CCOA is the ISACA Certified Cybersecurity Operations Analyst, and it is the least ISACA-looking exam ISACA has ever published. The organisation built its name on audit and governance credentials that are answered from a chair. This one hands you open source tools and asks you to use them. Twenty-five of its 140 questions are performance based, which means the answer is something you produce rather than something you pick. That single design choice changes who the cybersecurity operations analyst certification suits, how long preparation takes, and what a pass actually signals to a hiring manager. It also explains the weighting: more than a third of the paper sits in incident detection and response, the work a security operations centre does on an ordinary Tuesday. This article walks through the five domains and what each really tests, the true cost, the scaled pass mark, how CCOA differs from CISA and CISM, and a preparation sequence built around where the marks actually are.
What Is the Cybersecurity Operations Analyst Certification?
CCOA is ISACA’s technical credential for people who detect and respond to attacks rather than audit the controls that were meant to prevent them. It covers five domains: technology essentials, cybersecurity principles and risk, adversarial tactics, incident detection and response, and securing assets. The exam runs 140 questions across 240 minutes and is scored out of 800.
ISACA launched it in 2025, and the timing matters. The organisation already owned the governance end of the market through CISA and CISM. What it did not have was a credential that spoke to the analyst watching a queue of alerts. CCOA is that credential, and its content outline reads far more like a job description than an audit programme.
The practical consequence is that a candidate who has only read about security operations will struggle. Roughly a fifth of the paper cannot be answered from memory at all, because it is not asking what a tool does. It is asking what the output means.
Why Do 25 of the 140 Questions Need Real Tools?
Because ISACA split the paper deliberately. Of the 140 questions, 115 are traditional multiple choice and 25 are performance based, and the performance-based items expect working proficiency with open source security tooling. You are given an environment and a question, and the answer comes from what you find in it rather than from what you remember.
“This program is a hybrid exam that assesses a candidate’s knowledge and skills using a blend of traditional multiple-choice and performance-based questions requiring proficiency using a number of open source tools.”
That description is worth reading twice, because most candidates misjudge it in the same direction. They assume performance based means a simulation with a friendly interface. It does not. It means a terminal, a capture file, a log set, or a scan result, and a question that only makes sense once you have interrogated them.
What that means for your preparation time
Reading a study guide moves the multiple-choice score. It barely moves the other 25 questions. Those need hours in front of a packet capture, a Linux command line, and a log aggregator, doing the small unglamorous work of filtering, sorting, and correlating until it is fast.
There is a scheduling consequence too. Four hours sounds generous against 140 questions, and it is, right up until a performance-based item swallows twelve minutes. Candidates who pace themselves purely on question count run out of time in the last hour. Practising against a realistic set of CCOA practice questions is the cheapest way to find out where your own pace breaks down.
How Are the Five CCOA Domains Weighted?
The five CCOA domains are weighted 25, 20, 10, 34 and 11 percent. Incident Detection and Response is the largest at 34 percent, Technology Essentials follows at 25 percent, and Adversarial Tactics is the smallest at 10 percent. Two domains therefore carry 59 percent of the paper between them, which should drive how study time is allocated.
| Domain | Weight | What it examines |
|---|---|---|
| Technology Essentials | 25% | Networking, systems and endpoints, and applications, including cloud networking, segmentation, containers, databases, APIs and scripting |
| Cybersecurity Principles and Risk | 20% | Governance, compliance, cybersecurity objectives and models, plus risk across application, cloud, data, network, supply chain, endpoint and web application surfaces |
| Adversarial Tactics, Techniques, and Procedures | 10% | Threat landscape and threat intelligence sources, attack vectors and types, cyber attack stages, exploit techniques and penetration testing |
| Incident Detection and Response | 34% | Detection use cases, indicators of compromise, logs and alerts, monitoring tooling, containment, incident handling, forensic and malware analysis, network traffic and packet analysis |
| Securing Assets | 11% | Contingency planning, controls and techniques, identity and access management, frameworks and standards, and the full vulnerability management cycle |
Notice what is small. Adversarial tactics is the domain candidates most enjoy revising, and it is worth ten marks in every hundred. Attack theory is the seasoning here, not the meal.
What Does Incident Detection and Response Actually Cover?
Domain 4 is 34 percent of CCOA and splits into two halves. Detection covers data analytics, detection use cases, indicators of compromise and attack, logs and alerts, and monitoring tools. Response covers containment, incident handling, forensic analysis, malware analysis, network traffic analysis, packet analysis and threat analysis. Together they describe the full arc of an alert from firing to closure.
The detection half rewards a specific habit: being able to say why an alert exists. A detection use case is not a rule, it is the reasoning behind the rule, and questions in this area frequently give you the rule and ask what it was built to catch.
The response half is where tooling shows up
Packet analysis and network traffic analysis are named separately in the outline, and that separation is intentional. One is reading individual frames; the other is reading volume, timing and direction. Both appear, and both are far quicker to answer if you have actually filtered a capture rather than read about filtering one.
Forensic and malware analysis sit at a deliberately practical depth. You are not being asked to reverse engineer a binary. You are being asked what a hash, a persistence mechanism, or an unexpected outbound connection tells you, and what you do about it next.
Where the standards fit
ISACA does not tie the domain to one framework, but the language mirrors the phased approach the industry has used for two decades. Anyone who wants a free and rigorous grounding in the response half should read the NIST computer security incident handling guide, which lays out preparation, detection and analysis, containment, eradication and recovery in exactly the sequence the exam assumes.
How Much Technology Knowledge Does Domain 1 Assume?
More than most candidates expect. Technology Essentials is 25 percent of CCOA and spans three areas: networking, systems and endpoints, and applications. It names cloud networking, network topology, logical and physical segmentation, network tools, databases, the command line, containerisation and virtualisation, middleware, operating systems, APIs, automated deployment and scripting.
That is a wide surface for a domain called “essentials”. It is essential in the sense that everything else depends on it, not in the sense that it is shallow. An analyst who cannot describe how traffic reaches a container cannot reason about why an alert fired on it.
- Networking: devices, ports and protocols, network access, topology and segmentation
- Systems and endpoint: operating systems, databases, middleware, virtualisation and the command line
- Applications: APIs, cloud applications, automated deployment and scripting
Scripting deserves a specific note. It appears under applications rather than under any tooling domain, and the exam treats it as literacy rather than as software engineering. Reading a script and predicting what it does is the skill being tested.
Domain 2 then layers risk on top of the same surface, naming application, cloud, data, network, supply chain, endpoint and web application risk. If you want structured background on the last of those, the OWASP Top Ten project covers the categories the domain expects you to recognise by name.
What Does CCOA Cost, and What Is the Passing Score?
CCOA costs $399 for ISACA members and $499 for nonmembers, and the pass mark is a scaled 450 out of 800. A separate application fee of $50 applies when you claim the certification itself. The exam is four hours long and is delivered either at an authorised PSI test centre or under remote proctoring.
| Item | Detail |
|---|---|
| Questions | 140 total, 115 multiple choice and 25 performance based |
| Duration | 240 minutes |
| Passing score | 450 of 800, scaled |
| Exam fee | $399 member, $499 nonmember |
| Application fee | $50, payable when you apply for the certification |
| Delivery | PSI test centre or remotely proctored |
The scaled score is the part that confuses people, so it is worth being blunt about it. A scaled 450 is not 450 questions and it is not 56 percent of the marks. It is a conversion that keeps the standard constant across different versions of the exam, so the raw number of items you need right varies slightly with the form you sit.
The membership arithmetic is straightforward. The $100 saving on the exam fee covers most of an ISACA membership on its own, which is why a large share of candidates join before booking. Full fee detail sits on the official ISACA CCOA page.
Who Should Take CCOA Instead of CISA or CISM?
Take CCOA if you work inside the incident, and CISA or CISM if you work above it. CCOA is written for security operations analysts, incident responders and IT staff moving into a SOC. CISA audits controls and CISM manages a security programme; neither asks you to read a packet capture. The three credentials answer different questions about the same organisation.
That distinction matters more than it sounds, because ISACA’s reputation pulls candidates toward the wrong one. Someone two years into an analyst role often assumes CISA is the natural ISACA credential, then finds themselves revising audit sampling and evidence handling that they will never use at a console.
A quick way to decide
- You investigate alerts and hand off findings: CCOA
- You assess whether controls are designed and operating effectively: CISA
- You own the programme, the budget and the risk register: CISM
- You are new to security entirely and want vocabulary first: start below all three
The published CCOA exam content outline is the fastest sanity check. Read the domain list and ask honestly how much of it describes your week. If the answer is most of it, this is the right exam.
How Should You Prepare for a Four Hour Hybrid Exam?
Prepare in weighting order, and separate the two kinds of study. The multiple-choice half responds to reading and recall; the performance-based half responds only to time spent operating tools. A workable sequence spends the first half of the plan on Domain 4 and Domain 1, then adds the smaller domains, then rehearses under time pressure.
- Start with Incident Detection and Response, because at 34 percent it is worth more than any two other domains combined and it takes the longest to make automatic.
- Move to Technology Essentials next, treating networking, endpoints and applications as three separate passes rather than one long revision block.
- Build hands-on hours deliberately, filtering a packet capture, querying a log set and reading a scan result until each feels routine rather than novel.
- Layer Cybersecurity Principles and Risk on top of the technology you have just revised, since the risk categories map onto the same surfaces you have been working with.
- Cover Adversarial Tactics and Securing Assets last, keeping them brief, because together they account for only 21 percent of the paper.
- Sit at least two full timed papers at 140 questions in 240 minutes, and cap any single performance-based item at ten minutes so one hard question cannot eat the ending.
The mistake that costs most marks
Candidates over-revise attack theory. It is the most interesting material and the most heavily represented in general reading, and it is worth ten percent. Every hour spent there instead of on log and packet work is an hour spent on the smallest domain in the exam.
iSecPrep’s own CCOA study tips page is a useful companion once your plan is drafted, and the wider ISACA certification hub is worth a look if you are weighing CCOA against another ISACA credential.
What Happens After You Pass?
Passing the exam and holding the certification are two separate steps. ISACA gives you five years from the exam date to apply for CCOA certification, and the application carries its own $50 fee. Once certified, you keep the credential current through continuing professional education in the same way as ISACA’s other certifications.
That five-year window is unusually generous and worth using deliberately. If you sit the exam early in a role and expect your responsibilities to broaden, there is no pressure to apply immediately.
What it does for the job title
CCOA maps onto roles that already exist in most organisations: security operations centre analyst, incident responder, threat detection engineer and, increasingly, cloud security analyst. It is a mid-level signal rather than an entry-level one, because the performance-based section is genuinely hard to pass without operational exposure.
On compensation, treat any single figure with caution and look at ranges rather than averages. Published security analyst salary data shows a wide band driven by region and seniority, and a certification shifts position within that band rather than jumping you out of it.
Frequently Asked Questions
How many questions are on the CCOA exam?
One hundred and forty. ISACA splits them into 115 traditional multiple choice questions and 25 performance based questions, and you get 240 minutes for the whole paper.
What is the passing score for CCOA?
A scaled 450 out of 800. Because the score is scaled rather than a raw percentage, the exact number of items you need correct varies slightly between exam forms, which keeps the standard consistent.
How much does the CCOA exam cost?
The exam fee is $399 for ISACA members and $499 for nonmembers. A separate $50 application fee applies when you claim the certification after passing, so budget for both.
Which CCOA domain is the largest?
Incident Detection and Response at 34 percent. Technology Essentials is next at 25 percent, then Cybersecurity Principles and Risk at 20, Securing Assets at 11 and Adversarial Tactics at 10.
Is CCOA harder than CISA?
It is harder in a different way. CISA demands breadth of audit knowledge, while CCOA demands operational skill, and its performance based section cannot be passed by reading alone.
Do you need experience before sitting CCOA?
ISACA does not publish an experience prerequisite for the exam. In practice the tooling questions assume real exposure to logs, captures and a command line, so it suits analysts already in the work.
How long do you have to claim the certification?
Five years from the date you pass. That window lets candidates sit the exam early and apply once the rest of their profile catches up, without any need to resit.
Where can you take the CCOA exam?
At an authorised PSI test centre or under remote proctoring. The remote option matters in regions where test centre coverage is thin, and both routes use the same exam form.
What tools should you practise with?
Open source security tooling of the kind a SOC uses daily. Packet analysis, log querying and vulnerability scan output are the three areas that recur across the performance based questions.
Is CCOA worth it for a mid-level analyst?
For someone already handling alerts, yes, because the credential validates exactly that work. For someone with no operational exposure it is an expensive way to discover the gap.
Conclusion
CCOA is best understood through its weightings. A third of the paper sits in incident detection and response, a quarter in the technology that work runs on, and only a tenth in the attack theory candidates most enjoy revising. Add 25 performance based questions that expect you to operate tools rather than describe them, and the preparation plan writes itself: hands on the keyboard, in weighting order, under a clock.
The cybersecurity operations analyst certification rewards people who already do the job and want a credible way to prove it. If that describes you, work through the domain outline first, then test your pacing against realistic practice material before you book the four hours.
