CCOA (ISACA) study guide

CCOA · Work through your exam, one topic at a time.

The Certified Cyber Operations Analyst (CCOA) is a vendor-neutral credential aimed at analysts who work a security operations center queue: triaging alerts, pivoting across network and host evidence, and writing up what happened in a form a responder or duty manager can act on. It suits tier-one and tier-two analysts, detection engineers who want investigation discipline, and incident responders moving from checklist work to independent analysis. The CCOA study guide has 7 sections and about 2,968 words.

Network Traffic Analysis and Detection

This domain tests whether you can move from raw packets and flow records to a defensible detection statement. Expect PCAP triage, flow-record pivoting, IDS alert validation, and protocol-level anomaly recognition.

468 words, about 2 min 02

Endpoint and Host-Based Investigation

This domain tests reconstruction of host activity from Windows event logs, Sysmon, EDR telemetry, and filesystem artifacts, and knowing which source answers which question. 4688 process creation (command line only if "Include command line in process creation events" audit policy is enabled).

445 words, about 2 min 03

Security Log Analysis and SIEM Correlation

This domain tests normalization discipline, correlation logic design, and the detection-engineering judgment to know when a rule is firing correctly versus firing loudly. Parsing and normalization map vendor fields to a common schema (ECS, CEF, LEEF) so that src ip means the same thing everywhere.

428 words, about 2 min 04

Threat Intelligence and Indicator Enrichment

This domain tests whether you can turn a raw indicator into an actionable, time-bounded decision - and know when an indicator is too low-fidelity to act on. Hash (prefer SHA-256; MD5 collisions make it weak for identification), IP, domain, URL, JA3/JA3S fingerprint, YARA rule, and TTP-level descriptions mapped to MITRE ATT&CK.

416 words, about 2 min 05

Incident Response Triage and Escalation

This domain tests the judgment to size an incident quickly, decide containment, preserve evidence in the right order, and escalate with a clear rationale. Severity is the product of business impact, confidence in the detection, and scope (hosts, accounts, data).

405 words, about 2 min 06

Malware Behavior and Artifact Analysis

This domain tests structured static and dynamic analysis: forming hypotheses from file structure, confirming them with behavior, and turning both into detection content. Identify the true file type by magic bytes, never by extension.

385 words, about 2 min 07

Cyber Operations Reporting and Documentation

This domain tests whether your findings survive scrutiny: whether each statement is tied to evidence, labeled with a confidence level, and written for the audience that will act on it. Executive summary first: business impact in plain language, one paragraph, no jargon.

421 words, about 2 min