyst course include performance-based questions?
Yes. The CCOA - Certified Cybersecurity Operations Analyst course includes 20 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free CCOA - Certified Cybersecurity Operations Analyst sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full CCOA - Certified Cybersecurity Operations Analyst course?
The full CCOA - Certified Cybersecurity Operations Analyst course includes 400 practice questions and 20 performance-based tasks, covering all 5 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official ISACA exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by ISACA.
Which domains does the CCOA - Certified Cybersecurity Operations Analyst course cover?
The course covers 5 exam domains: Technology Essentials, Cybersecurity Principles and Risk, Adversarial Tactics, Techniques, and Procedures, Incident Detection and Response, Securing Assets.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.
Start with 10 free questions
No account, no card. The full CCOA - Certified Cybersecurity Operations Analyst course is $9.99, once.