ISACA · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?
The VM is isolated from the physical network.
The VM can only communicate with the host.
The VM uses the host's IP address.
The VM acts as a direct node on the physical network.
A bridged adapter places the virtual machine directly onto the physical network segment, giving it its own IP address and full visibility to other hosts. It bypasses the host's NAT isolation, so the VM becomes an independently reachable node subject to network attacks.
You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?
firewalld
systemctl status
yum check-update
AIDE
AIDE maintains a cryptographic hash database of file attributes, detecting unauthorised changes to system binaries on Red Hat Enterprise Linux. It satisfies the integrity verification requirement by comparing current hashes against the stored baseline, flagging any modification to monitored files.
You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?
Task Manager - Details tab
Local Security Policy (secpol.msc)
Advanced Security Settings - Effective Access
Effective Access on the Advanced Security Settings tab computes the resultant permissions a specified account holds on the executable, resolving group membership and deny entries, so you can confirm whether the service account lacks the required access.
Event Viewer - System Log
In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?
Protocol: TCP, Port: 443, Source: 10.0.1.0/24
Restricting the inbound rule to TCP port 443 with source 10.0.1.0/24 permits only HTTPS from that subnet. Narrowing the source CIDR is the security-relevant axis; 0.0.0.0/0 or omitting the port would expose the instance more broadly.
Protocol: UDP, Port: 443, Source: 10.0.1.0/24
Protocol: TCP, Port: 80, Source: 10.0.1.0/24
Protocol: All Traffic, Port: All, Source: 0.0.0.0/0
During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?
Verify the digital signature of the referenced executable.
Checking the digital signature of the executable referenced by the Run key reveals whether it is signed by a trusted publisher or tampered with. Unsigned or invalid signatures indicate likely malicious persistence, satisfying the need to distinguish legitimate from malicious entries.
Delete the registry key.
Reboot the server.
Rename the file to .txt.
Which protocol is most appropriate for secure remote management of network infrastructure devices?
SNMPv1
Telnet
SSH
SSH encrypts the entire management session, providing confidentiality and integrity for credentials and configuration commands in transit. Unlike Telnet, which sends data in cleartext, SSH satisfies the secure remote management requirement for infrastructure devices such as routers, switches and firewalls.
HTTP
Want more Technology Essentials practice?
Practice this domainYou are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?
Sysmon Event ID 11
Event ID 11 tracks FileCreate events, often associated with enumeration.
NetFlow
DHCP logs
Firewall logs
While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?
Discovery
Persistence
The Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run causes a program to execute automatically at user logon, establishing persistence so the adversary survives reboots. Modification of this key is a classic autostart technique, not credential access, exfiltration or lateral movement.
Execution
Privilege Escalation
You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?
Credential Access
Exfiltration
Lateral Movement
Lateral Movement fits because wsmprovhost.exe hosts PowerShell remoting sessions, and spawning cmd.exe from it indicates an attacker executing commands on a remote host via WinRM. This satisfies the stem's constraint: the parent process evidences remote execution rather than local privilege escalation or persistence.
Persistence
An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?
Impact
Deleting volume shadow copies destroys the victim's ability to recover encrypted or damaged data, which is the destructive outcome Impact tactics aim to achieve. Ransomware operators run vssadmin this way to prevent restoration, so the technique sits under Impact rather than Defence Evasion or Execution.
Credential Access
Defense Evasion
Initial Access
You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?
Network Isolation
Email filtering policies
Email filtering policies inspect inbound messages and attachments, blocking or quarantining malicious senders, links and payloads before delivery. This directly counters T1566 Phishing, which relies on email as the initial access vector, satisfying the requirement to prevent phishing reaching users.
Attack Surface Reduction (ASR) rules
Device Control
Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?
Installing a backdoor
Deleting logs to hide traces
Encrypting files for ransom
Running 'whoami' or 'net view'
Discovery covers techniques that enumerate systems, accounts, shares and network resources to build situational awareness. Running whoami identifies the current user context, while net view lists reachable hosts and shares, both mapping directly to ATT&CK's Discovery tactic.
Want more Adversarial Tactics practice?
Practice this domainDuring a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?
Risk avoidance
Risk mitigation
Risk acceptance
Acceptance means management acknowledges the residual risk and proceeds without patching, which matches their refusal driven by legacy dependencies. Unlike mitigation, transfer or avoidance, no control change occurs; the risk is formally retained and should be documented in the risk register with an owner.
Risk transfer
You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?
Implement TLS encryption
Implement logging and auditing
Implement cryptographic hashing/digital signatures
Cryptographic hashing and digital signatures provide integrity verification, directly countering Tampering by detecting any unauthorised modification of data in transit or at rest. This satisfies the design-phase constraint, where the threat targets data integrity rather than confidentiality or availability, making it the most effective control against that STRIDE category.
Implement Role-Based Access Control
You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?
Two-Factor Authentication
Hashing Algorithms
Digital Signatures
AES-256 Encryption
AES-256 is a symmetric block cipher that encrypts data in transit, rendering intercepted traffic unreadable without the key. It directly satisfies the confidentiality constraint by protecting sensitive data from unauthorised disclosure during transmission, unlike hashing or access controls which address different principles.
You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?
Access Control (AC)
Incident Response (IR)
The IR family covers incident handling, reporting and response activities, which is exactly what unauthorised data exfiltration triggers. It addresses detection, containment, eradication and recovery from security incidents, satisfying the stem's requirement for the control family governing exfiltration incidents.
Configuration Management (CM)
Risk Assessment (RA)
An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?
Packet sniffing on the wire
Replay attack
Unauthorized data modification
Distributed Denial of Service (DDoS) attack
A DDoS attack floods the database with traffic, exhausting resources so legitimate users cannot connect. This directly compromises availability, which concerns ensuring timely and reliable access to data for authorised users, rather than confidentiality or integrity.
A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?
Recover
Recover directly addresses resilience by restoring impaired capabilities after an incident, satisfying the stem's requirement for critical infrastructure continuity. Within the NIST Cybersecurity Framework, Recover supports timely recovery and service restoration, whereas Identify, Protect, Detect and Respond cover asset mapping, safeguards, monitoring and containment respectively.
Detect
Protect
Identify
Want more Cybersecurity Principles And Risk practice?
Practice this domainYou are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?
Computer Configuration > System Settings > Advanced > Security
Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
Password complexity is configured under Account Policies > Password Policy within Security Settings, reached via Computer Configuration > Policies > Windows Settings. This is the CIS Benchmark path where the 'Password must meet complexity requirements' setting is enforced for local accounts.
User Configuration > Preferences > Control Panel Settings > Local Users and Groups
Computer Configuration > Administrative Templates > Windows Components > Password
You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?
Use an IAM Group and add the EC2 instance to the group.
Create an IAM user with access keys and embed them in the application configuration file.
Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.
An IAM role attached to the instance profile supplies temporary credentials via instance metadata, and scoping the policy to the bucket ARN enforces least privilege. This satisfies the stem's constraint: the EC2 instance can only access that specific S3 bucket.
Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.
You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?
Check the 'nessuscli agent status' on the endpoint to verify the link state and connection to the manager.
Checking `nessuscli agent status` confirms whether the agent has successfully linked to its manager, since an unlinked or offline agent never reports plugin and asset data. This directly addresses the stem's constraint: endpoints absent from Asset Inventory despite installation, isolating link-state failure before investigating scanning or licensing.
Reinstall the Nessus Agent using the 'Force Install' flag.
Manually add the IP address of the endpoint to the 'Allowed Assets' list in Tenable.io.
Restart the Windows Management Instrumentation (WMI) service.
You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?
Power off the laptop immediately to preserve volatile memory.
Delete the user account associated with the laptop in Active Directory.
Use the 'Isolate Endpoint' feature in your EDR (e.g., CrowdStrike or Defender) to restrict network communication.
Endpoint isolation via the EDR console immediately severs the laptop's network communication while preserving the agent's management channel for investigation. This contains the active command-and-control traffic fastest, satisfying the stem's requirement for the most immediate containment action.
Physically disconnect the ethernet cable from the building patch panel.
You are configuring a Linux server and want to use 'iptables' to block all incoming traffic from a specific subnet (192.168.10.0/24). Which command is correct?
iptables -I OUTPUT -d 192.168.10.0/24 -j REJECT
iptables -A FORWARD -s 192.168.10.0/24 -j DROP
iptables -A INPUT -d 192.168.10.0/24 -j DROP
iptables -A INPUT -s 192.168.10.0/24 -j DROP
The -A INPUT appends a rule to the inbound chain, -s 192.168.10.0/24 matches the source subnet, and -j DROP discards matching packets. Together they block all incoming traffic from that subnet, satisfying the stated requirement.
During an audit, you need to classify assets based on their criticality. Which of the following is the best example of a 'High' classification for an asset?
A central database containing customer Personally Identifiable Information (PII) and credit card data.
A central database holding both PII and credit card data warrants 'High' criticality because compromise triggers regulatory breach notification, financial penalties and identity theft risk. Its confidentiality, integrity and availability requirements exceed those of internal or public assets, matching the highest classification tier.
A guest Wi-Fi access point used for public internet access.
A local printer used for departmental documents.
An internal employee breakroom display showing weather and news.
Want more Securing Assets practice?
Practice this domainWhich TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?
Re-image the compromised server immediately to restore service
Isolate the infected network segment to prevent lateral movement
Segment isolation cuts the network path ransomware or an intruder needs for lateral movement, satisfying the containment goal of stopping spread while forensic evidence is preserved. It is reversible and scoped, unlike full shutdown, so business continuity is maintained during investigation.
Shut down the entire corporate firewall
Notify the local police department
Disable compromised user accounts
Disabling the compromised account immediately revokes the attacker's authenticated access, blocking further mailbox, file or privilege abuse. This satisfies containment by removing the active credential vector while the account remains intact for later forensic review and password reset.
You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?
Throttle field
Notable event urgency
Time window
The time window restricts the lookback period to evaluate the threshold logic.
Risk score adjustment
You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?
Use the 'Top values' aggregation on the source IP field in a Lens visualization
Lens's 'Top values' aggregation groups documents by the source IP field and ranks them by count, directly returning the ten highest-volume addresses. Adding a time filter for the last hour and a destination filter satisfies both stem constraints, while Discover's raw document list cannot aggregate or rank unique values.
Run an 'Update By Query' API call
Use a regex filter in the search bar
Export all logs to CSV and use Excel
You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?
Host status dashboard
Network connections tab
Process Tree view
A Process Tree view renders parent-child relationships between processes, exposing which executable spawned the suspicious PowerShell instance. This directly satisfies the need to identify the parent process rather than merely listing isolated events or command lines.
Event search logs
You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?
Firewall denied logs
Physical access logs
SMTP gateway logs
Process creation logs (e.g., Sysmon Event ID 1)
LotL abuses legitimate signed binaries such as PowerShell or certutil, so command-line arguments and parent-child process relationships are the observable artefacts. Process creation logs capture these, whereas network or authentication logs lack the command-line context needed to distinguish malicious from benign execution.
During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?
Delete the analytic rule and recreate it with a higher threshold
Disable the alert in the Data Connector settings
Modify the analytic rule logic using a 'where' clause to exclude the account entity from a Watchlist
A Watchlist holds the noisy service account, and a 'where' clause in the rule query filters it out before alert generation. This preserves the rule's detection coverage for all other entities, satisfying the requirement to suppress false positives without disabling the analytic rule entirely.
Set the incident severity to 'Informational'
Want more Incident Detection And Response practice?
Practice this domainThe CCOA exam has 140 questions and must be completed in 240 minutes. The passing score is 450 (scaled 200–800). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Technology Essentials, Adversarial Tactics, Cybersecurity Principles And Risk, Securing Assets, Incident Detection And Response. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official ISACA CCOA exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.