CompTIA CySA+ Practice Test

1. A SOC analyst notices that a Windows workstation is repeatedly resolving DNS queries for domains with high entropy (e.g., xkq93jf.badnet.com) at short, regular intervals. Which technique is MOST likely being observed?

• A. A domain generation algorithm (DGA) used by malware to locate a command-and-control server
• B. Normal DNS caching behavior by the operating system
• C. A legitimate content delivery network performing load balancing across regional edge nodes using branded hostnames
• D. DNS zone transfer between authoritative name servers

2. During log review, an analyst sees a spike in outbound traffic on port 443 from a server that normally only receives inbound HTTPS connections. What is the BEST next step?

• A. Ignore it since port 443 is always associated with legitimate encrypted web traffic and cannot carry command-and-control beacons
• B. Investigate the anomaly further, including reviewing the destination IP reputation and process making the connection
• C. Immediately reformat the server without further analysis
• D. Block all outbound traffic on the network to contain any possible threat

3. An analyst is tuning a SIEM's correlation rules after a period of high false-positive alerts from a threat-intel-fed rule flagging any connection to IPs on a public blocklist. Which action BEST improves signal quality without reducing overall detection coverage?

• A. Disable the rule entirely so analysts stop seeing alerts from it
• B. Add contextual conditions (e.g., requiring the connection to originate from a sensitive asset or include unusual data volume) before the rule fires
• C. Remove the threat intelligence feed from the SIEM entirely
• D. Increase the alert severity so every match pages the on-call analyst immediately, doubling the paging volume without adding any new context to the alert

4. A threat hunter wants to proactively search for adversary behavior that has not yet triggered any automated alert. Which approach BEST describes this activity?

• A. Running a scheduled vulnerability scan against all subnets
• B. Waiting for the SIEM to generate an alert and then investigating it only after correlation rules already fired
• C. Patching all systems flagged as high-risk by the last scan
• D. Formulating a hypothesis based on known TTPs and searching telemetry for matching evidence

5. An analyst is deploying a host-based detection tool that must observe process creation, file modification, and registry changes on endpoints in real time. Which technology BEST fits this requirement?

• A. Endpoint Detection and Response (EDR)
• B. A network-based intrusion prevention system (NIPS) only
• C. A web application firewall (WAF)
• D. An email gateway spam filter

6. A security analyst reviewing NetFlow data notices a workstation transferring large volumes of data to an external IP over several hours during off-business hours. Assuming no known business justification exists, this pattern MOST strongly suggests which activity?

• A. Routine Windows Update traffic
• B. Data exfiltration
• C. A DHCP lease renewal
• D. ARP resolution broadcast traffic

7. Which of the following is the PRIMARY benefit of mapping detected adversary behavior to the MITRE ATT&CK framework during security operations?

• A. It generates a ready-to-deploy detection rule for each technique the moment that technique is added to the framework's matrix
• B. It replaces the need for a SIEM entirely
• C. It eliminates the need for any human analyst review
• D. It provides a common taxonomy of tactics and techniques that helps standardize detection engineering and gap analysis

8. An analyst configures a rule to alert whenever a service account that normally only runs batch jobs at 2 AM authenticates interactively during business hours. This is an example of which detection approach?

• A. Passive vulnerability scanning that fingerprints installed software versions without authenticating to the host
• B. Signature-based detection
• C. Static malware analysis
• D. Behavioral/anomaly-based detection using a baseline of normal activity

9. A CySA+ candidate is asked why organizations deploy deception technology such as honeypots within a production network segment. What is the PRIMARY purpose?

• A. To attract and detect attacker activity early by presenting an enticing but monitored fake target
• B. To permanently replace production servers
• C. To provide additional bandwidth for legitimate users
• D. To automatically patch vulnerabilities on real production systems by redirecting scanner traffic to the decoy

10. An analyst receives an alert for outbound traffic to a known malicious domain from an internal host. What is the first triage step?

• A. Close the alert if the domain is on a public blocklist
• B. Immediately reimage the host before gathering any information, following the standard end-user workstation refresh procedure used for routine upgrades
• C. Establish whether the connection actually succeeded and what process initiated it, since a blocked DNS lookup and an established session require very different responses
• D. Notify all users of a suspected compromise

11. An analyst investigates a suspicious process and finds it was launched by a legitimate signed system binary. What technique does this suggest?

• A. Living off the land, where an attacker uses tools already present on the system to avoid introducing detectable malware
• B. A rootkit hiding at the kernel level
• C. A denial of service attack against the host launched remotely by flooding it with malformed TCP SYN packets over port 445
• D. A hardware implant on the motherboard

12. A detection rule generates a high volume of alerts that analysts consistently close as benign. What is the correct response?

• A. Disable the rule entirely without documentation
• B. Tune the rule to reduce false positives while documenting what was excluded, since unmanaged alert volume causes genuine detections to be missed
• C. Continue processing every alert to avoid missing anything, adding a dedicated second overnight shift just to cover this one rule's output
• D. Increase analyst headcount to match the volume

13. An analyst correlates events from an endpoint tool, a firewall and an identity provider to reconstruct an intrusion. What capability enables this?

• A. Disabling logging on sources producing high volume
• B. Increasing the retention period on one source only
• C. Reviewing each tool's console separately at the same time, relying on each vendor's own local clock and unmatched case-numbering scheme
• D. Centralized log aggregation with consistent timestamps and a common identifier such as user or host linking events across sources

14. A threat intelligence feed provides indicators of compromise. What limitation should shape how they are used?

• A. Indicators cannot be ingested into detection tooling automatically at all and must be typed manually into the SIEM console by an analyst each day
• B. Indicators are only useful for compliance reporting
• C. Indicators never expire and remain valid indefinitely
• D. Indicators such as hashes and addresses are easily changed by an attacker, so detection based on behaviour and technique is more durable

15. An analyst maps observed adversary activity to a common framework of tactics and techniques. What does this enable?

• A. Identifying which stages of the attack were detected and which were not, so coverage gaps become visible and can be prioritized
• B. Automatic remediation of the affected systems
• C. Attribution of the attack to a specific individual using IP geolocation and WHOIS registration data pulled from the C2 domain
• D. A guarantee that the same attack cannot recur

16. An analyst performs threat hunting rather than responding to alerts. What distinguishes the activity?

• A. It is performed only after a confirmed breach
• B. It responds to alerts more quickly than standard triage by pre-staging containment scripts before the SIEM even finishes generating a page
• C. It proactively searches for adversary activity that existing detections did not surface, starting from a hypothesis rather than from an alert
• D. It replaces the need for detection rules entirely

17. An analyst examines a suspicious executable in a sandbox. What limitation should be understood?

• A. Sandbox results are always definitive
• B. Sandboxes execute files faster than a real host
• C. Malware commonly detects sandbox environments and alters or suspends its behaviour, so benign observed behaviour does not establish the file is safe
• D. Sandbox analysis cannot capture network activity, since the sandbox's virtual network interface is disabled by default on most commercial platforms

18. An analyst identifies encoded PowerShell in a command line captured by endpoint logging. What does the encoding typically indicate?

• A. A routine administrative practice used by IT staff to shorten long Group Policy startup scripts for faster logon execution times
• B. A corrupted log entry that should be discarded
• C. An attempt to obscure the command's content from casual inspection and simple string-based detection, warranting decoding and full investigation
• D. Evidence that the command failed to execute

19. Network traffic shows regular small outbound connections to the same external address at consistent intervals. What does this pattern suggest?

• A. Command and control beaconing, where an implant checks in on a schedule, which regularity of interval helps distinguish from human-driven traffic
• B. A large file transfer in progress
• C. Normal web browsing by a user
• D. A denial of service attack against the external address, since the connection volume alone matches an unusually persistent SYN flood pattern

20. An analyst reviews an authentication log showing successful logins for one account from two countries within minutes. What does this indicate?

• A. A clock synchronization error on the authentication server, since NTP drift of more than a few minutes can duplicate a login timestamp entry
• B. Impossible travel, suggesting credential compromise since one person cannot be in both locations, though a VPN or proxy can produce the same signal legitimately
• C. Normal behaviour for a mobile user
• D. A failed authentication attempt recorded incorrectly

21. A SOC analyst reviewing SIEM alerts notices a marketing employee's account authenticating to the finance department's file share at 3 AM, a resource the account has never accessed before. Which analysis technique BEST explains why this alert was generated?

• A. User and entity behavior analytics (UEBA) flagging a deviation from established access baselines
• B. Signature-based detection matching a known malware hash
• C. A vulnerability scanner correlating CVE data from the National Vulnerability Database with the account's login pattern
• D. Network flow analysis identifying a change in packet size distribution

22. During triage of a phishing report, an analyst finds the email's sender domain uses valid SPF and DKIM signatures but the display name spoofs the CEO and the reply-to address points to a free webmail domain. Which conclusion is MOST supported by this evidence?

• A. The email cannot be phishing since it passed email authentication checks
• B. The email is legitimate because SPF and DKIM both passed
• C. The email is likely a business email compromise attempt using a lookalike or compromised domain despite passing authentication
• D. The email originated from an internal compromised mailbox, confirmed by the passing DKIM signature and a matching SPF alignment record

23. An analyst needs to identify which specific tactics and techniques an intrusion used, from initial access through exfiltration, in a way that supports comparison with other campaigns industry-wide. Which reference framework BEST supports this goal?

• A. MITRE ATT&CK
• B. CVSS
• C. The organization's internal ticketing taxonomy
• D. The vulnerability scanner's proprietary severity scale

24. An analyst is building a detection rule for command-and-control beaconing that must avoid alerting on legitimate periodic traffic such as software update checks. Which characteristic BEST distinguishes malicious beaconing from routine polling in traffic analysis?

• A. The destination IP address is external to the network and resolves through a CDN edge node shared by thousands of other unrelated domains
• B. The connection occurs during business hours
• C. The traffic uses an encrypted protocol such as TLS
• D. The interval and payload size show unusually consistent jitter-free timing combined with a low-reputation or newly registered destination

25. A cloud security team receives an alert that a storage service's access logging was disabled shortly before an unusual spike in data downloads from an unfamiliar IAM role. What should the analyst do FIRST?

• A. Preserve available logs and cloud audit trail evidence while investigating the scope of the role's activity
• B. Immediately delete the IAM role to prevent further access
• C. Close the alert since logging was disabled and no further evidence can be gathered from the provider's separate control-plane audit trail
• D. Wait for the next scheduled vulnerability scan to confirm the finding

26. A SOC uses a SOAR platform to automatically disable a user account whenever three failed login attempts are followed by a successful login from a new geographic location. What is the PRIMARY benefit of this automation?

• A. It eliminates the need for analysts to ever review authentication logs again once the playbook is deployed and enabled
• B. It reduces analyst response time for a well-defined, repeatable scenario, freeing analysts for higher-judgment tasks
• C. It guarantees zero false positives in account compromise detection
• D. It replaces the need for multi-factor authentication on the account

27. An analyst investigating an endpoint alert discovers that a legitimate, digitally signed system utility was used to download and execute a secondary payload, leaving minimal artifacts of its own. Which technique does this behavior MOST closely describe?

• A. A distributed denial-of-service attack
• B. A zero-day exploit against the operating system kernel exploiting a CVE with no vendor patch available yet
• C. Living-off-the-land (LOTL) technique abusing a trusted binary
• D. Credential stuffing against a web application

28. A SOC pilots a generative AI assistant that drafts incident summaries and proposes SIEM queries from analyst prompts. Before an analyst runs one of the assistant's suggested queries against production log data, what is the analyst's MOST important responsibility?

• A. Validate the AI-suggested query and reasoning against known-good detection logic before running it, since generative output can be fluent yet factually wrong
• B. Check the assistant's self-reported confidence score before running the query, treating a high confidence value as sufficient grounds to skip further human review
• C. Disable every existing detection rule so the assistant becomes the SOC's sole source of alerting, triage, and escalation going forward
• D. Forward each AI-generated summary straight to executive leadership with no analyst review, since automation removes the need for triage

29. A company adopts a zero trust architecture and requires every access request to a finance application to be authenticated, authorized, and encrypted, regardless of whether the request originates inside the corporate network. Which principle does this design MOST directly reflect?

• A. Perimeter-based trust: once a device passes the firewall and joins the internal VLAN, all further internal requests are implicitly trusted
• B. Never trust, always verify: network location alone no longer grants implicit trust, so every session is evaluated on its own merits
• C. Defense in depth achieved solely by stacking additional firewalls at the network perimeter without touching identity or session policy
• D. Network segmentation alone, achieved by placing the finance application on its own VLAN with no additional identity verification required

30. A DevSecOps team wants to catch a vulnerable base-image library before a container reaches production rather than after deployment. At which point in the pipeline should the image be scanned to achieve this?

• A. Only after the container has been running in production for at least thirty days, once its behavior is well established
• B. Only during the annual penetration test, since container images are considered out of scope for continuous vulnerability scanning
• C. During the build stage in the CI/CD pipeline, scanning the image and its layers before it is pushed to the registry or deployed
• D. Only when a customer specifically requests a scan report, since routine build-time scanning is not part of standard container practice

31. An analyst is asked to explain why an OT network for a water treatment facility separates the process control network from the corporate IT network with a demilitarized zone rather than a single flat network. Which concept BEST explains this design?

• A. A cost-saving measure with no security purpose, since OT protocols like Modbus already include strong built-in encryption and mutual authentication by design specification
• B. A regulatory requirement that applies only to nuclear facilities and has no relevance to water treatment or other industrial environments
• C. A legacy convention from the 1990s that current ICS/SCADA security guidance actively recommends removing in favor of one flat network
• D. The Purdue Model's layered segmentation, which isolates safety-critical control systems from IT and external networks to limit the blast radius of a compromise

32. A security engineer configures a secrets vault so that a database credential used by an application is automatically rotated every 24 hours and is never written into application source code or configuration files. Which practice does this MOST directly support?

• A. Centralized secrets management with automated rotation, which limits how long a leaked credential remains valid if it is ever exposed
• B. Static credential embedding, which is considered best practice specifically because it lets developers audit every value directly in source control
• C. Shared account usage, where the same rotated credential is deliberately distributed to every employee to simplify onboarding and offboarding
• D. Storing a locally cached copy of the current rotated credential in an encrypted file on each application server for faster access

33. A compliance auditor asks why the SOC forwards logs from firewalls, endpoints, and the identity provider to a write-once storage tier in addition to the primary SIEM index. What security property does this write-once retention MOST directly support?

• A. Log compression, since write-once storage tiers are specifically optimized to reduce the on-disk size of raw event data by roughly half
• B. Log integrity, since data written to a write-once, read-many tier cannot be altered or deleted after ingestion, supporting evidentiary trust in the records
• C. Faster query performance, since write-once storage is indexed identically to the primary SIEM and returns search results more quickly
• D. Automatic threat detection, since simply storing logs in a write-once tier triggers every correlation rule instantly without any separate detection engineering

34. During a multi-source investigation, an analyst finds that timestamps from the firewall, the endpoint agent, and the identity provider disagree by several minutes, making it hard to establish the true order of events. Which underlying control gap MOST likely caused this?

• A. The SIEM's storage retention period was set too short, causing older events from each source to be purged before correlation could occur
• B. The firewall, endpoint agent, and identity provider were all configured to log in different character encodings, corrupting the timestamp fields
• C. Inconsistent or absent network time synchronization (NTP) across the log sources, so each system's clock drifted independently
• D. The analyst's browser cached an outdated version of the SIEM dashboard, displaying stale timestamps that no longer match the underlying data

35. An analyst is asked to write a YARA rule to detect a family of malware samples that share a distinctive byte sequence in their unpacked payload but use different file names and hashes across variants. Why is a YARA rule better suited to this task than a hash-based blocklist?

• A. A hash-based blocklist is actually the better tool here, since cryptographic hashes are specifically designed to remain identical across all variants of a malware family
• B. YARA rules can only be written for network traffic captures and cannot inspect the contents of a file on disk at all
• C. YARA and hash-based blocklists produce mathematically identical detection coverage, so the choice between them has no practical effect on this task
• D. YARA matches on patterns such as byte sequences, strings, and structural conditions within a file, so it still detects variants even when hashes and file names change

36. An analyst receives a suspicious email attachment and needs to quickly decode a Base64-encoded, then gzip-compressed payload embedded in the file to inspect its contents without executing it. Which category of tool is BEST suited to this specific task?

• A. A data manipulation and decoding toolkit that chains operations like Base64 decode and gzip decompression to reveal the payload safely
• B. A network-based vulnerability scanner, since decoding an email attachment's payload is functionally identical to scanning a host for missing patches
• C. A SOAR playbook editor, since decoding a single encoded attachment always requires building a full automated response workflow first
• D. An identity and access management console, since inspecting an encoded attachment is primarily a question of the analyst's account permissions

37. An analyst wants to check whether an external IP address that just triggered a firewall alert has a history of abuse reports, and separately wants to see which organization currently registers the domain it resolved from. Which two lookups accomplish this?

• A. A CVSS base score calculation for the address, and a software bill of materials lookup for the domain's web server software
• B. An IP reputation and abuse-report lookup for the address, and a WHOIS registration lookup for the domain
• C. A chain-of-custody log entry for the address, and a forensic disk image checksum for the domain's registrar
• D. A YARA rule scan of the address, and a packet capture filter built specifically for the domain's registrar's mail servers

38. A threat intelligence analyst wants to share newly discovered indicators of compromise with a partner organization in a structured, machine-readable format that both organizations' security tools can automatically ingest, rather than emailing a spreadsheet. Which capability BEST supports this?

• A. A shared spreadsheet emailed weekly, since structured exchange formats are considered slower to adopt across organizations than manual file transfer
• B. A printed report mailed to the partner's physical office, since automated ingestion of threat data is not supported by any current intelligence platform
• C. A threat intelligence platform that exports indicators in a structured, standardized exchange format both organizations' tools can automatically parse
• D. A verbal briefing given only once per quarter, since indicators of compromise are not the kind of information that benefits from timely automated sharing

39. An analyst reviewing Zeek network security monitor logs notices a connection log (conn.log) entry showing a long-duration, low-byte-count connection to an external host on an uncommon port, alongside a corresponding DNS log entry for a domain registered only days earlier. What does this combination MOST strongly suggest?

• A. A routine software update check, since long-duration low-byte connections to uncommon ports are the expected, well-documented behavior of standard patch management tools
• B. A misconfigured NTP time source causing the conn.log and DNS log timestamps to drift apart, which makes an otherwise unremarkable connection look more suspicious than it actually is
• C. Normal CDN load-balancing behavior, since content delivery networks routinely register new domains just days before pointing production traffic at them
• D. Likely command-and-control beaconing to newly registered infrastructure, since Zeek's protocol-aware logs reveal both the connection pattern and the domain's recent registration

40. A vulnerability scan returns a critical CVSS score for a missing patch on an internal file server that is accessible only from a tightly controlled management VLAN with no direct user or internet access. How should the analyst MOST appropriately factor this exposure into prioritization?

• A. Prioritize it identically to an internet-facing system with the same CVSS base score, since the base metric group alone determines priority regardless of network exposure
• B. Adjust priority downward relative to an equivalent internet-facing vulnerability, since compensating network controls reduce practical exploitability
• C. Ignore the finding completely because internal systems are never attacked
• D. Escalate it as the single highest priority in the organization regardless of other findings

41. An organization's vulnerability scanner reports a finding that later proves not to be exploitable because the vulnerable service is disabled on the host. What is this scan result BEST classified as?

• A. A true positive
• B. A false negative
• C. A false positive
• D. A true negative

42. When prioritizing remediation across hundreds of scan findings, which combination of factors gives the MOST risk-accurate prioritization?

• A. CVSS score combined with asset criticality, exposure, and known active exploitation
• B. CVSS base score alone
• C. Alphabetical order of the CVE identifiers
• D. The order in which the scan tool listed the findings in its default unsorted CSV export

43. A web application scan flags a parameter as vulnerable to SQL injection. Which remediation is MOST effective at addressing the root cause rather than just masking symptoms?

• A. Using parameterized queries (prepared statements) for all database interactions
• B. Hiding error messages returned by the database
• C. Renaming the vulnerable parameter to something less obvious while leaving the underlying query string concatenation unchanged
• D. Increasing the web server's request timeout value

44. An analyst compares two vulnerabilities with identical CVSS base scores of 8.8. Vulnerability A has a publicly available working exploit and is being actively used in the wild; Vulnerability B has no known public exploit. How should this affect remediation prioritization?

• A. Both should be treated identically since CVSS scores are equal
• B. Vulnerability A should be prioritized higher due to confirmed active exploitation increasing real-world risk
• C. Vulnerability B should be prioritized higher because it is less understood
• D. Neither should be prioritized until a third vulnerability with a matching CVSS temporal score is found for comparison

45. Which scanning approach requires valid login credentials to the target system and typically yields more accurate results by inspecting installed software, patch levels, and configuration directly?

• A. Uncredentialed (unauthenticated) scanning
• B. Credentialed (authenticated) scanning
• C. Passive network scanning only
• D. Port scanning without service detection

46. A vulnerability management program wants to reduce its attack surface on a legacy server that cannot be patched due to vendor end-of-life. Which compensating control is MOST appropriate?

• A. Do nothing since patching is impossible
• B. Expose the server directly to the internet on TCP port 3389 to simplify remote administrative access
• C. Disable all logging on the server to reduce noise
• D. Isolate the server on a segmented network with strict access control lists and enhanced monitoring

47. During a vulnerability assessment, an analyst identifies that a legacy protocol (Telnet) is enabled on several network devices, transmitting credentials in cleartext. What is the BEST remediation recommendation?

• A. Disable Telnet and replace it with SSH for encrypted management access
• B. Leave Telnet enabled but require longer passwords
• C. Restrict Telnet to only IPv6 addresses
• D. Change the default Telnet port number from TCP 23 to a non-standard high port above 10000

48. An organization's cloud infrastructure scan reveals a storage bucket configured with public read access containing sensitive customer records. From a vulnerability management perspective, what is the MOST accurate characterization of this finding?

• A. A low-severity configuration issue with no real risk
• B. A critical misconfiguration representing a data exposure risk requiring immediate remediation
• C. An expected and acceptable default state for cloud storage
• D. A finding that only affects availability, not confidentiality, since the bucket's replication settings remain private

49. A patch management team must decide how to handle a vendor-released patch for a critical remote code execution vulnerability affecting a business-critical production application. Testing shows the patch may break a custom integration. What is the BEST course of action?

• A. Apply the patch to production immediately without testing to close the vulnerability as fast as possible, accepting the resulting integration outage as an acceptable tradeoff
• B. Never apply the patch since it might break the integration
• C. Test the patch in a staging environment, coordinate remediation of the integration issue, and apply compensating controls until the patch can be safely deployed
• D. Uninstall the custom integration permanently without informing stakeholders

50. Which of the following BEST describes the purpose of penetration testing in relation to vulnerability scanning within a vulnerability management program?

• A. Penetration testing actively attempts to exploit identified weaknesses to validate real-world impact, complementing the broader coverage of automated scanning
• B. Penetration testing replaces the need for any vulnerability scanning
• C. Penetration testing is only ever performed by fully automated tools with no human tester involvement, making it functionally identical to a vulnerability scan
• D. Penetration testing and vulnerability scanning always test only web applications

51. An authenticated vulnerability scan returns substantially more findings than an unauthenticated scan of the same host. Why?

• A. Unauthenticated scanning is actually more thorough but intentionally reports fewer findings so the executive summary dashboard stays shorter for leadership review
• B. Credentialed scanning inspects installed software versions and configuration directly rather than inferring from network responses, producing more complete and more accurate results
• C. The difference is entirely random
• D. Authenticated scanning creates vulnerabilities on the host

52. An organization must decide the frequency of vulnerability scanning. What consideration should drive it?

• A. The scanner licence's maximum permitted scans
• B. The availability of the security team to read reports
• C. The rate at which the environment changes and new vulnerabilities are disclosed, since the interval between scans is a window of unknown exposure
• D. The calendar quarter boundaries for reporting convenience, aligning scan windows with the finance department's own closing schedule

53. A vulnerability scan reports a critical finding on a host. What must be established before treating it as critical to the organization?

• A. Whether the scanner was authenticated during the scan, since unauthenticated scans are logged in a separate report queue by most scanning platforms
• B. Whether the vulnerable component is actually reachable and in use, since severity scores describe the vulnerability rather than the organization's exposure to it
• C. Whether the vendor has released a patch only
• D. Whether other organizations have been exploited only

54. A reported vulnerability cannot be patched because the vendor no longer supports the product. What is the appropriate handling?

• A. Close the finding as not applicable since no patch exists
• B. Continue scanning without any other action
• C. Remove the system from the scan scope to clear the report, migrating its asset record into a separate decommissioned-systems tracking spreadsheet
• D. Apply compensating controls such as isolation, restricted access and enhanced monitoring, and record the accepted residual risk with an owner and a replacement plan

55. A scan finding is investigated and proves not to exist on the host. What has occurred and what should follow?

• A. A false positive, which should be documented and the scanner tuned, since repeated false positives erode confidence in the entire report
• B. A false negative, requiring the scan to be rerun
• C. A true positive that was remediated automatically
• D. A configuration error requiring the host to be rebuilt from a known-good golden image and re-enrolled in the scanner's asset inventory

56. A web application scan reports a SQL injection finding. How should the analyst verify it before escalating?

• A. Exploit it fully against the live production database to demonstrate impact, extracting and publishing real customer records as proof
• B. Escalate immediately without any verification
• C. Confirm the behaviour in a controlled, authorized manner against a non-production instance where possible, documenting the evidence
• D. Assume it is a false positive and close it

57. An organization must prioritize among thousands of open vulnerabilities. What information most improves prioritization beyond severity?

• A. Whether the vulnerability is being actively exploited in the wild, which changes the probability of attack far more than the score alone
• B. The number of characters in the vulnerability identifier string, which some legacy ticketing systems use to auto-sort the remediation backlog
• C. The age of the scanning tool's signature database
• D. The alphabetical order of the affected products

58. A cloud workload's configuration is scanned rather than its software. What class of finding does this surface?

• A. Only missing operating system patches, the exact same class of finding a fully credentialed, host-based authenticated vulnerability scanner already reports
• B. Misconfiguration such as overly permissive access, public exposure or absent logging, which causes a large share of cloud incidents independently of software vulnerabilities
• C. Only application source code defects
• D. Only expired TLS certificates

59. An analyst must assess the risk of a vulnerability in a third-party library used across many applications. What complicates the response?

• A. The library's licence terms
• B. The programming language the library is written in, since some legacy static analysis tools only support scanning a small handful of specific popular languages
• C. Determining which applications actually include the library and whether the vulnerable function is reachable, which requires dependency inventory the organization may not have
• D. The number of contributors to the library

60. A penetration test report and a vulnerability scan report are both received. How do their findings differ in character?

• A. The scan actually proves exploitability against production systems while the test merely enumerates the same issues a scanner's plugin database would already recognize automatically
• B. Both produce identical findings by different means
• C. The test covers only physical security
• D. The test demonstrates exploitable paths and their business impact on a smaller set of issues, while the scan enumerates a far larger set of potential weaknesses without proving exploitability

61. A CVSS v4.0 base score for a vulnerability shows an Attack Vector of Network, Attack Complexity of Low, and no privileges required, but the environmental score is later adjusted downward significantly by the analyst. Which factor MOST likely justifies that adjustment?

• A. The base score calculation was performed incorrectly by the scanner and should be recalculated using the Attack Requirements metric
• B. The vulnerability has since been assigned a new CVE identifier
• C. The vendor released a blog post describing the vulnerability
• D. The affected asset sits in a segmented environment with compensating controls that reduce real-world exploitability

62. An organization runs the same authenticated vulnerability scan monthly against a server farm. This month, a previously reported critical finding no longer appears, but no patch was deployed and no change ticket exists for that host. What should the analyst do?

• A. Investigate why the finding disappeared without a corresponding remediation record, since this could indicate scan failure, agent issues, or unauthorized changes
• B. Assume the vulnerability was a false positive originally, close it, and lower the scanner's authentication timeout setting to avoid similar alarms later
• C. Reduce the scan frequency since the finding is no longer present
• D. Escalate directly to law enforcement without further investigation

63. A vulnerability management team is choosing between agent-based and network-based scanning for a fleet of laptops that frequently leave the corporate network. Which factor MOST favors an agent-based approach for this asset group?

• A. Agent-based scanning requires no software installation on endpoints
• B. Agents can continue scanning and reporting even when the laptop is off the corporate network
• C. Agent-based scanning always produces lower false-positive rates than network scanning regardless of plugin configuration
• D. Agent-based scanning eliminates the need for credentialed access entirely

64. A remediation team wants to reduce exposure on a legacy industrial control system that cannot be patched or taken offline for business-continuity reasons. Which compensating control BEST reduces risk without altering the vulnerable software itself?

• A. Upgrading the operating system to the newest version immediately
• B. Installing the latest vendor patch despite the compatibility risk, even though the scenario states the system cannot be taken offline to apply it
• C. Placing the system behind a dedicated firewall segment with strict access control lists limiting connectivity to only required hosts
• D. Ignoring the finding since the system cannot be patched

65. A software composition analysis tool flags a critical vulnerability in an open-source library embedded in a homegrown application. The library is used indirectly through several layers of nested dependencies. What is the analyst's BEST first step?

• A. Ignore the finding since it is only an indirect dependency
• B. Wait for the application's original developers to leave the company before acting, treating any SBOM lookup as unnecessary paperwork in the meantime
• C. Delete the application since the dependency cannot be traced
• D. Generate or consult a software bill of materials (SBOM) to trace exactly where and how the vulnerable library is used before determining remediation

66. During a scan review, an analyst finds a finding classified with high confidence that turns out, upon manual verification, to genuinely exist and be exploitable. What term correctly describes this scan result?

• A. True positive
• B. False positive
• C. False negative
• D. Indicator of compromise

67. An organization's change advisory board delays deploying a critical security patch to a production database server because the patch window conflicts with a quarter-end financial close. What is the MOST appropriate action for the vulnerability management team in the interim?

• A. Deploy the patch anyway without change approval since it is critical
• B. Recommend and implement interim compensating controls, such as enhanced monitoring or restricted access, until the patch can be applied
• C. Permanently remove the vulnerability from the tracking system
• D. Take no action until the approved patch window since the change advisory board's delay counts as formal, documented risk acceptance by the business

68. Which of the following BEST describes the purpose of a vulnerability scanner's plugin or signature database?

• A. It encrypts network traffic between the scanner and target hosts using TLS 1.3 so scan results cannot ever be intercepted in transit
• B. It stores the organization's incident response playbooks
• C. It contains the checks used to detect known vulnerabilities, misconfigurations, and missing patches on target systems
• D. It logs all successful user authentications across the network

69. An incident responder is analyzing a suspected ransomware infection. Which action should be taken FIRST to limit damage while preserving the ability to investigate?

• A. Wait 24 hours to observe further behavior before taking any action, allowing encryption and lateral movement to continue completely unchecked
• B. Isolate the affected host from the network (e.g., disable its network interface) while keeping it powered on for potential memory analysis
• C. Power off the affected system completely before any analysis
• D. Delete all files on the host immediately to stop the spread

70. During incident response, which order BEST reflects the standard phases of the incident response lifecycle as commonly taught?

• A. Eradication, Preparation, Containment, Detection, Recovery, Lessons Learned, matching the NIST SP 800-61 framework order
• B. Lessons Learned, Preparation, Detection, Eradication, Containment, Recovery
• C. Recovery, Containment, Detection, Preparation, Eradication, Lessons Learned
• D. Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Lessons Learned)

71. An analyst is calculating chain of custody documentation while collecting a forensic disk image from a compromised server. What is the PRIMARY reason this documentation is critical?

• A. It replaces the need for cryptographic hashing of the evidence, since a signed custody log alone proves the image was not altered
• B. It speeds up the imaging process technically
• C. It is only needed for external audits, not incident response
• D. It establishes an unbroken record of who handled the evidence and when, supporting its admissibility and integrity

72. A responder needs to preserve volatile data before it is lost during an active incident. Per the standard order of volatility, which of the following should generally be collected FIRST?

• A. Data on backup tapes stored offsite
• B. Files stored on the local hard disk
• C. Printed documentation retained in the server room's locked fireproof cabinet for the legally required seven-year period
• D. Contents of RAM and active network connections

73. An incident response team determines that an attacker gained access via a phished credential and has been dormant in the environment for several weeks, moving laterally between systems. Which containment strategy BEST balances stopping further damage with preserving evidence for full scope determination?

• A. Take no containment action until the full scope of compromise is confirmed with certainty
• B. Apply targeted containment (disabling the compromised account, isolating known-affected hosts) while continuing to monitor for additional indicators before full eradication
• C. Immediately terminate all user accounts across the entire organization
• D. Immediately wipe and rebuild every server in the environment without further investigation, restoring each one from the most recent nightly backup snapshot

74. A company's incident response plan requires notifying specific regulatory bodies within a defined time window after confirming a breach involving personal data. Which document or process would MOST likely define this specific obligation?

• A. The vulnerability scanning schedule
• B. The organization's data breach notification policy, informed by applicable legal/regulatory requirements
• C. The company's marketing brand style guide
• D. The network diagram maintained by IT operations, since it lists every regulator's public contact information

75. During post-incident review (lessons learned), the team identifies that a critical alert was missed because analysts were overwhelmed by low-fidelity noise from a poorly tuned rule. What is the MOST appropriate long-term corrective action?

• A. Take no action since the incident has already been resolved
• B. Improve detection rule tuning and alert prioritization to reduce noise and surface high-fidelity alerts more effectively
• C. Hire more analysts without changing any detection tuning
• D. Add a 30-day suppression filter for this exact alert pattern so the noise stops while the team focuses on other priorities

76. During incident response, an analyst must decide whether to isolate a compromised host immediately. What is the tension?

• A. Isolation destroys all forensic evidence on the host
• B. Isolation stops further damage but alerts the attacker and may end the opportunity to observe their objectives and full footprint
• C. Isolation is only technically possible after the investigation concludes and every affected host has been individually imaged for evidence
• D. Isolation has no downside and should always be immediate

77. Evidence is collected from a compromised system. In what order should sources be captured?

• A. In whatever order the tooling completes fastest
• B. Archived backups first, since they are furthest from the incident and stored on a separate offsite retention schedule
• C. Most volatile first, beginning with memory and network connections before disk and archived data
• D. Disk images first, since they contain the most data

78. An analyst images a disk for forensic analysis. What step establishes that the image is a faithful copy?

• A. Computing a cryptographic hash of the source and the image and confirming they match, with a write blocker preventing modification of the source
• B. Comparing the file counts between source and image
• C. Opening the image and browsing the file system visually
• D. Confirming the image file size is larger than the source, which some older imaging tools report after adding padding sectors

79. During eradication, the team removes the attacker's known persistence mechanism. What must be verified before declaring the incident closed?

• A. That the incident ticket has been assigned a severity rating high enough to satisfy the mandatory closure threshold the ticketing workflow itself enforces
• B. That the affected user has changed their desktop wallpaper
• C. That the antivirus signature database is current only
• D. That the initial access vector is closed and no other persistence remains, since removing one mechanism while the entry path stays open invites immediate reinfection

80. A host shows a scheduled task created at an unusual hour running an executable from a user profile directory. What technique does this pattern suggest?

• A. Data exfiltration over an encrypted channel
• B. A denial of service against the local host
• C. Normal software update behaviour requiring no review, matching the update schedule most vendors publish for patch Tuesday releases
• D. Persistence, since scheduled tasks survive reboots and a user-writable location avoids requiring elevated privilege to place the payload

81. An analyst automates a repetitive containment action through a response playbook. What should govern which steps are automated?

• A. Avoiding automation entirely so an analyst reviews each action
• B. Automating only steps that generate no logs
• C. The reversibility and confidence of the action, so high-confidence reversible steps run automatically while disruptive or irreversible ones require human approval
• D. Automating every step to minimize response time, since the vendor's default playbook template already ships with each contained action pre-approved for use

82. During an active intrusion, an analyst confirms an attacker has established multiple footholds across several systems using different persistence mechanisms. Immediately isolating the first discovered host risks alerting the attacker before full scope is known. What approach BEST balances these competing concerns?

• A. Take no containment action until every single compromised host is identified
• B. Isolate each host on the network in one single visible action, immediately alerting the attacker even before the remaining scope is confirmed
• C. Perform quiet, coordinated containment across identified footholds simultaneously while continuing scoping efforts on any remaining unknowns
• D. Notify the attacker's ISP and wait for their response before acting

83. A forensic analyst must decide the order in which to collect evidence from a live, compromised system before it is powered down for imaging. Which of the following correctly reflects a MORE volatile data source that should generally be prioritized over a LESS volatile one?

• A. Contents of system memory (RAM) are more volatile than data stored on the local hard disk
• B. Disk image data is more volatile than data held in RAM
• C. Archived log files retained on backup tape under a 90-day rotation policy are considered more volatile than the live state of an active network connection
• D. Data stored on disk is more volatile than data stored on backup media

84. After eradicating a confirmed persistence mechanism during an incident, the response team wants to declare the incident closed. Which action is MOST important to complete FIRST before closure?

• A. Immediately delete all forensic images to free up storage
• B. Restore all systems from the most recent backup without further verification, since the backup predates the original point of compromise
• C. Publish the incident details externally to warn other organizations
• D. Verify through monitoring and follow-up scanning that no additional persistence mechanisms or indicators of compromise remain active

85. A breach involving customer personal data affects individuals across multiple states and countries. Beyond the technical incident response, which additional obligation MOST likely arises for the organization?

• A. A requirement to publicly release the full forensic investigation report, including raw memory images, on the company website
• B. An obligation to immediately terminate all affected employees
• C. Legal and regulatory notification requirements to affected individuals and applicable authorities within defined timeframes
• D. A requirement to disable the organization's entire network permanently

86. During the lessons-learned phase of an incident, the team identifies that a critical detection gap allowed an attacker to persist undetected for weeks. Which corrective action MOST directly addresses the root cause rather than just the symptom?

• A. Purchase a new SIEM platform without addressing the underlying gap
• B. Increase the number of analysts on shift without changing any detection coverage at all, leaving the same undetected technique fully free to recur later
• C. Document the gap in the report and take no further action
• D. Develop and deploy a new detection rule or data source specifically targeting the technique that went undetected, then validate it catches the behavior

87. A CySA+ analyst needs to communicate a newly discovered vulnerability to the software development team responsible for the affected application. Which element is MOST important to include to enable an effective and efficient fix?

• A. A general statement that 'security issues exist' with no further detail, reproduction steps, or affected file names
• B. Specific reproduction steps, affected component/code location, and business risk context
• C. Only the CVSS numeric score with no other context
• D. A request to shut down the entire application indefinitely

88. A CySA+ analyst is writing an executive summary of a recent security incident for senior leadership who are not technical. Which approach is MOST appropriate for this audience?

• A. Include full raw packet captures and unfiltered log dumps with no summarization
• B. Use only technical jargon and CVE identifiers with no context
• C. Omit any mention of business impact since leadership only cares about the technical root cause and the specific CVE identifiers involved
• D. Focus on business impact, risk, and remediation status in plain language, with technical detail available in an appendix if needed

89. Which metric BEST measures how quickly a security operations team detects a threat after it first enters the environment?

• A. Mean Time to Detect (MTTD)
• B. Return on Investment (ROI) of the SOC budget
• C. Number of open job requisitions on the security team
• D. Mean Time to Repair (MTTR) for hardware failures

90. When communicating risk to a business stakeholder who must decide whether to accept, mitigate, transfer, or avoid a given risk, which framing is MOST useful?

• A. Framing risk in terms of likelihood and potential business impact, alongside available response options and their costs
• B. Presenting only worst-case scenarios without discussing probability
• C. Describing risk purely in terms of technical CVE numbers and raw CVSS base scores with no likelihood, impact, or cost discussion attached
• D. Telling the stakeholder that the decision is not their responsibility

91. An incident involves personal data of customers in several countries. What obligation arises alongside the technical response?

• A. Deferring any legal assessment until the technical investigation is complete, since most regulators are understood to extend filing deadlines informally
• B. Notifying all customers immediately regardless of the facts established
• C. Assuming a single notification satisfies all jurisdictions
• D. Assessing notification requirements under each applicable regime, since deadlines and thresholds differ and legal counsel determines what must be reported and when

92. An analyst prepares an incident report for executive leadership. What should it emphasize?

• A. A packet-level analysis of the attacker's traffic
• B. Business impact, what was affected, what is being done, decisions required and the timeline, with technical detail available but not leading
• C. The full text of every log entry collected
• D. The analyst's personal assessment of who is at fault, drawn from informal HR interviews conducted during the response effort

93. A vulnerability management programme reports remediation metrics. Which metric best reflects risk reduction?

• A. The total number of findings closed per month, a figure most vulnerability management dashboards already surface as the headline chart
• B. The number of scans executed per month
• C. Time to remediate weighted by risk, since closing many low-risk findings quickly can accompany critical ones remaining open for months
• D. The size of the vulnerability database

94. A security team must communicate a required patch to a business unit that resists the disruption. What approach is most effective?

• A. Escalating immediately to executive leadership without discussion, citing the CVSS score alone as sufficient justification for overriding the business unit
• B. Applying the patch without notification to avoid the argument
• C. Withdrawing the request to preserve the relationship
• D. Presenting the specific risk to that unit's operations and offering options such as a maintenance window or compensating controls, rather than asserting policy alone

95. An analyst must recommend a detection improvement after an incident. What makes the recommendation actionable?

• A. Recommending that monitoring be improved generally
• B. Recommending the purchase of additional tooling without any specifics on which data source, field, or detection threshold it should monitor
• C. Recommending that users be more careful
• D. Specifying the data source, the observable behaviour and the logic, so the detection can be implemented and tested rather than aspired to

96. Security tooling generates a metric showing mean time to detect has increased. What should be investigated?

• A. Whether detection coverage has degraded, whether alert volume is delaying triage, or whether the incidents detected simply differed in character from prior periods
• B. Only whether more analysts should be hired
• C. Only the vendor's product roadmap
• D. Nothing, since the metric fluctuates naturally and most dashboards already smooth it out with a trailing twelve-month moving average calculation

97. A security team tracks both mean time to detect (MTTD) and mean time to respond (MTTR) across incidents each quarter. An executive asks which metric best reflects how quickly the team notices a threat once it enters the environment, as opposed to how quickly it is resolved. Which metric answers that question?

• A. Mean time to detect (MTTD)
• B. Mean time to respond (MTTR)
• C. Number of open vulnerabilities at quarter end
• D. Total number of incidents reported

98. An analyst is preparing two different reports on the same vulnerability finding: one for the development team that will fix the code and one for a business unit director who will decide on resourcing. Which approach BEST fits this dual-audience need?

• A. Send the identical highly technical report to both audiences to save time, trusting each reader to extract the parts relevant to their own role
• B. Tailor each report's content and framing to its audience: technical remediation detail for developers, and business risk and resourcing impact for the director
• C. Send only the CVSS score to both audiences without further explanation
• D. Omit technical details from the developer report to keep it brief

99. A CySA+ analyst must present a risk to a business stakeholder who will decide whether to accept, mitigate, transfer, or avoid it. Which framing of the finding is MOST useful for supporting that decision?

• A. The full technical exploit code demonstrating the vulnerability
• B. The exact CVSS vector string and its component metric values
• C. The likelihood and potential business impact of the risk, expressed in terms the stakeholder can weigh against cost and operational disruption
• D. A list of every CVE identifier related to the affected software over the past decade, sorted by publication date rather than by current exposure

100. A quarterly security report shows the number of critical vulnerabilities remediated has increased, but the average age of open critical findings has also increased. What does this combination MOST likely indicate to a reviewing stakeholder?

• A. The scanning tool is malfunctioning and should be replaced
• B. No further analysis is needed since remediation volume increased
• C. The vulnerability management program has fully eliminated its backlog, since the remediation count itself rose during this same reporting period
• D. New critical findings are being discovered or introduced faster than the team can remediate them, growing the backlog despite higher output