SecProve
ProfessionalVendor-neutralISACA· issued from US

CCOA

Certified Cybersecurity Operations Analyst

ISACA certification for SOC analysts with hybrid exam of multiple choice and performance-based questions. Focus on incident detection, response, and threat analysis. New since 2024.

Official page at ISACA↔ Compare with another cert
Exam fee
$575
Ongoing
$45/yr AMF · 20 CPE/yr
Study time
60–120 hrs
Delivery
Test center
Validity
3 yrs (renewal cycle)

› Quality score

21.0 / 40

Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.

Blueprint rigor
How well-defined and rigorous the exam blueprint is.
ISACA's cybersecurity operations associate — newer, blueprint still maturing.
7.0/10
Practical evidence
Hands-on labs / written reports vs pure MCQ.
Includes performance-based items and lab-style scenarios.
4.0/10
Currency & upkeep
How aggressively content is kept current with the field.
Refreshes track ISACA's SOC practice content.
6.0/10
Market recognition
How often this signal actually moves a hiring decision.
New (2024); recognition still building.
4.0/10

› Built for these roles

SOC AnalystsSecurity AnalystsIncident Response Analysts

› Exam format

Hybrid: 115 MC + 25 performance-based, 4 hours, 450/800

Passing score
450/800 (scaled)
Retake policy
Fee: $575 per attempt
Wait: 30d between attempts
Cap: 4 attempts/year

ISACA member $575 / non-member $760. 4 attempts per rolling 12-month window.

› Recertification

CPEs per ISACA policy, $45/$85 AMF

› 3-year cost of ownership

Exam (1×)
$575
AMF (3×)
$135@$45/yr
Total
$710

Excludes study materials, training, retake risk, and lost-wage opportunity. Use as a floor estimate.

› NICE Framework work roles

The NIST NICE work-role IDs this cert maps to. NICCS lookup.

PD-WRL-001PD-WRL-003
Recognition
Global
Exam languages
en

› Core domains covered

The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.

A10Security Operations

SOC operations, SIEM tuning, SOAR playbooks, alert triage, log analysis, runbook development.

A11Detection Engineering & Threat Hunting

SIGMA/YARA/Suricata rule writing, hypothesis-driven hunting, log deep-dives, detection gap analysis.

› Prerequisites

Experience

2-3 years cybersecurity experience recommended

› Study materials

Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.

Official guides
Training providers
  • ISACA Official CCOA Online Course
Practice tests
  • ISACA CCOA QAE
Free / community

› Version & lifecycle

Current version
Launched 2024
Released
2024-04

ISACA's first technical-tier hands-on cert. Includes performance-based items.

› Salary signal

SOC analyst tier 2 / threat hunter, US, 2-5 years.

$95K–$145K
median $115K

ISACA Salary Survey + Robert Half Salary Guide · 2024 · US base only · p25–p75 range

› How it compares

vs
CySA+

Both target SOC analyst tracks — CCOA carries ISACA brand weight; CySA+ has broader hiring-manager familiarity.

↔ Compare side-by-side
vs
GCIH

GCIH goes deeper at higher cost; CCOA is mid-tier with stronger management-track signaling.

↔ Compare side-by-side

› Common exam traps to study

Cybersecurity cert exams reuse the same 25 distractor patterns over and over — category confusion, RTO vs RPO, IDS vs IPS, MD5 vs SHA-256, and more. Once you can name the trap, you stop falling for it. Each archetype page covers what it is, the specific pairs candidates confuse, and how to avoid it.

Browse all 25 cert-exam trapsStart with: BEST vs correct

See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.

Highlight on the domain mapBrowse all certifications