How should I use these Adversarial Tactics practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Adversarial Tactics questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Adversarial Tactics domain.

CCOA · topic practice

Adversarial Tactics practice questions

Practise ISACA Certified Cybersecurity Operations Analyst (CCOA) (CCOA) Adversarial Tactics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Adversarial Tactics

Practice 10 questions Browse domain →

What the exam tests

What to know about Adversarial Tactics

Adversarial Tactics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Adversarial Tactics exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Adversarial Tactics questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Adversarial Tactics explanation →

An adversary performs a 'Pass-the-Hash' attack. Which tactic does this primarily fall under?

Trap 1: Initial Access

This usually occurs after Initial Access.

Trap 2: Exfiltration

It does not involve moving data out.

Trap 3: Persistence

It is an active movement technique, not a long-term maintenance technique.

Study all Adversarial Tactics common traps →

A
Initial Access
Why wrong: This usually occurs after Initial Access.
B
Exfiltration
Why wrong: It does not involve moving data out.
C
Credential Access
Pass-the-Hash is a classic Credential Access technique.
D
Credential Access
PtH is a method to leverage stolen hashes to gain unauthorized access.
E
Persistence
Why wrong: It is an active movement technique, not a long-term maintenance technique.

Adversarial Tactics practice questions

What to know about Adversarial Tactics

Common Adversarial Tactics exam traps

Adversarial Tactics questions

An adversary performs a 'Pass-the-Hash' attack. Which tactic does this primarily fall under?

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

What is the purpose of 'T1027 Obfuscated Files or Information'?

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

What is the primary difference between a Red Team and a Blue Team in a security simulation?

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

What is the primary goal of the 'Command and Control' (C2) tactic?

Which of these is a typical 'Lateral Movement' technique?

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

What is the primary function of a 'C2 Beacon'?

Track your progress over time

Start a Adversarial Tactics only practice session

Related CCOA topic practice pages

Cybersecurity Principles And Risk practice questions

Incident Detection And Response practice questions

Securing Assets practice questions

Technology Essentials practice questions

Adversarial Tactics practice questions

CCOA fundamentals practice questions

CCOA scenario practice questions

CCOA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid