CompTIA CySA+ (CS0-003)

Question 1

A CySA+ analyst is preparing to launch the organization's quarterly vulnerability scan. The current asset inventory lists 480 hosts, but the analyst notices that a recent network topology change added a new subnet for a business unit that provisioned its own cloud-connected devices without notifying IT. The security manager wants to ensure the scan does not miss any live systems on the network. Which action should the analyst take FIRST to address this gap?

Accepted Answer

Run an active asset discovery scan (ping sweep and port enumeration) across all in-scope network ranges to identify live hosts before vulnerability scanning

Answer

Increase the CVSS threshold on the vulnerability scanner so that only critical findings are reported for the known 480 hosts

Answer

Schedule the vulnerability scan against the existing 480-host inventory and open a ticket to update the inventory next quarter

Answer

Enable credentialed scanning on the 480 known hosts to obtain deeper configuration data

Question 2

A CySA+ analyst is asked to build a repeatable methodology for classifying observed adversary behaviors during an active intrusion. The goal is to map each discrete action an attacker takes on a compromised host—such as dumping credentials, creating scheduled tasks, and disabling logging—to a standardized catalog of techniques and sub-techniques, so detection engineers can later measure coverage gaps. Which attack methodology framework is the MOST appropriate choice for this specific purpose?

Accepted Answer

MITRE ATT&CK framework

Answer

Lockheed Martin Cyber Kill Chain

Answer

Diamond Model of Intrusion Analysis

Answer

NIST SP 800-61 incident response lifecycle

Question 3

A security analyst is planning a vulnerability scan of a manufacturing network segment containing legacy programmable logic controllers (PLCs) and human-machine interface (HMI) systems. During a prior scan, an aggressive active scan caused a PLC to become unresponsive, halting a production line. The analyst must map assets and identify vulnerabilities on this operational technology (OT) segment while minimizing the risk of disrupting production. Which scanning approach BEST meets these requirements?

Accepted Answer

Use passive network scanning to fingerprint assets from captured traffic, supplemented by manual review of vendor firmware advisories

Answer

Run a credentialed active scan with maximum thread concurrency during production hours to complete the assessment quickly

Answer

Perform an uncredentialed active scan with full port ranges and OS fingerprinting enabled against all PLC and HMI hosts

Answer

Deploy an agent-based scanner directly onto each PLC to continuously report installed software versions

Question 4

A SOC analyst reviewing firewall logs notices that an internal workstation initiates outbound HTTPS connections to the same external IP address every 300 seconds, with each connection transferring a nearly identical small payload of approximately 512 bytes. The destination domain was registered three days ago and has no reputation data. Which conclusion is BEST supported by these indicators?

Accepted Answer

The workstation is exhibiting command-and-control beaconing behavior and should be investigated as a compromised host

Answer

The traffic represents normal software update checks and can be safely ignored

Answer

The workstation is performing a volumetric DDoS attack against the external IP

Answer

The activity indicates data exfiltration of a large database to the external host

Question 5

A SOC analyst is correlating events from a web server, a firewall, and a domain controller during an incident investigation. The analyst notices that the sequence of logged events across the three systems does not match the actual order in which the activity occurred, making it impossible to build an accurate timeline. All logs are being forwarded to the same SIEM. Which underlying issue is MOST likely responsible for this problem?

Accepted Answer

The systems are not synchronized to a common time source, causing timestamp drift between log sources

Answer

The SIEM is configured with an insufficient log retention period for the affected sources

Answer

The firewall is logging in a proprietary binary format the SIEM cannot parse

Answer

The domain controller is generating too many events, overwhelming the SIEM ingestion pipeline

Question 6

A vulnerability scan identifies a critical remote code execution flaw on a legacy manufacturing control server. The vendor no longer supports the operating system, and no patch is available. The server must remain online because it controls an active production line, and it cannot be replaced for at least 18 months due to budget and procurement constraints. Which recommendation BEST reduces the risk while keeping the system operational?

Accepted Answer

Isolate the server on a segmented VLAN with strict firewall rules and deploy host-based intrusion prevention as compensating controls

Answer

Accept the risk and document it in the risk register, taking no further action until the replacement arrives

Answer

Immediately take the server offline until a supported operating system can be installed

Answer

Reclassify the vulnerability as a false positive because no patch exists to remediate it

Question 7

During an active ransomware incident, an analyst confirms that a file server in the finance VLAN is encrypting shares and attempting SMB connections to hosts in other VLANs. Management insists the finance department must retain read-only access to already-encrypted backups on a separate storage appliance while the response team works. The team wants to stop lateral spread without fully powering down the affected server (to preserve volatile evidence). Which containment action BEST meets these constraints?

Accepted Answer

Apply ACLs at the VLAN boundary to block the infected server's outbound SMB traffic while leaving the host running and reachable for forensic tooling

Answer

Immediately shut down the infected file server to guarantee encryption stops

Answer

Disable all user accounts in the finance department to prevent further access

Answer

Reimage the infected file server from a known-good baseline right away

Question 8

A security analyst is tasked with performing a vulnerability scan of a fleet of internal Windows servers to build an accurate patch remediation plan. Previous uncredentialed scans produced many results based only on banner grabbing and left large gaps in missing-patch detection. The server team has approved providing a dedicated service account for scanning. Which scanning approach will provide the most accurate and complete assessment of missing patches and configuration weaknesses?

Accepted Answer

Run a credentialed (authenticated) scan using the provided service account

Answer

Continue with uncredentialed scans but increase the plugin timeout values

Answer

Perform a passive network scan by analyzing captured traffic only

Answer

Run an agentless external scan from the perimeter to simulate an attacker's view

Question 9

A vulnerability analyst is reviewing a scanner report that lists a vulnerability with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Management asks the analyst to explain what characteristic of this vulnerability most significantly increases the urgency of remediation. Which statement is the analyst's BEST response?

Accepted Answer

The vulnerability is exploitable remotely over a network without requiring authentication or user interaction, making mass exploitation feasible.

Answer

The vulnerability requires local physical access to the host, so remediation can be deferred until the next maintenance window.

Answer

The vulnerability only affects availability, so the primary concern is a potential denial-of-service condition.

Answer

The vulnerability results in a scope change, meaning exploitation is limited to the vulnerable component itself.

Question 10

A CySA+ analyst is reviewing a vulnerability assessment report and notices that one finding has a CVSS v3.1 vector string ending in the metric 'S:C'. The vendor advisory describes a flaw in a hypervisor component that allows a compromised guest virtual machine to affect the underlying host and other guests. When explaining the risk to management, which statement about the Scope (S) metric being set to 'Changed' is most accurate?

Accepted Answer

The vulnerable component and the impacted component are different security authorities, so exploitation impacts resources beyond the vulnerable component's own scope.

Answer

The vulnerability's scope has been temporarily changed by a vendor patch, so the base score should be recalculated after remediation.

Answer

The attacker must change their privilege scope from user to administrator before the exploit succeeds, indicating high attack complexity.

Answer

The organizational scope of the scan changed, meaning the finding applies to assets outside the originally defined scanning boundary.

Question 11

A vulnerability analyst is reviewing scan results for two servers. Both are affected by a vulnerability with a CVSS v3.1 base score of 9.8 (Critical). Server A is an internet-facing web server hosting the customer payment portal, and a public proof-of-concept exploit is confirmed to be circulating in the wild. Server B is an internal test server with no sensitive data, isolated on a segmented lab VLAN with no external access, and no known exploit exists for its specific configuration. Management wants the analyst to prioritize remediation using more than the base score alone. Which approach BEST reflects proper risk-based prioritization?

Accepted Answer

Prioritize Server A first by applying temporal (exploit maturity) and environmental (asset value, exposure) metrics that raise its contextual risk above Server B

Answer

Remediate both servers with equal urgency because they share the identical 9.8 base CVSS score

Answer

Prioritize Server B first because internal systems are inherently more trusted and any compromise indicates an insider threat

Answer

Defer both until the next quarterly maintenance window since the base score does not distinguish between the two assets

Question 12

A threat intelligence analyst is reviewing an incident report. According to the report, an adversary obtained a zero-day vulnerability, then paired an exploit for that vulnerability with a malicious PDF payload to create a deliverable file. This file had not yet been sent to any target at the time the activity was observed. Using the Lockheed Martin Cyber Kill Chain, which stage does this coupling of exploit and payload BEST represent?

Accepted Answer

Weaponization

Answer

Reconnaissance

Answer

Delivery

Answer

Exploitation

Question 13

During the analysis phase of an incident, a SOC analyst confirms a workstation is infected with credential-harvesting malware. Before recommending containment actions, the incident lead insists the team first determine which other systems the compromised account accessed, what data was reachable, and whether the malware spread laterally. Which incident response activity is the lead prioritizing?

Accepted Answer

Scoping the incident to determine its full impact and extent

Answer

Performing eradication by removing the malware from affected hosts

Answer

Conducting a lessons-learned review to improve future response

Answer

Executing recovery to restore systems to normal operations

Question 14

A threat analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. She has confirmed the malware sample (a custom RAT) and the compromised web server used to host the second-stage payload. To expand the investigation, she wants to identify other victims by pivoting from what she already knows. Which analytic pivot best leverages the confirmed data to discover additional affected organizations?

Accepted Answer

Pivot from the Infrastructure vertex by querying passive DNS and threat feeds for other hosts resolving to the same hosting server IP

Answer

Pivot from the Adversary vertex by attributing the campaign to a specific nation-state actor before analyzing further

Answer

Pivot from the Victim vertex by surveying all internal assets for missing patches

Answer

Pivot from the Capability vertex by rewriting the RAT's source code to test detection signatures

Question 15

A threat analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. Investigation reveals that the attacker used a spear-phishing email to compromise an accounts-payable employee's workstation, then leveraged that access to reach the finance department's payment system. The analyst wants to properly populate the model's four core vertices. Which piece of evidence should be recorded under the 'Victim' vertex?

Accepted Answer

The compromised accounts-payable workstation and the targeted finance payment system

Answer

The malicious macro-enabled document delivered in the spear-phishing email

Answer

The command-and-control domain the malware beaconed to after execution

Answer

The threat group's known preference for financially motivated fraud campaigns

Question 16

A SOC analyst reviewing DNS query logs from an internal workstation notices hundreds of outbound lookups per hour to domains such as 'kjf83hdsl2.info', 'zx9qmvbn4.info', and 'p1x8wqz7t.info'. Most of these queries return NXDOMAIN responses, but a small number resolve successfully to a hosting provider in another country. Which conclusion is best supported by these indicators?

Accepted Answer

The host is likely infected with malware using a domain generation algorithm (DGA) to locate its command-and-control server

Answer

The workstation is misconfigured and pointing to an invalid internal DNS resolver

Answer

A user is browsing many legitimate websites that use content delivery networks

Answer

The DNS server is performing normal cache-poisoning protection through randomized subdomains

Question 17

A SOC analyst using an EDR platform observes that a finance workstation is executing an unsigned binary that is spawning encoded PowerShell commands and initiating outbound connections to multiple external IPs. The analyst needs to stop the potential spread while preserving the ability to investigate the host and collect volatile data. Which EDR capability should the analyst invoke FIRST?

Accepted Answer

Trigger network isolation (host containment) on the workstation through the EDR console

Answer

Immediately power off the workstation to stop the malicious process

Answer

Deploy an antivirus full scan and quarantine any flagged files

Answer

Add the external IPs to the perimeter firewall blocklist

Question 18

A CySA+ analyst is reviewing EDR telemetry on a Windows workstation after an alert fired. The process tree shows that WINWORD.EXE (Microsoft Word) spawned cmd.exe, which then launched powershell.exe with an encoded command that reached out to an external IP. No legitimate business macro is deployed in the environment. Which host indicator is the strongest evidence of malicious activity in this telemetry?

Accepted Answer

An unusual parent-child process relationship in which an office document application spawns a command shell and encoded PowerShell

Answer

The workstation is running Microsoft Word, which is not on the approved software baseline

Answer

PowerShell is installed on the workstation and available to standard users

Answer

The external IP address is not listed in the organization's asset inventory

Question 19

A finance clerk received an email appearing to come from the CEO requesting an urgent wire transfer to a new vendor. The clerk forwards it to the SOC. Reviewing the mail gateway logs, an analyst notes the message passed SPF, DKIM, and DMARC checks and originated from a legitimately registered external domain, 'compañy-corp.com', while the organization's real domain is 'company-corp.com'. There were no malicious attachments or links. Which indicator best characterizes this activity?

Accepted Answer

A homoglyph/lookalike domain used in a business email compromise attempt

Answer

A display-name spoofing attack from the organization's own domain

Answer

A DMARC misconfiguration allowing spoofed internal mail

Answer

A malware-delivery phishing campaign relying on a weaponized attachment

Question 20

While reviewing a compromised Windows workstation, an analyst runs a WMI query and discovers a __EventFilter bound to a CommandLineEventConsumer that launches a PowerShell script whenever system uptime reaches 200 seconds. No corresponding scheduled task or registry Run key entry exists. Which conclusion best describes what the analyst has found?

Accepted Answer

A WMI event subscription is being used as a fileless persistence mechanism that survives reboots

Answer

A benign performance-monitoring agent configured by the desktop team

Answer

A DLL side-loading technique used to evade application allow-listing

Answer

A one-time process injection that will not persist after the current session ends

Question 21

During a ransomware incident, the IR team has isolated three infected workstations and confirmed the malware achieved kernel-level persistence and dropped multiple unknown binaries. Anti-malware scans now report the machines as 'clean.' Business leadership is pressing to return the machines to production quickly. As the analyst leading the eradication phase, what is the MOST appropriate course of action?

Accepted Answer

Rebuild the workstations from a known-good image and restore data from validated backups before returning them to production

Answer

Trust the clean anti-malware scan results and reconnect the workstations to the network immediately

Answer

Run a second anti-malware scan with a different vendor's engine and, if also clean, return the machines to production

Answer

Delete the identified malicious binaries manually and re-enable the machines while continuing to monitor them

Question 22

A vulnerability scanner reports that a critical Apache Struts remote code execution flaw (CVE-2017-5638) is present on a production web server. Before the analyst escalates the finding to the patching team, the server owner insists the application was migrated to a Java Spring framework months ago and no longer uses Struts. Which action should the analyst take FIRST to determine whether this is a false positive?

Accepted Answer

Manually verify by inspecting the server's installed libraries and application files, and attempt to confirm the vulnerable component and version actually exist

Answer

Immediately close the finding as a false positive because the application owner confirmed Struts is no longer in use

Answer

Escalate the critical finding to the patching team without further review to meet the remediation SLA

Answer

Re-run the scan with a different vulnerability scanner and accept whatever the second tool reports

Question 23

A SOC analyst is reviewing perimeter firewall logs and notices that a single external source IP generated hundreds of connection attempts to sequential destination ports (22, 23, 25, 80, 443, 3389, ...) on one internal host within a 15-second window. Nearly all attempts were denied by the firewall, and only a handful of ports returned SYN-ACK responses. Which activity does this pattern MOST likely indicate?

Accepted Answer

A TCP port scan performing reconnaissance to enumerate open services

Answer

A distributed denial-of-service (DDoS) flood targeting the internal host

Answer

Normal load-balancer health checks cycling through backend services

Answer

Data exfiltration over multiple outbound channels to evade detection

Question 24

A DevOps team deploys cloud infrastructure using Terraform templates through a CI/CD pipeline. The security team discovers that several production S3 buckets were provisioned with public read access and unencrypted storage, and that these same misconfigurations keep reappearing after being manually fixed. Which approach would MOST effectively prevent these vulnerabilities from reaching production in the future?

Accepted Answer

Integrate infrastructure-as-code (IaC) configuration scanning into the CI/CD pipeline to fail builds that contain insecure template definitions before deployment

Answer

Schedule weekly authenticated vulnerability scans of the production cloud environment and remediate findings as they are reported

Answer

Enable cloud provider logging to alert the SOC whenever a bucket is created with public access so an analyst can revert it

Answer

Add a compensating control that places a web application firewall in front of the exposed S3 buckets

Question 25

A security team has finished eradicating a ransomware infection across the affected file servers. Systems have been rebuilt from known-good images, patched, and reconnected to the production network. The incident commander now wants to formally complete the recovery phase before transitioning to lessons learned. Which action is MOST important to perform during this recovery phase?

Accepted Answer

Validate that restored systems are functioning normally and increase monitoring to confirm the threat has not returned

Answer

Draft the final incident report and schedule the post-incident review meeting with stakeholders

Answer

Isolate the affected servers from the network to prevent further encryption of shared files

Answer

Wipe the malware artifacts and terminate the malicious processes on the rebuilt servers

Question 26

A retail company confirms a breach in which an attacker accessed a database containing customer names, email addresses, and hashed loyalty-program passwords, but no payment card data or government identifiers. The incident commander is drafting external communications and must decide who needs to be notified first from a stakeholder perspective. Which factor should MOST directly determine which external parties must be formally notified?

Accepted Answer

The type of data exposed and the jurisdictions where the affected individuals reside

Answer

The total number of records stored in the compromised database, regardless of what was exposed

Answer

The estimated cost of the incident response engagement to date

Answer

The internal severity classification assigned by the SOC analyst during triage

Question 27

A mid-sized manufacturer suffers a confirmed ransomware incident affecting several production servers. The incident response manager is coordinating notifications. The company holds a cyber insurance policy that requires prompt reporting of covered events and pre-approval before engaging outside vendors or making ransom-related decisions. Which action should the IR manager prioritize to protect the organization's ability to recover costs under the policy?

Accepted Answer

Notify the cyber insurance carrier as soon as the incident is confirmed and before engaging third-party forensics or negotiators

Answer

Complete full eradication and recovery first, then submit a single consolidated claim to the carrier with all documentation

Answer

Engage a preferred external forensics firm immediately and notify the carrier after the investigation report is finalized

Answer

Post a public disclosure statement so the carrier can independently verify the event before processing the claim

Question 28

A Tier 1 analyst at a hospital detects ransomware activity encrypting files on a shared clinical file server. The organization's incident response plan defines that any incident affecting patient care systems or involving data-encrypting malware must be immediately escalated beyond the SOC. According to sound escalation practice, what should the analyst do FIRST after initial validation?

Accepted Answer

Escalate to the incident response manager and activate the defined escalation path per the IR plan's trigger criteria

Answer

Begin drafting the post-incident lessons-learned report to document the timeline

Answer

Notify the state health regulator of a confirmed breach of protected health information

Answer

Wait to gather additional evidence before involving anyone to avoid raising a false alarm

Question 29

A security analyst has completed the investigation of a ransomware incident that affected a manufacturing plant. The CISO asks the analyst to write the executive summary section of the formal incident report for the board of directors and C-suite. Which content is MOST appropriate to include in this executive summary?

Accepted Answer

A high-level overview of the business impact, financial and operational consequences, and strategic recommendations to reduce future risk

Answer

The complete list of indicators of compromise, including file hashes, registry keys, and malicious IP addresses observed during the incident

Answer

A detailed timeline of every command executed by the attacker with corresponding Windows event log IDs and process trees

Answer

The raw packet captures and forensic disk image hashes used to preserve chain of custody during evidence collection

Question 30

During the response to a ransomware incident, forensic analysis confirms that a nation-state-linked threat actor exfiltrated customer PII and intellectual property. The CISO is preparing a communication plan. Legal counsel advises that the organization may wish to pursue attribution support and preserve options for prosecution, while also meeting a contractual obligation to notify a federal partner. Which action should the CISO prioritize when deciding whether to involve law enforcement?

Accepted Answer

Coordinate with legal counsel to engage law enforcement early, understanding that doing so may impose evidence-handling requirements and could affect disclosure timing

Answer

Publicly disclose the breach on the corporate website before contacting any external party to demonstrate transparency

Answer

Delay all external notification until the environment is fully eradicated and restored to avoid alarming stakeholders

Answer

Notify law enforcement only after the cyber insurance claim has been fully settled to avoid complicating the payout

Question 31

During an active ransomware incident, a local news outlet publishes a story claiming your company suffered a major breach exposing customer data. Employees begin fielding calls from customers and reporters, and one engineer posts a technical detail about the attack on a public forum. As the CySA analyst supporting the incident, what is the MOST appropriate action to ensure consistent and accurate external communication?

Accepted Answer

Direct all external inquiries and any public statements to the designated public relations/communications team working with legal, and instruct staff not to disclose incident details

Answer

Have the incident response team publish a detailed technical timeline of the attack on the company website to demonstrate transparency

Answer

Authorize each department head to respond to media questions relevant to their area to speed up the response

Answer

Instruct the engineer to correct any inaccuracies about the attack directly on the public forum to control the narrative

Question 32

A healthcare organization confirms that an attacker exfiltrated a database containing 12,000 patients' protected health information (PHI). The incident commander is finalizing the response and must ensure regulatory obligations are met. Under U.S. HIPAA Breach Notification Rule requirements, which action is the incident commander responsible for ensuring is completed?

Accepted Answer

Notify affected individuals and the HHS Secretary without unreasonable delay and no later than 60 days after discovery of the breach

Answer

Notify the affected individuals within 72 hours of discovering the breach, as required by all data protection laws

Answer

Delay all external notification until the eradication and recovery phases are fully complete to avoid disclosing incomplete information

Answer

Report the breach only to internal executive leadership, since regulatory bodies are notified solely during annual compliance audits

Question 33

A SOC analyst receives three simultaneous alerts during a busy shift: (1) a single failed login from a marketing user's workstation, (2) unusual outbound traffic from a database server holding customer PII that is also communicating with a known malicious IP, and (3) an antivirus quarantine event on an isolated test VM that has no network connectivity. The organization's incident classification matrix rates impact by data sensitivity, system criticality, and scope. Which alert should the analyst escalate and prioritize first according to sound incident triage practice?

Accepted Answer

The outbound traffic from the PII database server contacting a known malicious IP

Answer

The failed login on the marketing workstation, because credential attacks often precede larger breaches

Answer

The antivirus quarantine event on the isolated test VM, because malware must be eradicated immediately

Answer

All three equally, since every alert must be worked in the order it was received

Question 34

During a ransomware investigation, an analyst images an infected workstation's hard drive and stores the image on an evidence server. Legal has indicated the case may result in prosecution of an insider. Which action is MOST important to ensure the disk image will be admissible in court?

Accepted Answer

Document a chain-of-custody log recording every person who handled the image, along with dates, times, and purpose of access

Answer

Encrypt the disk image with AES-256 before transferring it to the evidence server

Answer

Immediately reimage the affected workstation so it can return to production

Answer

Compress the image to reduce storage requirements on the evidence server

Question 35

During an active ransomware incident, the SOC lead confirms that customer payment data may have been accessed. The incident response team is executing containment, but individual analysts have begun emailing partners and posting status updates in a public Slack channel. The CISO is concerned about inconsistent messaging and potential legal exposure. Which element of incident response preparation should have been established to govern who communicates what, to whom, and when during this incident?

Accepted Answer

A communication plan defining stakeholder roles, approved channels, and escalation/notification thresholds

Answer

A root cause analysis template completed before the incident began

Answer

A network segmentation diagram showing containment zones

Answer

A vulnerability disclosure policy for external researchers

Question 36

A ransomware incident has been contained: affected hosts are isolated on a quarantine VLAN, and the C2 domains are blocked at the perimeter. The IR lead wants to move from containment to eradication. Before the team begins eradication activities, which action is MOST important to complete first?

Accepted Answer

Confirm that all systems affected by the incident have been fully identified and scoped

Answer

Restore encrypted files from the most recent backups to the isolated hosts

Answer

Reconnect the quarantined hosts to the production network to test business functionality

Answer

Draft the lessons-learned report summarizing the timeline of the incident

Question 37

During an active ransomware incident, the IR team has isolated three infected file servers from the network to stop encryption from spreading. Business leadership demands that critical shared drives be restored within hours to continue operations, but the team has not yet determined how the malware entered the environment. Which containment approach should the IR team implement next to balance operational needs with the ongoing investigation?

Accepted Answer

Implement long-term containment by rebuilding clean systems in an isolated segment and restoring validated backups while forensic analysis of the original systems continues

Answer

Move directly to eradication by reimaging all three servers so operations can resume as quickly as possible

Answer

Remove the network isolation on the infected servers so users can access the shared drives while monitoring continues

Answer

Declare the incident recovered and return the original isolated servers to production after running an antivirus scan

Question 38

During a security team meeting, an analyst reviews recent activity. A threat intelligence feed reports that a hacktivist group has publicly announced plans to target the company's industry over the next month due to a controversial policy decision. Separately, the SIEM has flagged repeated failed authentication attempts against the VPN gateway from foreign IP ranges within the last hour. According to the incident response lifecycle, how should the analyst classify these two pieces of information?

Accepted Answer

The hacktivist announcement is a precursor, and the failed VPN authentications are an indicator.

Answer

Both the hacktivist announcement and the failed VPN authentications are precursors.

Answer

The hacktivist announcement is an indicator, and the failed VPN authentications are a precursor.

Answer

Both the hacktivist announcement and the failed VPN authentications are indicators of compromise.

Question 39

A SOC analyst receives an automated alert indicating a workstation contacted a known malicious IP. Before escalating to the incident response team, the analyst wants to reduce the chance of escalating a benign event and provide responders with enough context to act quickly. Which action during the detection and analysis phase BEST accomplishes this?

Accepted Answer

Enrich the alert by correlating it with asset criticality, threat intelligence reputation, and related endpoint/proxy logs to validate and contextualize the activity

Answer

Immediately reimage the workstation to eliminate any possible malware before the responders arrive

Answer

Disable the SIEM correlation rule that generated the alert to stop further notifications

Answer

Wait 24 hours to confirm the activity repeats before taking any investigative action

Question 40

An analyst has fully contained a ransomware incident affecting several file servers. Malware artifacts and attacker persistence mechanisms have been identified and documented, and forensic images have been collected. The incident commander now asks what the team should do NEXT before allowing users to reconnect to the restored file servers. Which action best represents the correct next step in the incident response lifecycle?

Accepted Answer

Remove all identified malware, malicious accounts, and persistence mechanisms from the affected systems and verify the environment is clean

Answer

Restore data from backups to production and immediately return the servers to normal user access to minimize downtime

Answer

Convene the lessons-learned meeting to document root cause and update the ransomware playbook

Answer

Draft the final incident report and notify regulators of the confirmed breach

Question 41

During the analysis phase of an incident, a CySA+ analyst must acquire a forensic copy of a compromised server's hard drive that may later be used as evidence in litigation. The analyst connects the source drive through a hardware device and creates a bit-for-bit copy. To later prove in court that the acquired image is identical to the original disk and has not been altered, which action must the analyst take during acquisition?

Accepted Answer

Generate a cryptographic hash (e.g., SHA-256) of both the source drive and the resulting image and record the matching values

Answer

Compress the disk image into an encrypted archive before storing it in the evidence locker

Answer

Copy only the allocated files from the source drive to reduce the image size and speed acquisition

Answer

Document the source drive's serial number and physical condition in the chain-of-custody form

Question 42

After containing and recovering from a ransomware incident, the CSIRT holds a post-incident review meeting attended by the SOC, IT operations, legal, and management. During the session, the team documents that the initial infection occurred because an unpatched VPN appliance was exploited, that detection took nine days because no alerting existed for that appliance's logs, and that restoration was delayed because backups had never been tested. As the analyst facilitating the meeting, which of the following BEST represents the primary intended outcome of this phase?

Accepted Answer

Produce a set of actionable recommendations and assign owners to improve controls, detection, and processes for future incidents

Answer

Determine which employee was responsible for failing to patch the VPN appliance so disciplinary action can be taken

Answer

Complete the eradication of the ransomware from all affected systems and validate that no persistence remains

Answer

Notify regulators and affected customers of the breach within the legally mandated disclosure window

Question 43

Following a successful containment and recovery from a ransomware incident, the IR team completes a post-incident review. The final report documents the root cause, timeline, response effectiveness, and several recommended process improvements. The IR lead is deciding how the completed report should be handled going forward. Which action provides the MOST long-term value from this deliverable?

Accepted Answer

Use the documented findings and recommendations to update playbooks, controls, and detection rules, then track the improvements to completion

Answer

Archive the report in a restricted evidence locker and reference it only if litigation arises

Answer

Distribute the full report to all employees company-wide to raise general security awareness

Answer

Submit the report to executive leadership solely to justify additional headcount in the SOC

Question 44

After closing a breach investigation, a CySA+ analyst is preparing a metrics report for leadership. The intrusion first occurred on March 3, the SIEM generated the first correlated alert on March 18, the SOC began active investigation on March 19, and the threat actor was fully evicted on March 22. Leadership wants a single metric that best expresses how long the adversary went undetected inside the environment, so future preparation investments can target that specific gap. Which metric should the analyst report to answer that question?

Accepted Answer

Dwell time — the interval from initial compromise (March 3) to detection (March 18)

Answer

Mean time to respond (MTTR) — the interval from detection (March 18) to full eradication (March 22)

Answer

Mean time to contain — the interval from investigation start (March 19) to eviction (March 22)

Answer

Total incident duration — the interval from initial compromise (March 3) to full eradication (March 22)

Question 45

During the analysis phase of an active malware incident, an analyst plans to collect forensic evidence from a compromised Windows workstation that is still powered on and connected to the network. The analyst wants to preserve the most fragile evidence first to avoid data loss. Which source should the analyst collect FIRST according to the order of volatility?

Accepted Answer

Contents of RAM and running process memory

Answer

System event logs stored on the local disk

Answer

Files archived on an attached USB backup drive

Answer

A full bit-for-bit image of the hard drive

Question 46

A mid-sized company recently suffered a ransomware incident. During the response, analysts wasted several hours debating who had authority to disconnect affected systems and how to escalate to legal and executive leadership. The CISO wants to ensure future incidents proceed with predefined, repeatable steps that assign roles and decision authority before an event occurs. Which preparation-phase activity most directly addresses this need?

Accepted Answer

Developing and maintaining incident response playbooks that document roles, escalation paths, and step-by-step actions for specific incident types

Answer

Conducting a root cause analysis of the ransomware infection vector after recovery is complete

Answer

Deploying an EDR solution capable of automatically isolating infected endpoints from the network

Answer

Increasing the frequency of vulnerability scans to detect exploitable weaknesses earlier

Question 47

Following the recovery from a ransomware incident, the incident response lead is preparing for the post-incident review. Before the lessons-learned meeting, the lead wants to produce a single artifact that chronologically documents every detected event, analyst action, and containment decision with precise timestamps sourced from correlated logs. Which artifact should the lead create to best support the review?

Accepted Answer

An incident timeline that sequences all events and response actions with correlated timestamps

Answer

A chain-of-custody form documenting evidence transfers between analysts

Answer

An updated communication tree listing stakeholder escalation contacts

Answer

A CVSS-based severity matrix ranking the exploited vulnerabilities

Question 48

Two weeks after an incident response team completed the recovery phase for a ransomware event and formally closed the incident, the SOC detects the same malware family callback traffic from a different subnet that was previously believed unaffected. According to the incident response lifecycle, what is the MOST appropriate action for the team to take?

Accepted Answer

Reopen or initiate incident response beginning with detection and analysis to re-scope the affected environment before containing the newly identified hosts

Answer

Immediately reimage all systems on the newly affected subnet without further analysis to save time

Answer

Document the finding in the lessons-learned report from the closed incident and take no further containment action

Answer

Restore the affected subnet from the most recent backup and consider the matter resolved

Question 49

A mid-sized manufacturing company just completed its first incident response tabletop exercise. During the debrief, the team notes that when a simulated ransomware event was declared, responders wasted nearly 45 minutes trying to determine who to notify, in what order, and how to reach after-hours contacts because several phone numbers were outdated and no backup contacts existed. Which preparation-phase artifact should the IR team prioritize updating to directly resolve this specific gap before the next exercise?

Accepted Answer

The call/escalation tree with validated primary and alternate contact information

Answer

The network segmentation diagram showing VLAN boundaries

Answer

The root cause analysis template used in post-incident reviews

Answer

The forensic evidence chain-of-custody form

Question 50

A CySA+ analyst is helping the security team improve its preparation-phase readiness after a recent malware outbreak required lengthy, manual host rebuilds. During eradication, technicians rebuilt each infected workstation by hand, leading to inconsistent configurations and a recovery window that stretched into days. Which preparation activity would MOST directly reduce recovery time and configuration inconsistency during future incidents?

Accepted Answer

Establish and maintain validated golden images (known-good baseline builds) for rapid reimaging

Answer

Increase the frequency of authenticated vulnerability scans against the workstation fleet

Answer

Deploy additional EDR sensors to shorten mean time to detect on endpoints

Answer

Expand the SIEM correlation ruleset to catch the malware family earlier

Question 51

A mid-sized manufacturing company is standing up a formal incident response capability. During the preparation phase, the security manager wants the IR team to be able to deploy to a remote plant site and begin acquiring volatile data and forensic images immediately upon arrival, without waiting on procurement or IT provisioning. Which preparation activity BEST addresses this requirement?

Accepted Answer

Assembling a pre-configured jump kit containing write blockers, imaging drives, cables, and trusted forensic tools

Answer

Scheduling a quarterly tabletop exercise that simulates a plant-site compromise

Answer

Establishing a communication tree so responders can reach stakeholders during off-hours

Answer

Documenting a root cause analysis template for use after the incident is closed

Question 52

During a preparation-phase review, a CySA+ analyst is asked to clarify the difference between the organization's incident response playbooks and its runbooks so that documentation ownership can be assigned. Which statement most accurately describes how these two artifacts differ in scope and use?

Accepted Answer

A playbook defines the high-level strategy and decision workflow for responding to a category of incident, while a runbook provides the specific step-by-step technical procedures used to execute individual tasks.

Answer

A playbook contains only automated SOAR actions, while a runbook contains only manual actions performed by analysts.

Answer

A runbook governs the entire incident response lifecycle across all incident types, while a playbook applies to a single system or application.

Answer

A playbook is a legally binding regulatory document, while a runbook is an informal set of notes maintained by individual analysts.

Question 53

During a tabletop exercise, a mid-sized company's IR team discovers they lack the specialized skills to conduct deep malware reverse-engineering and memory forensics for advanced attacks. Leadership wants to ensure that if a sophisticated breach occurs, expert help can be mobilized within hours rather than negotiating contracts during the crisis. Which preparation-phase action BEST addresses this gap?

Accepted Answer

Establish a pre-negotiated incident response retainer agreement with a third-party forensics firm

Answer

Purchase additional EDR licenses to expand endpoint visibility across the environment

Answer

Schedule quarterly vulnerability scans to identify weaknesses before an attacker does

Answer

Update the incident response communication tree with additional internal stakeholder contacts

Question 54

A mid-sized company just experienced a ransomware incident. During the response, analysts wasted valuable time because two team members both attempted to lead containment while no one contacted legal counsel until hours into the event. The post-incident review notes technical detection worked well, but coordination broke down. As the CSIRT lead planning improvements to the preparation phase, which action most directly addresses the identified problem?

Accepted Answer

Define and document a RACI matrix assigning clear incident roles and responsibilities, then train the team on it

Answer

Deploy an additional EDR solution to improve endpoint detection coverage

Answer

Increase the frequency of vulnerability scans on internet-facing assets

Answer

Purchase a cyber-insurance policy to offset ransomware recovery costs

Question 55

A ransomware incident has been fully contained and eradicated across the affected file servers. The IR team is now beginning the recovery phase and plans to restore data from backups taken two days before the infection. Before bringing the restored systems back into production, which action is MOST important to perform?

Accepted Answer

Scan and validate the restored data and systems to confirm they are free of malware and integrity is intact before reconnecting to production

Answer

Immediately reconnect the restored servers to the production network to minimize business downtime

Answer

Delete all backups older than the restore point to prevent accidental reintroduction of infected data

Answer

Draft the lessons-learned report and schedule the post-incident review meeting

Question 56

A security team has just completed the recovery phase after a ransomware incident. Systems have been restored from backups, business operations have resumed normally, and monitoring confirms no residual malicious activity. The CISO wants to ensure the organization improves its defenses and documentation before institutional memory fades. Which activity should the incident response team prioritize NEXT, and when should it be conducted?

Accepted Answer

Conduct a lessons-learned meeting within a short, defined window after recovery, producing a report with root cause and recommended improvements

Answer

Immediately re-image all endpoints again as a precaution before documenting anything, then defer any review until the next quarterly audit

Answer

Begin the containment phase again to double-check that lateral movement was fully stopped before closing the incident

Answer

Wait at least six months so metrics on recurrence can be gathered before holding any post-incident discussion

Question 57

A security analyst is reviewing /var/log/auth.log on a Linux web server after an alert fired. The relevant entries show: a successful SSH login for the low-privilege account 'svc_deploy' from an internal jump host, followed 40 seconds later by repeated 'sudo: svc_deploy : command not allowed' messages, and then a single entry: 'sudo: pam_unix(sudo:session): session opened for user root by svc_deploy(uid=1004)'. Which conclusion is best supported by these log entries?

Accepted Answer

The svc_deploy account was used to attempt unauthorized commands and ultimately succeeded in escalating to a root session, indicating likely privilege escalation

Answer

The repeated failures prove the attacker never gained elevated access and the alert is a false positive

Answer

The entries indicate a brute-force attack against the SSH service that should be blocked at the firewall

Answer

The log shows normal automated deployment behavior and requires no further investigation

Question 58

A CySA+ analyst reviews EDR telemetry from a compromised workstation. The host is periodically making outbound HTTPS connections to a legitimate cloud storage provider's API, and the analyst confirms the malware retrieves task instructions and posts stolen data through this service. When documenting the incident, which MITRE ATT&CK tactic BEST describes this observed behavior?

Accepted Answer

Command and Control using Web Service

Answer

Exfiltration Over Alternative Protocol

Answer

Persistence via Scheduled Task

Answer

Defense Evasion through Masquerading

Question 59

A SOC analyst reviewing EDR telemetry observes that a suspicious executable ran the command 'wevtutil cl Security' followed shortly by 'vssadmin delete shadows /all /quiet'. The analyst is mapping this activity to the MITRE ATT&CK framework to document the adversary's behavior. Which ATT&CK tactic best categorizes BOTH of these observed actions?

Accepted Answer

Defense Evasion

Answer

Credential Access

Answer

Impact

Answer

Persistence

Question 60

During an investigation, a CySA+ analyst reviews EDR telemetry from a compromised finance workstation. The logs show that a legitimate archiving utility bundled several spreadsheets into a password-protected RAR file, after which a scheduled process uploaded the archive to a personal cloud storage account over HTTPS. The analyst is documenting the incident using the MITRE ATT&CK framework. Which ATT&CK tactic best describes the final activity of uploading the archive to the external cloud service?

Accepted Answer

Exfiltration

Answer

Collection

Answer

Command and Control

Answer

Impact

Question 61

A SOC analyst reviews an incident where an attacker gained a foothold on an internal workstation. Investigation shows the user received an email with a link to a legitimate-looking cloud document portal. When the user entered credentials, they were captured, and the attacker later used those credentials to log in through the company's external VPN portal. The analyst is documenting the intrusion using the MITRE ATT&CK framework. Which technique best describes how the attacker obtained the credentials used for the initial foothold?

Accepted Answer

Phishing: Spearphishing Link (T1566.002)

Answer

Valid Accounts (T1078)

Answer

Brute Force: Credential Stuffing (T1110.004)

Answer

Exploit Public-Facing Application (T1190)

Question 62

During a threat hunt, an analyst reviews Windows event logs and EDR telemetry from an internal file server. They observe that a user account authenticated to the server using a Kerberos ticket, but no corresponding interactive logon or password entry was recorded on the source workstation. The same ticket was then used to access three additional servers within minutes. Which MITRE ATT&CK technique best describes this observed activity?

Accepted Answer

Pass-the-Ticket (T1550.003)

Answer

Valid Accounts (T1078)

Answer

Brute Force (T1110)

Answer

Exploitation of Remote Services (T1210)

Question 63

A SOC lead wants to visualize which adversary techniques the team can currently detect versus which have no detection coverage. She maps existing detection rules to their corresponding technique IDs and produces a color-coded matrix that highlights defended techniques in green and undefended ones in red. Which use of the MITRE ATT&CK framework does this activity best represent?

Accepted Answer

Building an ATT&CK Navigator heat map to identify detection coverage gaps

Answer

Producing a Diamond Model diagram to correlate adversary infrastructure

Answer

Mapping the Cyber Kill Chain to sequence an incident timeline

Answer

Generating STIX bundles to share indicators over a TAXII feed

Question 64

A security analyst is reviewing telemetry from an enterprise mobile device management (MDM) console after users reported unexpected battery drain on company-issued phones. The logs show that a recently sideloaded internal utility app requests and actively uses the following runtime permissions: READ_SMS, ACCESS_FINE_LOCATION, RECORD_AUDIO, and READ_CONTACTS. The app's stated purpose is to display the corporate cafeteria menu. Which conclusion is MOST supported by this application-layer indicator?

Accepted Answer

The permission requests are disproportionate to the app's stated function, indicating a likely malicious or trojanized application

Answer

The battery drain is caused solely by the ACCESS_FINE_LOCATION permission and is expected behavior for any location-aware app

Answer

The app is safe because it was distributed internally rather than through a public app store

Answer

The behavior indicates a certificate pinning failure that should be resolved by reissuing the app-signing certificate

Exam domain	Exam weight	Practice
Security Operations	33%	Practice this topic
Vulnerability Management	30%	Practice this topic
Incident Response and Management	20%	Practice this topic
Reporting and Communication	17%	Practice this topic

CompTIA CySA+ (CS0-003) (CS0-003) practice exam & study guide

Start studying CS0-003

All CS0-003 study resources

CS0-003 exam domains

Sample CS0-003 questions

Key CS0-003 terms

CS0-003 frequently asked questions

Security Operations (33%)

Vulnerability Management (30%)

Incident Response and Management (20%)

Reporting and Communication (17%)