CompTIA CySA+ (CS0-003)

Question 1

A CySA+ analyst is preparing to launch the organization's quarterly vulnerability scan. The current asset inventory lists 480 hosts, but the analyst notices that a recent network topology change added a new subnet for a business unit that provisioned its own cloud-connected devices without notifying IT. The security manager wants to ensure the scan does not miss any live systems on the network. Which action should the analyst take FIRST to address this gap?

Accepted Answer

Run an active asset discovery scan (ping sweep and port enumeration) across all in-scope network ranges to identify live hosts before vulnerability scanning

Answer

Increase the CVSS threshold on the vulnerability scanner so that only critical findings are reported for the known 480 hosts

Answer

Schedule the vulnerability scan against the existing 480-host inventory and open a ticket to update the inventory next quarter

Answer

Enable credentialed scanning on the 480 known hosts to obtain deeper configuration data

Question 2

A CySA+ analyst is asked to build a repeatable methodology for classifying observed adversary behaviors during an active intrusion. The goal is to map each discrete action an attacker takes on a compromised host—such as dumping credentials, creating scheduled tasks, and disabling logging—to a standardized catalog of techniques and sub-techniques, so detection engineers can later measure coverage gaps. Which attack methodology framework is the MOST appropriate choice for this specific purpose?

Accepted Answer

MITRE ATT&CK framework

Answer

Lockheed Martin Cyber Kill Chain

Answer

Diamond Model of Intrusion Analysis

Answer

NIST SP 800-61 incident response lifecycle

Question 3

A security analyst is planning a vulnerability scan of a manufacturing network segment containing legacy programmable logic controllers (PLCs) and human-machine interface (HMI) systems. During a prior scan, an aggressive active scan caused a PLC to become unresponsive, halting a production line. The analyst must map assets and identify vulnerabilities on this operational technology (OT) segment while minimizing the risk of disrupting production. Which scanning approach BEST meets these requirements?

Accepted Answer

Use passive network scanning to fingerprint assets from captured traffic, supplemented by manual review of vendor firmware advisories

Answer

Run a credentialed active scan with maximum thread concurrency during production hours to complete the assessment quickly

Answer

Perform an uncredentialed active scan with full port ranges and OS fingerprinting enabled against all PLC and HMI hosts

Answer

Deploy an agent-based scanner directly onto each PLC to continuously report installed software versions

Question 4

A SOC analyst reviewing firewall logs notices that an internal workstation initiates outbound HTTPS connections to the same external IP address every 300 seconds, with each connection transferring a nearly identical small payload of approximately 512 bytes. The destination domain was registered three days ago and has no reputation data. Which conclusion is BEST supported by these indicators?

Accepted Answer

The workstation is exhibiting command-and-control beaconing behavior and should be investigated as a compromised host

Answer

The traffic represents normal software update checks and can be safely ignored

Answer

The workstation is performing a volumetric DDoS attack against the external IP

Answer

The activity indicates data exfiltration of a large database to the external host

Question 5

A SOC analyst is correlating events from a web server, a firewall, and a domain controller during an incident investigation. The analyst notices that the sequence of logged events across the three systems does not match the actual order in which the activity occurred, making it impossible to build an accurate timeline. All logs are being forwarded to the same SIEM. Which underlying issue is MOST likely responsible for this problem?

Accepted Answer

The systems are not synchronized to a common time source, causing timestamp drift between log sources

Answer

The SIEM is configured with an insufficient log retention period for the affected sources

Answer

The firewall is logging in a proprietary binary format the SIEM cannot parse

Answer

The domain controller is generating too many events, overwhelming the SIEM ingestion pipeline

Question 6

A vulnerability scan identifies a critical remote code execution flaw on a legacy manufacturing control server. The vendor no longer supports the operating system, and no patch is available. The server must remain online because it controls an active production line, and it cannot be replaced for at least 18 months due to budget and procurement constraints. Which recommendation BEST reduces the risk while keeping the system operational?

Accepted Answer

Isolate the server on a segmented VLAN with strict firewall rules and deploy host-based intrusion prevention as compensating controls

Answer

Accept the risk and document it in the risk register, taking no further action until the replacement arrives

Answer

Immediately take the server offline until a supported operating system can be installed

Answer

Reclassify the vulnerability as a false positive because no patch exists to remediate it

Question 7

During an active ransomware incident, an analyst confirms that a file server in the finance VLAN is encrypting shares and attempting SMB connections to hosts in other VLANs. Management insists the finance department must retain read-only access to already-encrypted backups on a separate storage appliance while the response team works. The team wants to stop lateral spread without fully powering down the affected server (to preserve volatile evidence). Which containment action BEST meets these constraints?

Accepted Answer

Apply ACLs at the VLAN boundary to block the infected server's outbound SMB traffic while leaving the host running and reachable for forensic tooling

Answer

Immediately shut down the infected file server to guarantee encryption stops

Answer

Disable all user accounts in the finance department to prevent further access

Answer

Reimage the infected file server from a known-good baseline right away

Question 8

A security analyst is tasked with performing a vulnerability scan of a fleet of internal Windows servers to build an accurate patch remediation plan. Previous uncredentialed scans produced many results based only on banner grabbing and left large gaps in missing-patch detection. The server team has approved providing a dedicated service account for scanning. Which scanning approach will provide the most accurate and complete assessment of missing patches and configuration weaknesses?

Accepted Answer

Run a credentialed (authenticated) scan using the provided service account

Answer

Continue with uncredentialed scans but increase the plugin timeout values

Answer

Perform a passive network scan by analyzing captured traffic only

Answer

Run an agentless external scan from the perimeter to simulate an attacker's view

Question 9

A vulnerability analyst is reviewing a scanner report that lists a vulnerability with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Management asks the analyst to explain what characteristic of this vulnerability most significantly increases the urgency of remediation. Which statement is the analyst's BEST response?

Accepted Answer

The vulnerability is exploitable remotely over a network without requiring authentication or user interaction, making mass exploitation feasible.

Answer

The vulnerability requires local physical access to the host, so remediation can be deferred until the next maintenance window.

Answer

The vulnerability only affects availability, so the primary concern is a potential denial-of-service condition.

Answer

The vulnerability results in a scope change, meaning exploitation is limited to the vulnerable component itself.

Question 10

A CySA+ analyst is reviewing a vulnerability assessment report and notices that one finding has a CVSS v3.1 vector string ending in the metric 'S:C'. The vendor advisory describes a flaw in a hypervisor component that allows a compromised guest virtual machine to affect the underlying host and other guests. When explaining the risk to management, which statement about the Scope (S) metric being set to 'Changed' is most accurate?

Accepted Answer

The vulnerable component and the impacted component are different security authorities, so exploitation impacts resources beyond the vulnerable component's own scope.

Answer

The vulnerability's scope has been temporarily changed by a vendor patch, so the base score should be recalculated after remediation.

Answer

The attacker must change their privilege scope from user to administrator before the exploit succeeds, indicating high attack complexity.

Answer

The organizational scope of the scan changed, meaning the finding applies to assets outside the originally defined scanning boundary.

Question 11

A vulnerability analyst is reviewing scan results for two servers. Both are affected by a vulnerability with a CVSS v3.1 base score of 9.8 (Critical). Server A is an internet-facing web server hosting the customer payment portal, and a public proof-of-concept exploit is confirmed to be circulating in the wild. Server B is an internal test server with no sensitive data, isolated on a segmented lab VLAN with no external access, and no known exploit exists for its specific configuration. Management wants the analyst to prioritize remediation using more than the base score alone. Which approach BEST reflects proper risk-based prioritization?

Accepted Answer

Prioritize Server A first by applying temporal (exploit maturity) and environmental (asset value, exposure) metrics that raise its contextual risk above Server B

Answer

Remediate both servers with equal urgency because they share the identical 9.8 base CVSS score

Answer

Prioritize Server B first because internal systems are inherently more trusted and any compromise indicates an insider threat

Answer

Defer both until the next quarterly maintenance window since the base score does not distinguish between the two assets

Question 12

A threat intelligence analyst is reviewing an incident report. According to the report, an adversary obtained a zero-day vulnerability, then paired an exploit for that vulnerability with a malicious PDF payload to create a deliverable file. This file had not yet been sent to any target at the time the activity was observed. Using the Lockheed Martin Cyber Kill Chain, which stage does this coupling of exploit and payload BEST represent?

Accepted Answer

Weaponization

Answer

Reconnaissance

Answer

Delivery

Answer

Exploitation

Question 13

During the analysis phase of an incident, a SOC analyst confirms a workstation is infected with credential-harvesting malware. Before recommending containment actions, the incident lead insists the team first determine which other systems the compromised account accessed, what data was reachable, and whether the malware spread laterally. Which incident response activity is the lead prioritizing?

Accepted Answer

Scoping the incident to determine its full impact and extent

Answer

Performing eradication by removing the malware from affected hosts

Answer

Conducting a lessons-learned review to improve future response

Answer

Executing recovery to restore systems to normal operations

Question 14

A threat analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. She has confirmed the malware sample (a custom RAT) and the compromised web server used to host the second-stage payload. To expand the investigation, she wants to identify other victims by pivoting from what she already knows. Which analytic pivot best leverages the confirmed data to discover additional affected organizations?

Accepted Answer

Pivot from the Infrastructure vertex by querying passive DNS and threat feeds for other hosts resolving to the same hosting server IP

Answer

Pivot from the Adversary vertex by attributing the campaign to a specific nation-state actor before analyzing further

Answer

Pivot from the Victim vertex by surveying all internal assets for missing patches

Answer

Pivot from the Capability vertex by rewriting the RAT's source code to test detection signatures

Question 15

A threat analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. Investigation reveals that the attacker used a spear-phishing email to compromise an accounts-payable employee's workstation, then leveraged that access to reach the finance department's payment system. The analyst wants to properly populate the model's four core vertices. Which piece of evidence should be recorded under the 'Victim' vertex?

Accepted Answer

The compromised accounts-payable workstation and the targeted finance payment system

Answer

The malicious macro-enabled document delivered in the spear-phishing email

Answer

The command-and-control domain the malware beaconed to after execution

Answer

The threat group's known preference for financially motivated fraud campaigns

Question 16

A SOC analyst reviewing DNS query logs from an internal workstation notices hundreds of outbound lookups per hour to domains such as 'kjf83hdsl2.info', 'zx9qmvbn4.info', and 'p1x8wqz7t.info'. Most of these queries return NXDOMAIN responses, but a small number resolve successfully to a hosting provider in another country. Which conclusion is best supported by these indicators?

Accepted Answer

The host is likely infected with malware using a domain generation algorithm (DGA) to locate its command-and-control server

Answer

The workstation is misconfigured and pointing to an invalid internal DNS resolver

Answer

A user is browsing many legitimate websites that use content delivery networks

Answer

The DNS server is performing normal cache-poisoning protection through randomized subdomains

Question 17

A SOC analyst using an EDR platform observes that a finance workstation is executing an unsigned binary that is spawning encoded PowerShell commands and initiating outbound connections to multiple external IPs. The analyst needs to stop the potential spread while preserving the ability to investigate the host and collect volatile data. Which EDR capability should the analyst invoke FIRST?

Accepted Answer

Trigger network isolation (host containment) on the workstation through the EDR console

Answer

Immediately power off the workstation to stop the malicious process

Answer

Deploy an antivirus full scan and quarantine any flagged files

Answer

Add the external IPs to the perimeter firewall blocklist

Question 18

A CySA+ analyst is reviewing EDR telemetry on a Windows workstation after an alert fired. The process tree shows that WINWORD.EXE (Microsoft Word) spawned cmd.exe, which then launched powershell.exe with an encoded command that reached out to an external IP. No legitimate business macro is deployed in the environment. Which host indicator is the strongest evidence of malicious activity in this telemetry?

Accepted Answer

An unusual parent-child process relationship in which an office document application spawns a command shell and encoded PowerShell

Answer

The workstation is running Microsoft Word, which is not on the approved software baseline

Answer

PowerShell is installed on the workstation and available to standard users

Answer

The external IP address is not listed in the organization's asset inventory

Question 19

A finance clerk received an email appearing to come from the CEO requesting an urgent wire transfer to a new vendor. The clerk forwards it to the SOC. Reviewing the mail gateway logs, an analyst notes the message passed SPF, DKIM, and DMARC checks and originated from a legitimately registered external domain, 'compañy-corp.com', while the organization's real domain is 'company-corp.com'. There were no malicious attachments or links. Which indicator best characterizes this activity?

Accepted Answer

A homoglyph/lookalike domain used in a business email compromise attempt

Answer

A display-name spoofing attack from the organization's own domain

Answer

A DMARC misconfiguration allowing spoofed internal mail

Answer

A malware-delivery phishing campaign relying on a weaponized attachment

Question 20

While reviewing a compromised Windows workstation, an analyst runs a WMI query and discovers a __EventFilter bound to a CommandLineEventConsumer that launches a PowerShell script whenever system uptime reaches 200 seconds. No corresponding scheduled task or registry Run key entry exists. Which conclusion best describes what the analyst has found?

Accepted Answer

A WMI event subscription is being used as a fileless persistence mechanism that survives reboots

Answer

A benign performance-monitoring agent configured by the desktop team

Answer

A DLL side-loading technique used to evade application allow-listing

Answer

A one-time process injection that will not persist after the current session ends

Question 21

During a ransomware incident, the IR team has isolated three infected workstations and confirmed the malware achieved kernel-level persistence and dropped multiple unknown binaries. Anti-malware scans now report the machines as 'clean.' Business leadership is pressing to return the machines to production quickly. As the analyst leading the eradication phase, what is the MOST appropriate course of action?

Accepted Answer

Rebuild the workstations from a known-good image and restore data from validated backups before returning them to production

Answer

Trust the clean anti-malware scan results and reconnect the workstations to the network immediately

Answer

Run a second anti-malware scan with a different vendor's engine and, if also clean, return the machines to production

Answer

Delete the identified malicious binaries manually and re-enable the machines while continuing to monitor them

Question 22

A vulnerability scanner reports that a critical Apache Struts remote code execution flaw (CVE-2017-5638) is present on a production web server. Before the analyst escalates the finding to the patching team, the server owner insists the application was migrated to a Java Spring framework months ago and no longer uses Struts. Which action should the analyst take FIRST to determine whether this is a false positive?

Accepted Answer

Manually verify by inspecting the server's installed libraries and application files, and attempt to confirm the vulnerable component and version actually exist

Answer

Immediately close the finding as a false positive because the application owner confirmed Struts is no longer in use

Answer

Escalate the critical finding to the patching team without further review to meet the remediation SLA

Answer

Re-run the scan with a different vulnerability scanner and accept whatever the second tool reports

Question 23

A SOC analyst is reviewing perimeter firewall logs and notices that a single external source IP generated hundreds of connection attempts to sequential destination ports (22, 23, 25, 80, 443, 3389, ...) on one internal host within a 15-second window. Nearly all attempts were denied by the firewall, and only a handful of ports returned SYN-ACK responses. Which activity does this pattern MOST likely indicate?

Accepted Answer

A TCP port scan performing reconnaissance to enumerate open services

Answer

A distributed denial-of-service (DDoS) flood targeting the internal host

Answer

Normal load-balancer health checks cycling through backend services

Answer

Data exfiltration over multiple outbound channels to evade detection

Question 24

A DevOps team deploys cloud infrastructure using Terraform templates through a CI/CD pipeline. The security team discovers that several production S3 buckets were provisioned with public read access and unencrypted storage, and that these same misconfigurations keep reappearing after being manually fixed. Which approach would MOST effectively prevent these vulnerabilities from reaching production in the future?

Accepted Answer

Integrate infrastructure-as-code (IaC) configuration scanning into the CI/CD pipeline to fail builds that contain insecure template definitions before deployment

Answer

Schedule weekly authenticated vulnerability scans of the production cloud environment and remediate findings as they are reported

Answer

Enable cloud provider logging to alert the SOC whenever a bucket is created with public access so an analyst can revert it

Answer

Add a compensating control that places a web application firewall in front of the exposed S3 buckets

Question 25

A security team has finished eradicating a ransomware infection across the affected file servers. Systems have been rebuilt from known-good images, patched, and reconnected to the production network. The incident commander now wants to formally complete the recovery phase before transitioning to lessons learned. Which action is MOST important to perform during this recovery phase?

Accepted Answer

Validate that restored systems are functioning normally and increase monitoring to confirm the threat has not returned

Answer

Draft the final incident report and schedule the post-incident review meeting with stakeholders

Answer

Isolate the affected servers from the network to prevent further encryption of shared files

Answer

Wipe the malware artifacts and terminate the malicious processes on the rebuilt servers

Question 26

A retail company confirms a breach in which an attacker accessed a database containing customer names, email addresses, and hashed loyalty-program passwords, but no payment card data or government identifiers. The incident commander is drafting external communications and must decide who needs to be notified first from a stakeholder perspective. Which factor should MOST directly determine which external parties must be formally notified?

Accepted Answer

The type of data exposed and the jurisdictions where the affected individuals reside

Answer

The total number of records stored in the compromised database, regardless of what was exposed

Answer

The estimated cost of the incident response engagement to date

Answer

The internal severity classification assigned by the SOC analyst during triage

Question 27

A mid-sized manufacturer suffers a confirmed ransomware incident affecting several production servers. The incident response manager is coordinating notifications. The company holds a cyber insurance policy that requires prompt reporting of covered events and pre-approval before engaging outside vendors or making ransom-related decisions. Which action should the IR manager prioritize to protect the organization's ability to recover costs under the policy?

Accepted Answer

Notify the cyber insurance carrier as soon as the incident is confirmed and before engaging third-party forensics or negotiators

Answer

Complete full eradication and recovery first, then submit a single consolidated claim to the carrier with all documentation

Answer

Engage a preferred external forensics firm immediately and notify the carrier after the investigation report is finalized

Answer

Post a public disclosure statement so the carrier can independently verify the event before processing the claim

Question 28

A Tier 1 analyst at a hospital detects ransomware activity encrypting files on a shared clinical file server. The organization's incident response plan defines that any incident affecting patient care systems or involving data-encrypting malware must be immediately escalated beyond the SOC. According to sound escalation practice, what should the analyst do FIRST after initial validation?

Accepted Answer

Escalate to the incident response manager and activate the defined escalation path per the IR plan's trigger criteria

Answer

Begin drafting the post-incident lessons-learned report to document the timeline

Answer

Notify the state health regulator of a confirmed breach of protected health information

Answer

Wait to gather additional evidence before involving anyone to avoid raising a false alarm

Question 29

A security analyst has completed the investigation of a ransomware incident that affected a manufacturing plant. The CISO asks the analyst to write the executive summary section of the formal incident report for the board of directors and C-suite. Which content is MOST appropriate to include in this executive summary?

Accepted Answer

A high-level overview of the business impact, financial and operational consequences, and strategic recommendations to reduce future risk

Answer

The complete list of indicators of compromise, including file hashes, registry keys, and malicious IP addresses observed during the incident

Answer

A detailed timeline of every command executed by the attacker with corresponding Windows event log IDs and process trees

Answer

The raw packet captures and forensic disk image hashes used to preserve chain of custody during evidence collection

Question 30

During the response to a ransomware incident, forensic analysis confirms that a nation-state-linked threat actor exfiltrated customer PII and intellectual property. The CISO is preparing a communication plan. Legal counsel advises that the organization may wish to pursue attribution support and preserve options for prosecution, while also meeting a contractual obligation to notify a federal partner. Which action should the CISO prioritize when deciding whether to involve law enforcement?

Accepted Answer

Coordinate with legal counsel to engage law enforcement early, understanding that doing so may impose evidence-handling requirements and could affect disclosure timing

Answer

Publicly disclose the breach on the corporate website before contacting any external party to demonstrate transparency

Answer

Delay all external notification until the environment is fully eradicated and restored to avoid alarming stakeholders

Answer

Notify law enforcement only after the cyber insurance claim has been fully settled to avoid complicating the payout

Question 31

During an active ransomware incident, a local news outlet publishes a story claiming your company suffered a major breach exposing customer data. Employees begin fielding calls from customers and reporters, and one engineer posts a technical detail about the attack on a public forum. As the CySA analyst supporting the incident, what is the MOST appropriate action to ensure consistent and accurate external communication?

Accepted Answer

Direct all external inquiries and any public statements to the designated public relations/communications team working with legal, and instruct staff not to disclose incident details

Answer

Have the incident response team publish a detailed technical timeline of the attack on the company website to demonstrate transparency

Answer

Authorize each department head to respond to media questions relevant to their area to speed up the response

Answer

Instruct the engineer to correct any inaccuracies about the attack directly on the public forum to control the narrative

Question 32

A healthcare organization confirms that an attacker exfiltrated a database containing 12,000 patients' protected health information (PHI). The incident commander is finalizing the response and must ensure regulatory obligations are met. Under U.S. HIPAA Breach Notification Rule requirements, which action is the incident commander responsible for ensuring is completed?

Accepted Answer

Notify affected individuals and the HHS Secretary without unreasonable delay and no later than 60 days after discovery of the breach

Answer

Notify the affected individuals within 72 hours of discovering the breach, as required by all data protection laws

Answer

Delay all external notification until the eradication and recovery phases are fully complete to avoid disclosing incomplete information

Answer

Report the breach only to internal executive leadership, since regulatory bodies are notified solely during annual compliance audits

Question 33

A SOC analyst receives three simultaneous alerts during a busy shift: (1) a single failed login from a marketing user's workstation, (2) unusual outbound traffic from a database server holding customer PII that is also communicating with a known malicious IP, and (3) an antivirus quarantine event on an isolated test VM that has no network connectivity. The organization's incident classification matrix rates impact by data sensitivity, system criticality, and scope. Which alert should the analyst escalate and prioritize first according to sound incident triage practice?

Accepted Answer

The outbound traffic from the PII database server contacting a known malicious IP

Answer

The failed login on the marketing workstation, because credential attacks often precede larger breaches

Answer

The antivirus quarantine event on the isolated test VM, because malware must be eradicated immediately

Answer

All three equally, since every alert must be worked in the order it was received

Question 34

During a ransomware investigation, an analyst images an infected workstation's hard drive and stores the image on an evidence server. Legal has indicated the case may result in prosecution of an insider. Which action is MOST important to ensure the disk image will be admissible in court?

Accepted Answer

Document a chain-of-custody log recording every person who handled the image, along with dates, times, and purpose of access

Answer

Encrypt the disk image with AES-256 before transferring it to the evidence server

Answer

Immediately reimage the affected workstation so it can return to production

Answer

Compress the image to reduce storage requirements on the evidence server

Question 35

During an active ransomware incident, the SOC lead confirms that customer payment data may have been accessed. The incident response team is executing containment, but individual analysts have begun emailing partners and posting status updates in a public Slack channel. The CISO is concerned about inconsistent messaging and potential legal exposure. Which element of incident response preparation should have been established to govern who communicates what, to whom, and when during this incident?

Accepted Answer

A communication plan defining stakeholder roles, approved channels, and escalation/notification thresholds

Answer

A root cause analysis template completed before the incident began

Answer

A network segmentation diagram showing containment zones

Answer

A vulnerability disclosure policy for external researchers

Question 36

A ransomware incident has been contained: affected hosts are isolated on a quarantine VLAN, and the C2 domains are blocked at the perimeter. The IR lead wants to move from containment to eradication. Before the team begins eradication activities, which action is MOST important to complete first?

Accepted Answer

Confirm that all systems affected by the incident have been fully identified and scoped

Answer

Restore encrypted files from the most recent backups to the isolated hosts

Answer

Reconnect the quarantined hosts to the production network to test business functionality

Answer

Draft the lessons-learned report summarizing the timeline of the incident

Question 37

During an active ransomware incident, the IR team has isolated three infected file servers from the network to stop encryption from spreading. Business leadership demands that critical shared drives be restored within hours to continue operations, but the team has not yet determined how the malware entered the environment. Which containment approach should the IR team implement next to balance operational needs with the ongoing investigation?

Accepted Answer

Implement long-term containment by rebuilding clean systems in an isolated segment and restoring validated backups while forensic analysis of the original systems continues

Answer

Move directly to eradication by reimaging all three servers so operations can resume as quickly as possible

Answer

Remove the network isolation on the infected servers so users can access the shared drives while monitoring continues

Answer

Declare the incident recovered and return the original isolated servers to production after running an antivirus scan

Question 38

During a security team meeting, an analyst reviews recent activity. A threat intelligence feed reports that a hacktivist group has publicly announced plans to target the company's industry over the next month due to a controversial policy decision. Separately, the SIEM has flagged repeated failed authentication attempts against the VPN gateway from foreign IP ranges within the last hour. According to the incident response lifecycle, how should the analyst classify these two pieces of information?

Accepted Answer

The hacktivist announcement is a precursor, and the failed VPN authentications are an indicator.

Answer

Both the hacktivist announcement and the failed VPN authentications are precursors.

Answer

The hacktivist announcement is an indicator, and the failed VPN authentications are a precursor.

Answer

Both the hacktivist announcement and the failed VPN authentications are indicators of compromise.

Question 39

A SOC analyst receives an automated alert indicating a workstation contacted a known malicious IP. Before escalating to the incident response team, the analyst wants to reduce the chance of escalating a benign event and provide responders with enough context to act quickly. Which action during the detection and analysis phase BEST accomplishes this?

Accepted Answer

Enrich the alert by correlating it with asset criticality, threat intelligence reputation, and related endpoint/proxy logs to validate and contextualize the activity

Answer

Immediately reimage the workstation to eliminate any possible malware before the responders arrive

Answer

Disable the SIEM correlation rule that generated the alert to stop further notifications

Answer

Wait 24 hours to confirm the activity repeats before taking any investigative action

Question 40

An analyst has fully contained a ransomware incident affecting several file servers. Malware artifacts and attacker persistence mechanisms have been identified and documented, and forensic images have been collected. The incident commander now asks what the team should do NEXT before allowing users to reconnect to the restored file servers. Which action best represents the correct next step in the incident response lifecycle?

Accepted Answer

Remove all identified malware, malicious accounts, and persistence mechanisms from the affected systems and verify the environment is clean

Answer

Restore data from backups to production and immediately return the servers to normal user access to minimize downtime

Answer

Convene the lessons-learned meeting to document root cause and update the ransomware playbook

Answer

Draft the final incident report and notify regulators of the confirmed breach

Question 41

During the analysis phase of an incident, a CySA+ analyst must acquire a forensic copy of a compromised server's hard drive that may later be used as evidence in litigation. The analyst connects the source drive through a hardware device and creates a bit-for-bit copy. To later prove in court that the acquired image is identical to the original disk and has not been altered, which action must the analyst take during acquisition?

Accepted Answer

Generate a cryptographic hash (e.g., SHA-256) of both the source drive and the resulting image and record the matching values

Answer

Compress the disk image into an encrypted archive before storing it in the evidence locker

Answer

Copy only the allocated files from the source drive to reduce the image size and speed acquisition

Answer

Document the source drive's serial number and physical condition in the chain-of-custody form

Question 42

After containing and recovering from a ransomware incident, the CSIRT holds a post-incident review meeting attended by the SOC, IT operations, legal, and management. During the session, the team documents that the initial infection occurred because an unpatched VPN appliance was exploited, that detection took nine days because no alerting existed for that appliance's logs, and that restoration was delayed because backups had never been tested. As the analyst facilitating the meeting, which of the following BEST represents the primary intended outcome of this phase?

Accepted Answer

Produce a set of actionable recommendations and assign owners to improve controls, detection, and processes for future incidents

Answer

Determine which employee was responsible for failing to patch the VPN appliance so disciplinary action can be taken

Answer

Complete the eradication of the ransomware from all affected systems and validate that no persistence remains

Answer

Notify regulators and affected customers of the breach within the legally mandated disclosure window

Question 43

Following a successful containment and recovery from a ransomware incident, the IR team completes a post-incident review. The final report documents the root cause, timeline, response effectiveness, and several recommended process improvements. The IR lead is deciding how the completed report should be handled going forward. Which action provides the MOST long-term value from this deliverable?

Accepted Answer

Use the documented findings and recommendations to update playbooks, controls, and detection rules, then track the improvements to completion

Answer

Archive the report in a restricted evidence locker and reference it only if litigation arises

Answer

Distribute the full report to all employees company-wide to raise general security awareness

Answer

Submit the report to executive leadership solely to justify additional headcount in the SOC

Question 44

After closing a breach investigation, a CySA+ analyst is preparing a metrics report for leadership. The intrusion first occurred on March 3, the SIEM generated the first correlated alert on March 18, the SOC began active investigation on March 19, and the threat actor was fully evicted on March 22. Leadership wants a single metric that best expresses how long the adversary went undetected inside the environment, so future preparation investments can target that specific gap. Which metric should the analyst report to answer that question?

Accepted Answer

Dwell time — the interval from initial compromise (March 3) to detection (March 18)

Answer

Mean time to respond (MTTR) — the interval from detection (March 18) to full eradication (March 22)

Answer

Mean time to contain — the interval from investigation start (March 19) to eviction (March 22)

Answer

Total incident duration — the interval from initial compromise (March 3) to full eradication (March 22)

Question 45

A security analyst is reviewing /var/log/auth.log on a Linux web server after an alert fired. The relevant entries show: a successful SSH login for the low-privilege account 'svc_deploy' from an internal jump host, followed 40 seconds later by repeated 'sudo: svc_deploy : command not allowed' messages, and then a single entry: 'sudo: pam_unix(sudo:session): session opened for user root by svc_deploy(uid=1004)'. Which conclusion is best supported by these log entries?

Accepted Answer

The svc_deploy account was used to attempt unauthorized commands and ultimately succeeded in escalating to a root session, indicating likely privilege escalation

Answer

The repeated failures prove the attacker never gained elevated access and the alert is a false positive

Answer

The entries indicate a brute-force attack against the SSH service that should be blocked at the firewall

Answer

The log shows normal automated deployment behavior and requires no further investigation

Question 46

A CySA+ analyst reviews EDR telemetry from a compromised workstation. The host is periodically making outbound HTTPS connections to a legitimate cloud storage provider's API, and the analyst confirms the malware retrieves task instructions and posts stolen data through this service. When documenting the incident, which MITRE ATT&CK tactic BEST describes this observed behavior?

Accepted Answer

Command and Control using Web Service

Answer

Exfiltration Over Alternative Protocol

Answer

Persistence via Scheduled Task

Answer

Defense Evasion through Masquerading

Question 47

A SOC analyst reviewing EDR telemetry observes that a suspicious executable ran the command 'wevtutil cl Security' followed shortly by 'vssadmin delete shadows /all /quiet'. The analyst is mapping this activity to the MITRE ATT&CK framework to document the adversary's behavior. Which ATT&CK tactic best categorizes BOTH of these observed actions?

Accepted Answer

Defense Evasion

Answer

Credential Access

Answer

Impact

Answer

Persistence

Question 48

During an investigation, a CySA+ analyst reviews EDR telemetry from a compromised finance workstation. The logs show that a legitimate archiving utility bundled several spreadsheets into a password-protected RAR file, after which a scheduled process uploaded the archive to a personal cloud storage account over HTTPS. The analyst is documenting the incident using the MITRE ATT&CK framework. Which ATT&CK tactic best describes the final activity of uploading the archive to the external cloud service?

Accepted Answer

Exfiltration

Answer

Collection

Answer

Command and Control

Answer

Impact

Question 49

A SOC analyst reviews an incident where an attacker gained a foothold on an internal workstation. Investigation shows the user received an email with a link to a legitimate-looking cloud document portal. When the user entered credentials, they were captured, and the attacker later used those credentials to log in through the company's external VPN portal. The analyst is documenting the intrusion using the MITRE ATT&CK framework. Which technique best describes how the attacker obtained the credentials used for the initial foothold?

Accepted Answer

Phishing: Spearphishing Link (T1566.002)

Answer

Valid Accounts (T1078)

Answer

Brute Force: Credential Stuffing (T1110.004)

Answer

Exploit Public-Facing Application (T1190)

Question 50

During a threat hunt, an analyst reviews Windows event logs and EDR telemetry from an internal file server. They observe that a user account authenticated to the server using a Kerberos ticket, but no corresponding interactive logon or password entry was recorded on the source workstation. The same ticket was then used to access three additional servers within minutes. Which MITRE ATT&CK technique best describes this observed activity?

Accepted Answer

Pass-the-Ticket (T1550.003)

Answer

Valid Accounts (T1078)

Answer

Brute Force (T1110)

Answer

Exploitation of Remote Services (T1210)

Question 51

A SOC lead wants to visualize which adversary techniques the team can currently detect versus which have no detection coverage. She maps existing detection rules to their corresponding technique IDs and produces a color-coded matrix that highlights defended techniques in green and undefended ones in red. Which use of the MITRE ATT&CK framework does this activity best represent?

Accepted Answer

Building an ATT&CK Navigator heat map to identify detection coverage gaps

Answer

Producing a Diamond Model diagram to correlate adversary infrastructure

Answer

Mapping the Cyber Kill Chain to sequence an incident timeline

Answer

Generating STIX bundles to share indicators over a TAXII feed

Question 52

A security analyst is reviewing telemetry from an enterprise mobile device management (MDM) console after users reported unexpected battery drain on company-issued phones. The logs show that a recently sideloaded internal utility app requests and actively uses the following runtime permissions: READ_SMS, ACCESS_FINE_LOCATION, RECORD_AUDIO, and READ_CONTACTS. The app's stated purpose is to display the corporate cafeteria menu. Which conclusion is MOST supported by this application-layer indicator?

Accepted Answer

The permission requests are disproportionate to the app's stated function, indicating a likely malicious or trojanized application

Answer

The battery drain is caused solely by the ACCESS_FINE_LOCATION permission and is expected behavior for any location-aware app

Answer

The app is safe because it was distributed internally rather than through a public app store

Answer

The behavior indicates a certificate pinning failure that should be resolved by reissuing the app-signing certificate

Question 53

A security analyst reviewing NetFlow data notices that an internal file server (10.10.5.12) is transferring large volumes of data to a single internal workstation (10.10.5.88) over SMB during off-hours. The workstation normally generates minimal traffic. No data has yet left the network perimeter, but the workstation's outbound connections to the internet remain flat. Based on the MITRE ATT&CK framework, which activity is MOST likely occurring?

Accepted Answer

Data staging in preparation for later exfiltration

Answer

Command and control beaconing to an external server

Answer

Active data exfiltration over an encrypted channel

Answer

Initial access via a phishing payload delivery

Question 54

A SOC analyst is reviewing a packet capture from an internal workstation that generated an unusually high volume of outbound DNS traffic to a single external resolver. Most queries are TXT record lookups with long, seemingly random subdomain strings such as 'a8f2k9dj3mq7.data.exfil-example.net', and responses contain large TXT payloads. CPU and disk usage on the host are normal, and no large HTTP or FTP transfers are seen. Which activity does this pattern most strongly indicate?

Accepted Answer

DNS tunneling used for command-and-control or data exfiltration

Answer

A misconfigured DNS server performing a legitimate zone transfer (AXFR)

Answer

Normal DNS caching behavior from a busy web browser

Answer

An ARP spoofing attack redirecting local name resolution

Question 55

A CySA+ analyst reviews recurring scan results and notices that several hardened servers, which passed a compliance baseline check three months ago, are now failing multiple configuration and missing-patch checks. Change records show no approved modifications to these systems during that period. Which recommendation BEST addresses the underlying cause the analyst has identified?

Accepted Answer

Implement configuration drift detection and enforce the secure baseline through an automated configuration management tool

Answer

Increase the vulnerability scan frequency from monthly to weekly to catch new findings sooner

Answer

Submit a formal risk acceptance so the failing findings can be documented and closed

Answer

Switch the affected servers from credentialed to uncredentialed scanning to reduce false positives

Question 56

During a network investigation, an analyst captures traffic on a switched LAN segment and notices multiple ARP reply packets mapping the default gateway's IP address (192.168.1.1) to two different MAC addresses within the same minute. Several hosts on the subnet are also experiencing intermittent connectivity and unusually slow browsing. Which activity does this pattern most strongly indicate?

Accepted Answer

ARP cache poisoning enabling an on-path (man-in-the-middle) attack

Answer

A DHCP starvation attack exhausting the address pool

Answer

A misconfigured DNS server returning conflicting records

Answer

A SYN flood denial-of-service against the gateway

Question 57

A user forwards a suspicious email to the SOC. The message claims to be from the company's payroll provider and asks the recipient to log in via an included link. During analysis, the analyst reviews the raw email headers and notices the following: the 'From' header displays payroll@trustedvendor.com, but the SPF check result is 'softfail', the 'Return-Path' domain is mailer-3847.sendgrid-relay.ru, and DKIM shows 'none'. The Received chain originates from an IP not associated with the vendor's published mail infrastructure. Which conclusion is best supported by these indicators?

Accepted Answer

The sender domain is likely spoofed; the mismatched Return-Path, softfail SPF, and absent DKIM indicate the message did not originate from the authorized vendor infrastructure

Answer

The email is legitimate but was routed through a third-party marketing relay, so no action is needed

Answer

The DKIM 'none' result proves the message body was altered in transit and confirms a man-in-the-middle attack

Answer

Because the 'From' header matches the trusted vendor domain, the message passes authentication and can be released to the user

Question 58

A SOC analyst reviews external-facing web server logs and notices repeated requests from a single external IP over several days that enumerate directory paths, query robots.txt, probe /admin and /login endpoints, and pull HTTP response headers revealing server versions. No exploitation attempts or malicious payloads have been observed yet. Within the Cyber Kill Chain, which stage does this activity most accurately represent?

Accepted Answer

Reconnaissance

Answer

Delivery

Answer

Exploitation

Answer

Actions on Objectives

Question 59

A retail organization's monthly vulnerability scan flags several findings across its environment. The security manager must decide which to remediate first. The affected systems include: (1) an internal HR workstation with a medium-severity local privilege escalation flaw, (2) a public-facing e-commerce web server in the cardholder data environment (CDE) with a medium-severity TLS misconfiguration, (3) a development server with a critical remote code execution flaw that is isolated on an air-gapped test network, and (4) a marketing kiosk with a low-severity outdated browser plugin. Which finding should be remediated first?

Accepted Answer

The e-commerce web server TLS misconfiguration, because it resides in the PCI DSS cardholder data environment and is internet-facing

Answer

The development server RCE flaw, because it has the highest CVSS base score

Answer

The HR workstation privilege escalation flaw, because privilege escalation always enables lateral movement

Answer

The marketing kiosk plugin, because kiosks are physically accessible to the public

Question 60

A CySA+ analyst runs a software composition analysis (SCA) scan against a Node.js application build. The report flags a critical remote code execution vulnerability in a logging library. Investigation shows the development team never directly imported this library; it was pulled in automatically by a charting package listed in package.json. The charting package itself has no fix that removes the vulnerable dependency. What is the MOST appropriate first action for the analyst to recommend?

Accepted Answer

Coordinate with developers to apply a dependency override/resolution pinning the transitive library to a patched version, then rebuild and rescan

Answer

Mark the finding as a false positive because the development team did not directly declare the vulnerable library

Answer

Remove the entire application from production until the upstream charting package vendor releases a new major version

Answer

Add the vulnerable library hash to the endpoint EDR block list so the library cannot execute

Question 61

A developer builds a web-based network diagnostics tool that lets support staff enter a hostname, which the application passes to the operating system's ping utility. During a security review, an analyst confirms that entering '8.8.8.8; cat /etc/passwd' returns the contents of the password file. Which secure coding practice would MOST directly prevent this class of vulnerability?

Accepted Answer

Enforce strict input validation with an allow-list of permitted characters and avoid passing user input to a shell interpreter

Answer

Enable TLS 1.3 on the web server to encrypt the diagnostic request in transit

Answer

Apply output encoding to the ping results before rendering them in the browser

Answer

Set the session cookie with the HttpOnly and Secure attributes

Question 62

A vulnerability scan of a company's customer feedback portal reports a stored cross-site scripting (XSS) vulnerability. Analysts confirm that user-submitted comments are saved to a database and later rendered directly into the HTML of an administrative review page without any transformation. Which secure coding control most directly remediates this vulnerability?

Accepted Answer

Apply context-aware output encoding when rendering the stored comment data into the HTML page

Answer

Convert all database queries to use parameterized statements with bound variables

Answer

Enforce TLS 1.3 on all connections between the browser and the web server

Answer

Implement account lockout after five failed administrator logins

Question 63

A vulnerability scan of a customer-facing web application flags a critical SQL injection vulnerability in a login form. The development team confirms the finding is valid: the application concatenates user-supplied credentials directly into dynamic SQL statements. As the security analyst, which secure coding control should you recommend the developers implement to most effectively eliminate this class of vulnerability?

Accepted Answer

Refactor the code to use parameterized queries (prepared statements) with bound variables

Answer

Deploy a web application firewall (WAF) with signatures that block common SQL injection payloads

Answer

Enforce HTTPS on the login page and add a CAPTCHA to slow down automated attacks

Answer

Add client-side JavaScript validation to reject input containing single quotes and SQL keywords

Question 64

A SOC analyst notices that a SIEM correlation rule designed to detect brute-force authentication is generating hundreds of alerts per day, nearly all of which are traced back to a single vulnerability scanner and two automated backup service accounts performing scheduled logins. Analysts are spending excessive time triaging these alerts and have begun ignoring the rule's output. Which action best improves detection efficiency while preserving the rule's security value?

Accepted Answer

Add tuning exceptions that exclude the known scanner IP and service accounts, then adjust the failed-login threshold

Answer

Disable the brute-force correlation rule entirely to eliminate the alert volume

Answer

Increase the SIEM log retention period so historical brute-force data is available for review

Answer

Route all brute-force alerts directly to the incident response team for manual investigation

CompTIA CySA+ (CS0-003) (CS0-003) full-length practice exam

How this timed CS0-003 mock exam works

What your CS0-003 results show

How to get the most out of it

Ready for the full CS0-003 mock exam?