thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ISACA · Cybersecurity · Associate

ISACA CCOA exam guide

Exam CCOA

ISACA's Certified Cybersecurity Operations Analyst (CCOA) validates hands-on SOC skills: technology essentials, cybersecurity principles, adversary tactics, incident detection and response, and securing assets. Its hybrid exam includes performance-based questions that require open-source security tools.

Questions140
Time limit240 minutes
Passing scoreSee official page
Exam fee$499 USD
Valid for3 years
DeliveryPSI test center or remote proctored

Format: Hybrid: 115 multiple choice plus 25 performance-based questions using open-source tools. Fee note: $399 for ISACA members; $50 application fee after passing.

Who it's for

Early-career SOC analysts, incident responders and security technicians who want a hands-on operations credential.

What the exam covers

Technology Essentials25%
Cybersecurity Principles and Risk20%
Adversarial Tactics, Techniques, and Procedures10%
Incident Detection and Response34%
Securing Assets11%

Eligibility & prerequisites

Required: None for the exam. Certification requires passing the exam, a $50 application fee and agreeing to the Code of Ethics and CPE policy.

Recommended: Hands-on exposure to networking, operating systems and SOC tooling.

Keeping it active

Annual and 3-year CPE cycle: earn at least 20 CPE hours each year and 120 hours every 3 years, and pay ISACA's annual maintenance fee (lower for members).

Skills & careers

Skills it validates

  • Networking, OS and cloud fundamentals for security
  • Analyzing logs and alerts with open-source tools
  • Mapping attacks to MITRE ATT&CK
  • Incident detection, triage and response
  • Vulnerability and asset protection
  • Applying security principles and risk concepts

Job roles

SOC AnalystCybersecurity AnalystIncident ResponderSecurity Operations TechnicianThreat Analyst

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: Technology essentials (25%): networking, Linux and Windows, cloud, data formats.
  2. Week 3: Cybersecurity principles and risk; adversarial TTPs with MITRE ATT&CK.
  3. Week 4-5: Incident detection and response (34%): log analysis, Wireshark, SIEM queries, IR process.
  4. Week 6: Securing assets plus hands-on practice with the open-source tools ISACA lists.
  5. Week 7: Timed practice combining multiple choice and lab tasks.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Incident detection and response is 34% of the exam; practice log and packet analysis.
  • The 25 performance-based items need tool fluency, not just theory.
  • Budget time for labs within the 4 hours.
  • Know ATT&CK tactics in order and common techniques.
  • Review ISACA's candidate guide for the tool list before exam day.

Frequently asked questions

How much does CCOA cost?

$399 for ISACA members and $499 for non-members.

Is CCOA hands-on?

Yes. It is a hybrid exam with performance-based questions that require open-source security tools.

CCOA vs CySA+?

Both target SOC analysts; CySA+ is more established with DoD 8140 recognition, while CCOA is newer and tool-based.

How long is the CCOA exam?

4 hours.

How do I maintain CCOA?

Follow ISACA's CPE policy and pay the annual maintenance fee.

Official page: www.isaca.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.