CCOA (ISACA) case studies
CCOA · Put your knowledge to work in context.
The Certified Cyber Operations Analyst (CCOA) is a vendor-neutral credential aimed at analysts who work a security operations center queue: triaging alerts, pivoting across network and host evidence, and writing up what happened in a form a responder or duty manager can act on. It suits tier-one and tier-two analysts, detection engineers who want investigation discipline, and incident responders moving from checklist work to independent analysis. The CCOA case studies are 5 cases and about 3,989 words.
1Five-Minute Beacon from a Branch VLAN
You are the tier-2 analyst in a 2,400-employee logistics company's SOC. Zeek and NetFlow feed the SIEM, and full packet capture is retained for only 72 hours.
852 words, about 4 min2Signed Binary, Unsigned Behaviour
A developer's Windows 10 laptop trips a Sysmon-based EDR rule. C: .exe opened a handle to lsass.exe with GrantedAccess 0x1410 - PROCESS VM READ plus full QUERY INFORMATION, broader than the 0x1010 that AV and backup scanners normally request.
640 words, about 3 min3Brute Force or Clock Drift?
You are tuning a Splunk ES correlation search called 'Brute Force Followed by Successful Logon'. It has fired 380 times in the last 20 minutes across three member servers: APP-03, SQL-02 and file server FS-01.
836 words, about 4 min4MFA Pushes at 22:10
At 22:10 on a Tuesday, the on-call analyst takes a call from the service desk: a finance manager, m.tanaka, says she received three MFA push notifications she did not initiate and approved none of them. Twenty minutes earlier an alert fired for a new inbox rule on her mailbox: 'move messages containing invoice, payment or remittance to RSS Feeds'.
844 words, about 4 min5Zero-Detection Document, Dead Domain
A sales user submits a .docm named 'Remittance Advice 4471.docm' after Word displayed a macro warning. VirusTotal reports 0/63 on the document hash.
817 words, about 4 min