ISACA · Exam reference
About the CCOA - Certified Cybersecurity Operations Analyst exam
CCOA is ISACA's hands-on certification for security operations analysts, covering alert triage, threat detection, incident response and asset hardening. The four-hour exam mixes 115 multiple-choice questions with 25 performance-based tasks worked inside real tools. This course follows the five official domains at their published weights.
10
Sample questions
240 min
Exam time limit
70%
Practice pass mark
$399
Exam voucher
The Certified Cybersecurity Operations Analyst (CCOA) is ISACA's first credential aimed at the people who sit at the SOC console rather than the audit desk. Where CISA, CISM and CRISC test governance and management, CCOA tests whether you can triage an alert, read a packet capture, follow an intrusion through logs and contain it. The exam runs four hours and carries 140 items: 115 multiple-choice questions and 25 performance-based tasks completed in a live environment with tools such as Wireshark and Security Onion. ISACA scores it on a scaled range of 200 to 800, and 450 passes. The weighting is where most candidates misjudge their revision. Incident Detection and Response alone is 34 percent of the paper, and Technology Essentials is another 25 percent, so those two domains are close to six items in every ten. Adversarial Tactics, Techniques, and Procedures, the domain that sounds hardest, is worth 10 percent. Candidates who pour their study time into MITRE ATT&CK matrices and skim networking fundamentals, log formats and command-line basics tend to run out of road in the technology section. CCOA suits analysts with roughly two to three years in a security operations role, and anyone weighing it against CompTIA CySA+ for the same jobs. It also suits people who already hold an ISACA certification and want a technical credential on the same CPE cycle. This course covers all five domains in the official proportions, so the practice you do reflects the paper you sit.
Exam Domains Covered
Exam Format & Details
140 items in four hours: 115 multiple-choice questions and 25 performance-based tasks worked in a live environment with open-source tooling. ISACA reports a scaled score from 200 to 800, and 450 is the pass mark. The voucher is $399 for ISACA members and $499 for non-members, booked through ISACA.
Why Practice Questions Matter
CCOA punishes shallow recall in a specific way: the performance-based tasks give you nothing to eliminate. You either know which Wireshark display filter isolates the traffic or you do not. Multiple-choice practice cannot replace lab time, but it closes the knowledge gaps the lab exposes, and it is the fastest way through Technology Essentials, which is a quarter of the paper and largely definitional. Working questions at the official domain weights also shows you where you are weak before exam day does, which matters on a four-hour paper you would rather not sit twice.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the CCOA - Certified Cybersecurity Operations Analyst exam — not actual exam content.
Q1.Which Windows Security event ID should an analyst pivot to when asked to prove when a rogue account first appeared on a host?
- A.4624
- B.4688
- C.4720
- D.7045
Domain: Technology Essentials
Q2.Parsing /etc/passwd with awk -F: on the third field returns two names: root and backup-svc. What conclusion follows?
- A.backup-svc is an unprivileged service identity created by a package installer
- B.backup-svc is a second root account and must be investigated
- C.UID 0 is a reserved value that prevents the account from logging in
- D.backup-svc can only reach root privileges if it is also listed in the sudoers file
Domain: Technology Essentials
Q3.The same server is scanned twice in one afternoon. The uncredentialed scan returns 12 findings and the credentialed scan returns 140. What best explains the gap?
- A.The credentialed scan produced 128 false positives that the uncredentialed scan correctly avoided
- B.The credentialed scan logged in and read the installed packages, registry and configuration instead of inferring from banners
- C.The uncredentialed scan was configured with a lower cadence
- D.The host was patched between the two scans
Domain: Securing Assets
Q4.A standard requires disk encryption on all laptops, but a fleet of manufacturing terminals physically cannot support it and must stay in service. What is the correct handling?
- A.Leave the terminals as they are and note the gap informally within the team
- B.Raise a documented exception with the risk stated, a named owner and a review date, for the risk owner to decide
- C.Amend the standard to remove the encryption requirement so the estate is compliant
- D.Have the security manager approve the deviation and close the matter
Domain: Cybersecurity Principles and Risk
Q5.STIX and TAXII are frequently named together. Which description of each is correct?
- A.STIX is the transport protocol and TAXII is the description format
- B.STIX is the format for describing threat information and TAXII is the protocol that transports it
- C.STIX is an open-source sharing platform and TAXII is its database schema
- D.Both are commercial indicator feeds sold by threat intelligence vendors
Domain: Adversarial Tactics, Techniques, and Procedures
Frequently Asked Questions
What is included in the free CCOA - Certified Cybersecurity Operations Analyst sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full CCOA - Certified Cybersecurity Operations Analyst course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the CCOA - Certified Cybersecurity Operations Analyst course page.
Are these official ISACA exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by ISACA.
Which domains does the CCOA - Certified Cybersecurity Operations Analyst course cover?
The course covers 5 exam domains: Technology Essentials, Cybersecurity Principles and Risk, Adversarial Tactics, Techniques, and Procedures, Incident Detection and Response, Securing Assets.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.