20+ practice questions focused on Adversarial Tactics — one of the most tested topics on the ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Adversarial Tactics PracticeIn the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?
Explanation: T1059 focuses on the interpretation of code (PowerShell, Bash), while T1204 focuses on the user-driven triggering of the malicious file.
You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?
Explanation: Process hollowing involves creating a legitimate process in a suspended state, unmapping its original code, and writing malicious code into its memory space before resuming it. The WriteProcessMemory API call to a remote process is the key indicator: it is used to inject the payload into the hollowed process's address space. Detecting WriteProcessMemory targeting another process's memory — especially combined with CreateProcess in a suspended state and ResumeThread — is a strong signal of process hollowing.
An adversary performs a 'Pass-the-Hash' attack. Which tactic does this primarily fall under?
Explanation: Pass-the-Hash is used to authenticate as a user without needing the original password, serving the goal of Credential Access.
During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?
Explanation: WMIC is often used for remote execution and discovery in Windows environments.
Which TWO of the following are considered 'Defense Evasion' techniques?
Explanation: Masquerading (A) is a Defense Evasion technique because an adversary manipulates, names, or renames legitimate system tools, files, or processes to make malicious activity appear benign, thereby bypassing security controls and evading detection. Indicator removal on host (D), such as clearing Windows Event Logs (e.g., wevtutil cl) or deleting files, is also Defense Evasion because it erases forensic artifacts that defenders and monitoring tools rely on to detect intrusions. Account manipulation (B) belongs to the Persistence tactic (creating or modifying accounts to maintain access), not Defense Evasion. Data staging (C) is part of the Collection tactic, where data is gathered and consolidated prior to exfiltration. Remote service creation (E) is a Persistence/Execution technique (e.g., creating a service via sc.exe or PsExec) used to run code, not primarily to evade defenses.
+15 more Adversarial Tactics questions available
Practice all Adversarial Tactics questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Adversarial Tactics. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Adversarial Tactics questions on the CCOA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Adversarial Tactics is tested as part of the ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) blueprint. Practicing with targeted Adversarial Tactics questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CCOA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Adversarial Tactics is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Adversarial Tactics practice session with instant scoring and detailed explanations.
Start Adversarial Tactics Practice →