CCOA Incident Detection And Response Practice Question
You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Manual status update via Action menu
In Splunk Enterprise Security, the Notable Event workflow status is controlled by the 'Status' field mapping in the incident review dashboard, which relies on the analyst's manual intervention through the 'Action' menu to change the status value.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retention policy override
Why it's wrong here
Retention policies manage data aging, not workflow states.
- ✗
Real-time notable event aggregation
Why it's wrong here
Aggregation groups events but does not manage the specific analyst workflow state.
- ✗
Automated workflow action trigger
Why it's wrong here
This would immediately transition the status upon event creation.
- ✓
Manual status update via Action menu
Why this is correct
Manual status updates are required to transition from the default 'New' status.
About these practice questions
Courseiva writes every CCOA question from scratch — 203 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official ISACA exam blueprint
This CCOA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCOA exam.