- Maps to ISACA Domain 1, Technology Essentials (25%).
- Work with network devices, ports, protocols, access, and topology.
- Apply logical and physical segmentation.
- Use network tools and cloud networking concepts.
ISACA Certification Training
Certified Cybersecurity Operations Analyst™ (CCOA™) Certification Training Course
Show you can do the work in real tools. Accumentum prepares cybersecurity analysts for ISACA’s Certified Cybersecurity Operations Analyst (CCOA) exam, which mixes multiple-choice questions with hands-on tasks.
Course focus: Technology essentials, cybersecurity principles and risk, adversarial tactics, incident detection and response, and securing assets, mapped to ISACA’s five CCOA exam domains, with practice on the open-source tools the exam uses.
Course Overview
Detect, analyze, and respond to threats with the tools analysts use every day.
The Certified Cybersecurity Operations Analyst™ (CCOA™) Certification Training Course with Accumentum prepares you for ISACA’s hands-on analyst exam. ISACA launched CCOA in January 2025 for cybersecurity professionals with two to three years of experience.
The CCOA exam is a hybrid. It has 115 multiple-choice questions and 25 performance-based questions that ask you to work in tools such as Wireshark, Security Onion, Kibana, CyberChef, Greenbone OpenVAS, PowerShell, and Linux and Windows command lines.
The ten modules follow ISACA’s five CCOA domains: Technology Essentials (25%), Cybersecurity Principles and Risk (20%), Adversarial Tactics, Techniques, and Procedures (10%), Incident Detection and Response (34%), and Securing Assets (11%).
CCOA also fits a longer path. ISACA gives CCOA exam passers a one-year educational waiver toward CISM, so it can be a step between analyst work and security management.
Next step: Certified Information Security Manager (CISM). CCOA exam passers earn a one-year educational waiver toward CISM. When you are ready to move into security management, Accumentum’s CISM course is the next step.
Course Objectives
Build CCOA exam readiness and hands-on analyst skills.
01
Know the technology
Work with networking, systems, cloud, containers, command lines, APIs, and scripting the way an analyst needs to.
02
Understand cyber risk
Connect governance, compliance, and risk to application, cloud, data, network, and supply chain risk.
03
Detect and respond
Build detection use cases, triage alerts, analyze logs, packets, and malware, and contain incidents.
04
Secure assets
Apply controls and identity and access management, and run vulnerability assessment, remediation, and tracking.
Who Should Attend
- SOC analysts and cybersecurity analysts with a few years of experience.
- Information security, vulnerability, and incident response analysts.
- Security+ or CySA+ holders who want a hands-on, vendor-neutral analyst credential.
- Analysts planning a path to CISM who want the one-year waiver.
Prerequisites
- ISACA says the CCOA exam is open to anyone with an interest in cybersecurity and lists no experience requirement to certify.
- ISACA designed CCOA for analysts with two to three years of experience, so the course assumes working knowledge of networking, operating systems, and security basics.
- You should be comfortable on Windows and Linux command lines before the performance-based section.
- Training does not replace ISACA’s certification requirements. After passing the exam you must still apply to ISACA and meet its ethics and CPE rules.
Pathway Map
The CCOA training course covers all five ISACA domains across ten modules.
Every module opens with the exam domain it maps to, so you can see how the pieces fit together across the course.
Course Content
- Maps to ISACA Domain 1, Technology Essentials (25%).
- Work with operating systems, databases, middleware, containers, and virtualization.
- Use command lines on Windows and Linux.
- Read APIs, automated deployment, cloud applications, and scripts.
- Maps to ISACA Domain 2, Cybersecurity Principles and Risk (20%).
- Apply compliance, governance, and risk management concepts.
- Understand cybersecurity objectives, roles, and models.
- Align security operations with business objectives.
- Maps to ISACA Domain 2, Cybersecurity Principles and Risk (20%).
- Assess application, web application, and cloud technology risk.
- Assess data, network, and system and endpoint risk.
- Assess supply chain risk.
- Maps to ISACA Domain 3, Adversarial Tactics, Techniques, and Procedures (10%).
- Identify attack vectors, threat actors, and threat intelligence sources.
- Recognize attack types, attack stages, and exploit techniques.
- Understand how penetration testing supports defense.
- Maps to ISACA Domain 4, Incident Detection and Response (34%).
- Develop detection use cases and rule sets.
- Work with logs, alerts, and monitoring tools such as Security Onion and Kibana.
- Identify indicators of compromise and indicators of attack.
- Maps to ISACA Domain 4, Incident Detection and Response (34%).
- Analyze network traffic and packets in Wireshark.
- Decode and analyze artifacts with CyberChef and CertUtil.
- Perform basic malware and threat analysis.
- Maps to ISACA Domain 4, Incident Detection and Response (34%).
- Triage events and handle incidents through classification, escalation, and notification.
- Propose containment measures and support forensic investigation.
- Document and report incidents and lessons learned.
- Maps to ISACA Domain 5, Securing Assets (11%).
- Apply controls, techniques, and contingency planning.
- Manage identity and access.
- Use industry best practices, frameworks, and standards.
- Maps to ISACA Domain 5, Securing Assets (11%).
- Run vulnerability assessments with tools such as Greenbone OpenVAS.
- Identify, prioritize, and remediate vulnerabilities.
- Track remediation to closure.
Course Features
Designed for analysts preparing for the ISACA CCOA exam.
Expert-Led Sessions
Live virtual sessions with instructors focused on detection, analysis, and response.
Hands-On Tool Practice
Guided practice with the kinds of open-source tools ISACA lists for the performance-based questions.
Domain-Mapped Materials
Study materials organized by ISACA’s five CCOA domains and their published weights.
Exam Readiness Review
Review of the exam structure, the lab section, and ISACA-style question stems before you schedule.
Certification Exam
Prepare for the ISACA Certified Cybersecurity Operations Analyst exam.
CCOA Exam Readiness
Accumentum’s CCOA course prepares analysts for both the multiple-choice and hands-on sections across all five ISACA domains.
ISACA launched the Certified Cybersecurity Operations Analyst (CCOA) certification in January 2025. ISACA designed it for cybersecurity analysts with two to three years of experience.
The CCOA exam runs 4 hours and has 115 multiple-choice questions and 25 performance-based questions. Multiple choice comes first, followed by the lab section. It covers five domains: Technology Essentials (25%), Cybersecurity Principles and Risk (20%), Adversarial Tactics, Techniques, and Procedures (10%), Incident Detection and Response (34%), and Securing Assets (11%).
Exams are computer-based and taken at PSI testing centers or through remote proctoring. The exam is offered in English. After you register, you have six months to take the exam.
To become certified you must pass the exam, apply within five years of passing, pay ISACA’s application processing fee, and follow ISACA’s Code of Professional Ethics and CPE policy. CCOA exam passers also earn a one-year educational waiver toward CISM.
Accumentum is an independent training provider. ISACA sets and changes exam rules, fees, and policies, so confirm current details on isaca.org before you register.
Careers
Where the CCOA Can Take You
CCOA is built for hands on security operations work. It suits analysts who monitor, detect and respond, and it is a practical step toward senior analyst and management roles.
SOC Analyst
Monitors alerts, triages events and escalates incidents.
Incident Responder
Investigates and contains security incidents.
Threat Detection Engineer
Builds and tunes detection content.
Security Operations Lead
Runs shifts, playbooks and SOC metrics.
Study Plan
How We Prepare You for the CCOA
The CCOA exam includes performance based questions, so we pair concept review with hands on practice in every module and timed drills on the tasks the exam tests.
Hands On Labs
Practice the operational tasks behind the performance based questions.
Timed Drills
Build speed for a four hour exam that mixes formats.
Funding
Paying for CCOA Training
We are an Army CA and Air Force COOL Approved Vendor, so eligible service members can often use those programs toward CCOA training. Your education counselor decides what gets approved, and we help you put the paperwork together.
If you're paying yourself or through your employer, PathPay spreads tuition into monthly payments. Email info@accumentum.net and we will send a quote for the CCOA class that you can pass to a manager or training budget owner.
Army CA
Send us your request details and we will provide the course quote and documents your counselor asks for.
Air Force COOL
We are an approved vendor. We help you confirm the credential is on your COOL list before you apply.
PathPay
Monthly payments instead of one lump sum. See the PathPay page for current terms.
Employer Paid
We provide quotes and course outlines your employer can use to approve the spend.
After the Exam
Retakes and Certification
ISACA allows four attempts in a rolling 12 month period. After a first attempt that does not pass, you wait 30 days to retake, then 90 days before each of the next two attempts, and each attempt is paid in full.
If you need to cancel or change a scheduled exam, ISACA requires you to do it at least 48 hours before your appointment.
Keep Exploring
Related Courses and Resources
After the Exam
Scheduling, Retakes and Certification
ISACA exam registration is continuous, so you can register when you are ready and then book a seat with PSI at a test center or through remote proctoring. If you need to change or cancel, ISACA asks you to do it at least 48 hours before your appointment.
ISACA allows four attempts in a rolling 12 month period. After a first attempt that does not pass you wait 30 days, then 90 days before each of the next two attempts, and each attempt is paid in full.
Passing the exam comes first. Candidates then have five years to apply for CCOA certification and agree to ISACA's Code of Professional Ethics and Continuing Professional Education policy. We walk you through that application in class.
Because the CCOA exam includes performance-based questions in tools such as Wireshark, Kibana and Security Onion, we spend part of each day at the keyboard. You'll read packet captures, search logs and work through an alert the way you would on a real shift, then talk through what you found with the group.
Frequently Asked Questions
How Accumentum’s CCOA course lines up with ISACA’s exam, what the hands-on section involves, and how CCOA leads to CISM.
Certified Cybersecurity Operations Analyst (CCOA) is ISACA’s hands-on credential for cybersecurity analysts. ISACA says it focuses on the technical skills to evaluate threats, identify vulnerabilities, and recommend countermeasures. ISACA launched it in January 2025.
ISACA says the exam is open to anyone with an interest in cybersecurity and lists no experience requirement. ISACA designed it for analysts with two to three years of experience.
Five domains: Technology Essentials (25%), Cybersecurity Principles and Risk (20%), Adversarial Tactics, Techniques, and Procedures (10%), Incident Detection and Response (34%), and Securing Assets (11%).
The exam has 25 performance-based questions. ISACA lists tools such as Wireshark, Security Onion, Kibana, CyberChef, Greenbone OpenVAS, CertUtil, PowerShell, Windows Event Viewer, and Linux commands.
ISACA gives candidates 4 hours for 115 multiple-choice questions and 25 performance-based questions. The multiple-choice section comes first, then the lab section.
Yes. ISACA gives CCOA exam passers a one-year educational waiver toward CISM. Accumentum also offers a CISM course for that next step.
ISACA requires at least 120 CPE hours over each three-year period, with at least 20 hours each year.
Both are analyst credentials. CCOA adds performance-based questions in real tools, and it earns a one-year waiver toward ISACA’s CISM. Accumentum offers CySA+ training too.
The course is delivered as live virtual expert-led training with hands-on tool practice and study materials mapped to the five CCOA domains.
No. You earn CCOA by passing the ISACA exam and meeting ISACA’s certification requirements. Accumentum is an independent training provider, and ISACA sets the exam rules, fees, and policies.
Enrollment
Enroll in the ISACA CCOA Certification Training Course with Accumentum.
Enroll in the Certified Cybersecurity Operations Analyst™ (CCOA™) Certification Training Course with Accumentum to prepare for ISACA’s hands-on analyst exam.
You will work through all five CCOA domains with an instructor and practice in the kinds of tools the performance-based questions use.
Before you enroll, get comfortable with Windows and Linux command lines, since the lab section expects it. For course dates and enrollment help, visit Accumentum’s registration page.
Show your hands-on skills with CCOA training.
Prepare for the ISACA CCOA exam while you build the detection and response skills SOC teams need.