During log review, an analyst sees a spike in outbound traffic on port 443 from a server that normally only receives inbound HTTPS connections. What is the BEST next step?

Investigate the anomaly further, including reviewing the destination IP reputation and process making the connection

Ignore it since port 443 is always associated with legitimate encrypted web traffic

Immediately reformat the server without further analysis

Block all outbound traffic on the network to contain any possible threat

An analyst is tuning a SIEM's correlation rules after a period of high false-positive alerts from a threat-intel-fed rule flagging any connection to IPs on a public blocklist. Which action BEST improves signal quality without reducing overall detection coverage?

Add contextual conditions (e.g., requiring the connection to originate from a sensitive asset or include unusual data volume) before the rule fires

Disable the rule entirely so analysts stop seeing alerts from it

Increase the alert severity so every match pages the on-call analyst immediately

Remove the threat intelligence feed from the SIEM entirely

A threat hunter wants to proactively search for adversary behavior that has not yet triggered any automated alert. Which approach BEST describes this activity?

Formulating a hypothesis based on known TTPs and searching telemetry for matching evidence

Running a scheduled vulnerability scan against all subnets

Waiting for the SIEM to generate an alert and then investigating it

Patching all systems flagged as high-risk by the last scan

An analyst is deploying a host-based detection tool that must observe process creation, file modification, and registry changes on endpoints in real time. Which technology BEST fits this requirement?

Endpoint Detection and Response (EDR)

A network-based intrusion prevention system (NIPS) only

A web application firewall (WAF)

A security analyst reviewing NetFlow data notices a workstation transferring large volumes of data to an external IP over several hours during off-business hours. Assuming no known business justification exists, this pattern MOST strongly suggests which activity?

ARP resolution broadcast traffic

Which of the following is the PRIMARY benefit of mapping detected adversary behavior to the MITRE ATT&CK framework during security operations?

It provides a common taxonomy of tactics and techniques that helps standardize detection engineering and gap analysis

It guarantees that all zero-day exploits will be automatically blocked

It replaces the need for a SIEM entirely

It eliminates the need for any human analyst review

An analyst configures a rule to alert whenever a service account that normally only runs batch jobs at 2 AM authenticates interactively during business hours. This is an example of which detection approach?

Behavioral/anomaly-based detection using a baseline of normal activity

A CySA+ candidate is asked why organizations deploy deception technology such as honeypots within a production network segment. What is the PRIMARY purpose?

To attract and detect attacker activity early by presenting an enticing but monitored fake target

To permanently replace production servers

To provide additional bandwidth for legitimate users

To automatically patch vulnerabilities on real production systems

A vulnerability scan returns a critical CVSS score for a missing patch on an internal file server that is accessible only from a tightly controlled management VLAN with no direct user or internet access. How should the analyst MOST appropriately factor this exposure into prioritization?

Adjust priority downward relative to an equivalent internet-facing vulnerability, since compensating network controls reduce practical exploitability

Prioritize it identically to an internet-facing system with the same CVSS base score, since CVSS alone determines priority

Ignore the finding completely because internal systems are never attacked

Escalate it as the single highest priority in the organization regardless of other findings

← All practice tests

PRACTICE ENGINE · COMPTIA CYSA+

CompTIA CySA+ Practice Test.

88 free practice questions with answers and explanations.

No signup required. Choose a topic and review each answer.

Start practicing →

About these practice questions

Written by Every Exam Prep Editorial TeamSource and review policy

Verified against the official content outline July 18, 2026

These are original study questions written from published exam objectives—not recalled, copied, or confidential live-exam items. Always confirm current coverage with the official sources linked on this page.

Exam format and study resources

The CompTIA CySA+ is administered by CompTIA, with 85 scored questions, a 2 hours 45 minutes time limit and a 750 (on a scale of 100-900) result.

This free CompTIA CySA+ practice test has 88 original questions written to CompTIA's official content outline, last checked against it on July 18, 2026. Every question shows a worked explanation, and nothing here requires a signup.

Practice topic

Difficulty

QUESTION 1 / 88Security OperationsMedium0/0

A SOC analyst notices that a Windows workstation is repeatedly resolving DNS queries for domains with high entropy (e.g., xkq93jf.badnet.com) at short, regular intervals. Which technique is MOST likely being observed?

0/0session

0 answers saved

Browse all questions & answers

1. A SOC analyst notices that a Windows workstation is repeatedly resolving DNS queries for domains with high entropy (e.g., xkq93jf.badnet.com) at short, regular intervals. Which technique is MOST likely being observed?
- A. A domain generation algorithm (DGA) used by malware to locate a command-and-control server
- B. Normal DNS caching behavior by the operating system
- C. A legitimate content delivery network performing load balancing
- D. DNS zone transfer between authoritative name servers
Show answer & explanation
Answer: A
High-entropy, algorithmically generated domain names queried at regular intervals are a classic indicator of a DGA, which malware uses to evade static blocklists while finding its C2 infrastructure. DNS caching does not produce novel random-looking domains, CDNs use recognizable branded domains, and zone transfers occur between name servers (AXFR/IXFR) rather than from an endpoint querying external random names.
2. During log review, an analyst sees a spike in outbound traffic on port 443 from a server that normally only receives inbound HTTPS connections. What is the BEST next step?
- A. Ignore it since port 443 is always associated with legitimate encrypted web traffic
- B. Investigate the anomaly further, including reviewing the destination IP reputation and process making the connection
- C. Immediately reformat the server without further analysis
- D. Block all outbound traffic on the network to contain any possible threat
Show answer & explanation
Answer: B
A behavioral change (a normally inbound-only server suddenly generating outbound traffic) warrants investigation before any containment or eradication action; encryption on a common port does not guarantee legitimacy since attackers frequently use 443 for encrypted exfiltration or C2. Ignoring the anomaly risks missing a real compromise, reformatting destroys evidence and is premature, and blocking all outbound traffic network-wide is a disproportionate response to an unconfirmed single-host anomaly.
3. An analyst is tuning a SIEM's correlation rules after a period of high false-positive alerts from a threat-intel-fed rule flagging any connection to IPs on a public blocklist. Which action BEST improves signal quality without reducing overall detection coverage?
- A. Disable the rule entirely so analysts stop seeing alerts from it
- B. Add contextual conditions (e.g., requiring the connection to originate from a sensitive asset or include unusual data volume) before the rule fires
- C. Increase the alert severity so every match pages the on-call analyst immediately
- D. Remove the threat intelligence feed from the SIEM entirely
Show answer & explanation
Answer: B
Adding contextual enrichment (asset criticality, behavioral thresholds) narrows a noisy rule to higher-fidelity conditions while preserving detection capability, which is a standard SIEM tuning practice. Disabling the rule or removing the feed eliminates detection coverage entirely, and raising severity without improving precision only worsens alert fatigue by escalating more false positives.
4. A threat hunter wants to proactively search for adversary behavior that has not yet triggered any automated alert. Which approach BEST describes this activity?
- A. Running a scheduled vulnerability scan against all subnets
- B. Formulating a hypothesis based on known TTPs and searching telemetry for matching evidence
- C. Waiting for the SIEM to generate an alert and then investigating it
- D. Patching all systems flagged as high-risk by the last scan
Show answer & explanation
Answer: B
Threat hunting is a proactive, hypothesis-driven process where the analyst uses knowledge of adversary tactics, techniques, and procedures (often mapped to frameworks like MITRE ATT&CK) to search telemetry for evidence that automated detections may have missed. Vulnerability scanning identifies weaknesses rather than active adversary behavior, reactive alert triage is not proactive hunting, and patching is a remediation activity, not detection.
5. An analyst is deploying a host-based detection tool that must observe process creation, file modification, and registry changes on endpoints in real time. Which technology BEST fits this requirement?
- A. Endpoint Detection and Response (EDR)
- B. A network-based intrusion prevention system (NIPS) only
- C. A web application firewall (WAF)
- D. An email gateway spam filter
Show answer & explanation
Answer: A
EDR agents run on the host itself and provide deep visibility into process execution, file system, and registry activity, along with response capabilities like isolation. A NIPS inspects network traffic rather than host-level OS activity, a WAF protects web applications from HTTP-layer attacks, and an email gateway filters messages rather than monitoring endpoint behavior.
6. A security analyst reviewing NetFlow data notices a workstation transferring large volumes of data to an external IP over several hours during off-business hours. Assuming no known business justification exists, this pattern MOST strongly suggests which activity?
- A. Routine Windows Update traffic
- B. Data exfiltration
- C. A DHCP lease renewal
- D. ARP resolution broadcast traffic
Show answer & explanation
Answer: B
Sustained, large-volume outbound transfers to an external destination during off-hours with no legitimate business reason is a hallmark indicator of data exfiltration, often used by threat hunters as a behavioral anomaly to investigate. Windows Update traffic is typically smaller and follows recognizable Microsoft endpoints, DHCP lease renewals are small and periodic broadcast/unicast exchanges, and ARP is confined to the local broadcast domain and cannot explain sustained external transfer.
7. Which of the following is the PRIMARY benefit of mapping detected adversary behavior to the MITRE ATT&CK framework during security operations?
- A. It guarantees that all zero-day exploits will be automatically blocked
- B. It replaces the need for a SIEM entirely
- C. It eliminates the need for any human analyst review
- D. It provides a common taxonomy of tactics and techniques that helps standardize detection engineering and gap analysis
Show answer & explanation
Answer: D
ATT&CK provides a shared, structured vocabulary of adversary tactics and techniques that analysts use to map detections, identify coverage gaps, and communicate findings consistently across teams. It does not block zero-days on its own, does not replace SIEM tooling (which remains the mechanism for collecting and correlating telemetry), and does not eliminate the need for human analysis and judgment.
8. An analyst configures a rule to alert whenever a service account that normally only runs batch jobs at 2 AM authenticates interactively during business hours. This is an example of which detection approach?
- A. Signature-based detection
- B. Behavioral/anomaly-based detection using a baseline of normal activity
- C. Passive vulnerability scanning
- D. Static malware analysis
Show answer & explanation
Answer: B
Comparing observed activity against an established baseline of normal behavior (a service account's typical login pattern) to flag deviations is the definition of behavioral/anomaly-based detection. Signature-based detection matches known patterns of malicious code or traffic rather than behavioral baselines, passive vulnerability scanning identifies weaknesses without analyzing runtime behavior, and static malware analysis examines file characteristics without execution.
9. A CySA+ candidate is asked why organizations deploy deception technology such as honeypots within a production network segment. What is the PRIMARY purpose?
- A. To permanently replace production servers
- B. To attract and detect attacker activity early by presenting an enticing but monitored fake target
- C. To provide additional bandwidth for legitimate users
- D. To automatically patch vulnerabilities on real production systems
Show answer & explanation
Answer: B
Honeypots and other deception assets are decoys designed to lure attackers so their reconnaissance and exploitation activity can be observed and alerted on early, without risk to real production data. They are not meant to serve legitimate business traffic, do not add usable bandwidth, and have no mechanism to patch vulnerabilities elsewhere in the environment.
10. A vulnerability scan returns a critical CVSS score for a missing patch on an internal file server that is accessible only from a tightly controlled management VLAN with no direct user or internet access. How should the analyst MOST appropriately factor this exposure into prioritization?
- A. Prioritize it identically to an internet-facing system with the same CVSS base score, since CVSS alone determines priority
- B. Adjust priority downward relative to an equivalent internet-facing vulnerability, since compensating network controls reduce practical exploitability
- C. Ignore the finding completely because internal systems are never attacked
- D. Escalate it as the single highest priority in the organization regardless of other findings
Show answer & explanation
Answer: B
Effective vulnerability management considers environmental context (CVSS environmental/temporal factors) alongside the base score; restricted network access meaningfully lowers real-world exploitability compared to an equivalent internet-facing flaw, so relative prioritization should reflect that. Treating CVSS base score as the sole determinant, ignoring the finding outright, or blindly escalating it above all else in a limited-exposure context all fail to properly apply risk-based prioritization.
11. An organization's vulnerability scanner reports a finding that later proves not to be exploitable because the vulnerable service is disabled on the host. What is this scan result BEST classified as?
- A. A true positive
- B. A false positive
- C. A false negative
- D. A true negative
Show answer & explanation
Answer: B
A false positive occurs when a scanner reports a vulnerability that does not actually pose risk under real conditions, as is the case here since the vulnerable service is disabled and therefore not exploitable. A true positive would mean the vulnerability is genuinely present and exploitable, a false negative would mean an actual vulnerability was missed by the scan, and a true negative means no vulnerability existed and none was reported.
12. When prioritizing remediation across hundreds of scan findings, which combination of factors gives the MOST risk-accurate prioritization?
- A. CVSS score combined with asset criticality, exposure, and known active exploitation
- B. CVSS base score alone
- C. Alphabetical order of the CVE identifiers
- D. The order in which the scan tool listed the findings
Show answer & explanation
Answer: A
Risk-based vulnerability prioritization combines the technical severity (CVSS) with business context such as asset criticality, network exposure, and threat intelligence on active exploitation to determine true organizational risk, rather than relying on any single or arbitrary factor. CVSS alone ignores business context, alphabetical CVE ordering and default tool output order have no bearing on actual risk and are effectively random with respect to prioritization.
13. A web application scan flags a parameter as vulnerable to SQL injection. Which remediation is MOST effective at addressing the root cause rather than just masking symptoms?
- A. Hiding error messages returned by the database
- B. Using parameterized queries (prepared statements) for all database interactions
- C. Renaming the vulnerable parameter to something less obvious
- D. Increasing the web server's request timeout value
Show answer & explanation
Answer: B
Parameterized queries separate SQL code from user-supplied data so injected input cannot be interpreted as executable SQL, directly addressing the root cause of SQL injection. Hiding error messages reduces information disclosure but does not stop the injection itself, renaming a parameter is security through obscurity and trivially bypassed, and adjusting request timeouts has no bearing on how input is parsed by the database.
14. An analyst compares two vulnerabilities with identical CVSS base scores of 8.8. Vulnerability A has a publicly available working exploit and is being actively used in the wild; Vulnerability B has no known public exploit. How should this affect remediation prioritization?
- A. Both should be treated identically since CVSS scores are equal
- B. Vulnerability B should be prioritized higher because it is less understood
- C. Vulnerability A should be prioritized higher due to confirmed active exploitation increasing real-world risk
- D. Neither should be prioritized until a third vulnerability is found for comparison
Show answer & explanation
Answer: C
Threat intelligence about active, real-world exploitation is a temporal/contextual factor that increases actual risk beyond the static base score, so Vulnerability A represents a more urgent, immediate threat and should be remediated first. Treating both identically ignores available threat context, prioritizing the less-understood one over the actively exploited one inverts real risk, and there's no reason prioritization must wait on unrelated findings.
15. Which scanning approach requires valid login credentials to the target system and typically yields more accurate results by inspecting installed software, patch levels, and configuration directly?
- A. Uncredentialed (unauthenticated) scanning
- B. Passive network scanning only
- C. Credentialed (authenticated) scanning
- D. Port scanning without service detection
Show answer & explanation
Answer: C
Credentialed scans log into the target with valid credentials, allowing the scanner to enumerate installed packages, patch levels, and local configuration directly, producing far fewer false positives/negatives than external probing alone. Uncredentialed scans only see what's exposed externally, passive scanning merely observes traffic without actively querying configuration, and basic port scanning without service detection reveals only open ports, not patch or configuration state.
16. A vulnerability management program wants to reduce its attack surface on a legacy server that cannot be patched due to vendor end-of-life. Which compensating control is MOST appropriate?
- A. Do nothing since patching is impossible
- B. Isolate the server on a segmented network with strict access control lists and enhanced monitoring
- C. Expose the server directly to the internet to simplify remote access
- D. Disable all logging on the server to reduce noise
Show answer & explanation
Answer: B
When patching is not possible, isolating the asset behind network segmentation with restrictive ACLs and heightened monitoring is a standard compensating control that reduces exploitability and improves detection of any attempted attack. Doing nothing leaves the vulnerability fully exposed, exposing the server to the internet dramatically increases risk, and disabling logging removes the visibility needed to detect exploitation attempts on an unpatchable system.
17. During a vulnerability assessment, an analyst identifies that a legacy protocol (Telnet) is enabled on several network devices, transmitting credentials in cleartext. What is the BEST remediation recommendation?
- A. Leave Telnet enabled but require longer passwords
- B. Change the default Telnet port number to a non-standard port
- C. Disable Telnet and replace it with SSH for encrypted management access
- D. Restrict Telnet to only IPv6 addresses
Show answer & explanation
Answer: C
Telnet's fundamental weakness is that it transmits all data, including credentials, in cleartext; the only effective remediation is replacing it with an encrypted protocol like SSH. Longer passwords, IPv6 restriction, or changing the port do nothing to encrypt the traffic itself and leave credentials just as exposed to interception.
18. An organization's cloud infrastructure scan reveals a storage bucket configured with public read access containing sensitive customer records. From a vulnerability management perspective, what is the MOST accurate characterization of this finding?
- A. A low-severity configuration issue with no real risk
- B. A critical misconfiguration representing a data exposure risk requiring immediate remediation
- C. An expected and acceptable default state for cloud storage
- D. A finding that only affects availability, not confidentiality
Show answer & explanation
Answer: B
A publicly readable storage bucket containing sensitive records is a serious confidentiality-impacting misconfiguration since anyone on the internet could access customer data, warranting urgent remediation (restricting access and auditing for prior exposure). It is not low severity or an acceptable default, and its primary impact is on confidentiality (unauthorized disclosure), not availability.
19. A patch management team must decide how to handle a vendor-released patch for a critical remote code execution vulnerability affecting a business-critical production application. Testing shows the patch may break a custom integration. What is the BEST course of action?
- A. Apply the patch to production immediately without testing to close the vulnerability as fast as possible
- B. Never apply the patch since it might break the integration
- C. Test the patch in a staging environment, coordinate remediation of the integration issue, and apply compensating controls until the patch can be safely deployed
- D. Uninstall the custom integration permanently without informing stakeholders
Show answer & explanation
Answer: C
Balanced vulnerability management requires validating patches in a non-production environment, working with stakeholders to resolve compatibility issues, and applying compensating controls (e.g., additional monitoring or network restrictions) to manage risk during the interim, rather than choosing an extreme of immediate unvalidated deployment or indefinite delay. Applying untested patches to production risks an outage, refusing to patch leaves a critical RCE open indefinitely, and unilaterally removing business functionality without stakeholder input is an inappropriate and disruptive shortcut.
20. Which of the following BEST describes the purpose of penetration testing in relation to vulnerability scanning within a vulnerability management program?
- A. Penetration testing replaces the need for any vulnerability scanning
- B. Penetration testing actively attempts to exploit identified weaknesses to validate real-world impact, complementing the broader coverage of automated scanning
- C. Penetration testing and vulnerability scanning always test only web applications
- D. Penetration testing is only performed by automated tools with no human involvement
Show answer & explanation
Answer: B
Vulnerability scanning provides broad, automated identification of potential weaknesses, while penetration testing goes further by having skilled testers actively attempt exploitation to demonstrate real business impact and validate whether a vulnerability is truly exploitable in context; the two are complementary, not substitutes. Pen testing does not replace scanning's breadth, it typically involves significant manual tester expertise rather than being purely automated, and both practices apply to networks, endpoints, and cloud infrastructure, not solely web applications.
21. An incident responder is analyzing a suspected ransomware infection. Which action should be taken FIRST to limit damage while preserving the ability to investigate?
- A. Power off the affected system completely before any analysis
- B. Delete all files on the host immediately to stop the spread
- C. Wait 24 hours to observe further behavior before taking any action
- D. Isolate the affected host from the network (e.g., disable its network interface) while keeping it powered on for potential memory analysis
Show answer & explanation
Answer: D
Network isolation stops the ransomware from spreading laterally or continuing to communicate with C2 infrastructure while keeping the system powered on preserves volatile memory that may contain encryption keys or forensic artifacts. Powering off immediately can destroy volatile evidence in RAM, deleting files destroys evidence and does not address the root infection, and waiting 24 hours allows continued spread and data loss during active ransomware activity.
22. During incident response, which order BEST reflects the standard phases of the incident response lifecycle as commonly taught?
- A. Lessons Learned, Preparation, Detection, Eradication, Containment, Recovery
- B. Eradication, Preparation, Containment, Detection, Recovery, Lessons Learned
- C. Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Lessons Learned)
- D. Recovery, Containment, Detection, Preparation, Eradication, Lessons Learned
Show answer & explanation
Answer: C
The widely recognized incident response lifecycle begins with Preparation (readiness before an incident), followed by Detection and Analysis, then Containment, Eradication, and Recovery, and finally Post-Incident Activity/Lessons Learned to improve future response; the other orderings scramble this logical sequence in ways that don't reflect how a real incident actually needs to be handled (e.g., you cannot contain a threat before detecting it, and lessons learned must come after recovery, not before preparation).
23. An analyst is calculating chain of custody documentation while collecting a forensic disk image from a compromised server. What is the PRIMARY reason this documentation is critical?
- A. It replaces the need for cryptographic hashing of the evidence
- B. It speeds up the imaging process technically
- C. It is only needed for external audits, not incident response
- D. It establishes an unbroken record of who handled the evidence and when, supporting its admissibility and integrity
Show answer & explanation
Answer: D
Chain of custody documents every person who accessed, handled, or transferred evidence and when, which is essential for demonstrating the evidence has not been tampered with and remains legally admissible and trustworthy. It has no effect on the technical speed of imaging, it is relevant to internal incident response as well as any legal proceedings, and it complements rather than replaces cryptographic hashing (which verifies integrity of the data itself).
24. A responder needs to preserve volatile data before it is lost during an active incident. Per the standard order of volatility, which of the following should generally be collected FIRST?
- A. Data on backup tapes stored offsite
- B. Contents of RAM and active network connections
- C. Files stored on the local hard disk
- D. Printed documentation in the server room
Show answer & explanation
Answer: B
The order of volatility prioritizes collecting the most transient data first; RAM contents and active network connections/state disappear the moment a system is powered off or a session ends, making them the highest priority to capture. Disk-based files persist after shutdown and can be imaged later, backup tapes are already durable long-term storage, and printed documentation is entirely static and non-volatile.
25. An incident response team determines that an attacker gained access via a phished credential and has been dormant in the environment for several weeks, moving laterally between systems. Which containment strategy BEST balances stopping further damage with preserving evidence for full scope determination?
- A. Take no containment action until the full scope of compromise is confirmed with certainty
- B. Immediately wipe and rebuild every server in the environment without further investigation
- C. Apply targeted containment (disabling the compromised account, isolating known-affected hosts) while continuing to monitor for additional indicators before full eradication
- D. Immediately terminate all user accounts across the entire organization
Show answer & explanation
Answer: C
Targeted containment addresses known compromised accounts and hosts to limit further lateral movement while preserving the broader environment for continued monitoring and investigation to fully scope the incident before eradication — this mirrors real-world guidance to contain proportionally rather than overreact or underreact. Disabling every account organization-wide is disruptive and unnecessary, waiting for absolute certainty allows continued attacker activity, and wiping every server destroys evidence and is a wildly disproportionate response before scope is even understood.
26. A company's incident response plan requires notifying specific regulatory bodies within a defined time window after confirming a breach involving personal data. Which document or process would MOST likely define this specific obligation?
- A. The organization's data breach notification policy, informed by applicable legal/regulatory requirements
- B. The vulnerability scanning schedule
- C. The company's marketing brand style guide
- D. The network diagram maintained by IT operations
Show answer & explanation
Answer: A
A breach notification policy, shaped by applicable regulations (such as data protection laws), is the document that defines who must be notified, what must be disclosed, and within what timeframe following a confirmed data breach. A vulnerability scanning schedule concerns proactive testing cadence, a brand style guide governs marketing appearance, and a network diagram documents infrastructure topology — none of these define legal notification obligations.
27. During post-incident review (lessons learned), the team identifies that a critical alert was missed because analysts were overwhelmed by low-fidelity noise from a poorly tuned rule. What is the MOST appropriate long-term corrective action?
- A. Hire more analysts without changing any detection tuning
- B. Take no action since the incident has already been resolved
- C. Improve detection rule tuning and alert prioritization to reduce noise and surface high-fidelity alerts more effectively
- D. Remove the rule that generated the missed alert entirely so it never fires again
Show answer & explanation
Answer: C
Addressing root cause requires improving detection engineering (tuning rules, prioritizing high-confidence alerts) so genuine threats are not buried in noise going forward, which is a core outcome of the lessons-learned phase. Simply adding headcount without fixing the underlying noise problem is an incomplete fix, removing the very rule that could have caught the incident eliminates future detection capability, and taking no action ignores the purpose of post-incident review, which is continuous improvement.
28. A CySA+ analyst is writing an executive summary of a recent security incident for senior leadership who are not technical. Which approach is MOST appropriate for this audience?
- A. Include full raw packet captures and unfiltered log dumps with no summarization
- B. Focus on business impact, risk, and remediation status in plain language, with technical detail available in an appendix if needed
- C. Use only technical jargon and CVE identifiers with no context
- D. Omit any mention of business impact since leadership only cares about technical root cause
Show answer & explanation
Answer: B
Effective security communication tailors depth and language to the audience; for executives, framing findings in terms of business impact, risk, and remediation status in plain language ensures the message drives informed decisions, with technical detail available separately for those who need it. Dumping raw technical artifacts or jargon-heavy content without context overwhelms a non-technical audience and obscures the message, while omitting business impact defeats the entire purpose of an executive-facing report.
29. Which metric BEST measures how quickly a security operations team detects a threat after it first enters the environment?
- A. Mean Time to Repair (MTTR) for hardware failures
- B. Return on Investment (ROI) of the SOC budget
- C. Mean Time to Detect (MTTD)
- D. Number of open job requisitions on the security team
Show answer & explanation
Answer: C
Mean Time to Detect (MTTD) specifically measures the average time elapsed between a threat's initial presence in the environment and its discovery by the security team, making it the direct metric for detection speed. MTTR for hardware failures concerns equipment repair, not threat detection; SOC budget ROI measures financial efficiency rather than detection speed; and open job requisitions is an HR staffing metric unrelated to detection performance.
30. A CySA+ analyst needs to communicate a newly discovered vulnerability to the software development team responsible for the affected application. Which element is MOST important to include to enable an effective and efficient fix?
- A. A general statement that 'security issues exist' with no further detail
- B. Specific reproduction steps, affected component/code location, and business risk context
- C. Only the CVSS numeric score with no other context
- D. A request to shut down the entire application indefinitely
Show answer & explanation
Answer: B
Developers need actionable detail — how to reproduce the issue, exactly where in the code or component it exists, and why it matters from a risk standpoint — to prioritize and fix the vulnerability efficiently. A vague statement gives them nothing to act on, a bare CVSS score without context or reproduction steps doesn't tell them what to fix or where, and demanding a full application shutdown is a disproportionate and usually unnecessary response to a single reported vulnerability.
31. When communicating risk to a business stakeholder who must decide whether to accept, mitigate, transfer, or avoid a given risk, which framing is MOST useful?
- A. Framing risk in terms of likelihood and potential business impact, alongside available response options and their costs
- B. Describing risk purely in terms of technical CVE numbers with no likelihood or impact discussion
- C. Presenting only worst-case scenarios without discussing probability
- D. Telling the stakeholder that the decision is not their responsibility
Show answer & explanation
Answer: A
Effective risk communication for decision-makers translates technical findings into business terms — likelihood, potential impact, and the trade-offs of each response option (accept, mitigate, transfer, avoid) — so they can make an informed, risk-based decision. Reciting bare CVE identifiers provides no decision-relevant context, deflecting the decision away from the stakeholder who owns it is inappropriate, and presenting only worst-case outcomes without likelihood distorts the actual risk picture and undermines sound decision-making.
32. An analyst receives an alert for outbound traffic to a known malicious domain from an internal host. What is the first triage step?
- A. Establish whether the connection actually succeeded and what process initiated it, since a blocked DNS lookup and an established session require very different responses
- B. Close the alert if the domain is on a public blocklist
- C. Immediately reimage the host before gathering any information
- D. Notify all users of a suspected compromise
Show answer & explanation
Answer: A
Triage establishes whether an alert represents a real event and its scope before response consumes effort, and a blocked attempt carries a different urgency than an established command and control channel. Reimaging first destroys the evidence needed to determine how the host was compromised and whether others were.
33. An analyst investigates a suspicious process and finds it was launched by a legitimate signed system binary. What technique does this suggest?
- A. Living off the land, where an attacker uses tools already present on the system to avoid introducing detectable malware
- B. A rootkit hiding at the kernel level
- C. A denial of service attack against the host
- D. A hardware implant on the motherboard
Show answer & explanation
Answer: A
Using built-in interpreters and administrative utilities defeats signature-based detection because the binaries are legitimate and expected, which shifts detection toward behaviour and command-line arguments. This is why command-line and process-lineage logging matter more than file hashes for detecting modern intrusions.
34. A detection rule generates a high volume of alerts that analysts consistently close as benign. What is the correct response?
- A. Tune the rule to reduce false positives while documenting what was excluded, since unmanaged alert volume causes genuine detections to be missed
- B. Disable the rule entirely without documentation
- C. Continue processing every alert to avoid missing anything
- D. Increase analyst headcount to match the volume
Show answer & explanation
Answer: A
Alert fatigue is a real detection failure mode, so tuning is a detection improvement rather than a concession, but every exclusion is a blind spot that must be recorded and reviewed. Disabling a rule without documentation leaves nobody able to explain later why a technique went undetected.
35. An analyst correlates events from an endpoint tool, a firewall and an identity provider to reconstruct an intrusion. What capability enables this?
- A. Reviewing each tool's console separately at the same time
- B. Centralized log aggregation with consistent timestamps and a common identifier such as user or host linking events across sources
- C. Disabling logging on sources producing high volume
- D. Increasing the retention period on one source only
Show answer & explanation
Answer: B
Correlation depends on events sharing a time base and a joinable field, since a sequence spanning three tools cannot be reconstructed when clocks differ and identifiers do not match. Normalization at ingestion is what makes those fields comparable, and it is the unglamorous work that determines whether investigation is possible at all.
36. A threat intelligence feed provides indicators of compromise. What limitation should shape how they are used?
- A. Indicators such as hashes and addresses are easily changed by an attacker, so detection based on behaviour and technique is more durable
- B. Indicators cannot be ingested into detection tooling automatically
- C. Indicators are only useful for compliance reporting
- D. Indicators never expire and remain valid indefinitely
Show answer & explanation
Answer: A
The pyramid of pain captures this: hashes and addresses cost an adversary almost nothing to change, while tools, techniques and behaviours are progressively harder to alter. Indicator feeds retain value for rapid retrospective search but should not be the foundation of a detection strategy.
37. An analyst maps observed adversary activity to a common framework of tactics and techniques. What does this enable?
- A. Identifying which stages of the attack were detected and which were not, so coverage gaps become visible and can be prioritized
- B. Automatic remediation of the affected systems
- C. Attribution of the attack to a specific individual
- D. A guarantee that the same attack cannot recur
Show answer & explanation
Answer: A
Mapping converts a narrative of one incident into a structured view of detection coverage across the attack lifecycle, which is what turns an investigation into a programme improvement. Attribution to a named actor is a separate and far less certain exercise that rarely changes what a defender should do next.
38. A vulnerability scan reports a critical finding on a host. What must be established before treating it as critical to the organization?
- A. Whether the vulnerable component is actually reachable and in use, since severity scores describe the vulnerability rather than the organization's exposure to it
- B. Whether the scanner was authenticated during the scan only
- C. Whether the vendor has released a patch only
- D. Whether other organizations have been exploited only
Show answer & explanation
Answer: A
A base severity score is a property of the flaw, and the organization's risk depends on exposure, compensating controls and the asset's importance. A critical vulnerability in a component that is never loaded ranks below a moderate one on an internet-facing system holding sensitive data.
39. An authenticated vulnerability scan returns substantially more findings than an unauthenticated scan of the same host. Why?
- A. Authenticated scanning creates vulnerabilities on the host
- B. Credentialed scanning inspects installed software versions and configuration directly rather than inferring from network responses, producing more complete and more accurate results
- C. Unauthenticated scanning is more thorough but reports less
- D. The difference is entirely random
Show answer & explanation
Answer: B
Without credentials the scanner infers from banners and behaviour, which both misses local issues and produces false positives where a backported fix leaves the version string unchanged. Credentialed scanning is therefore preferred internally, while unauthenticated scanning usefully shows what an unauthenticated attacker would see.
40. A reported vulnerability cannot be patched because the vendor no longer supports the product. What is the appropriate handling?
- A. Apply compensating controls such as isolation, restricted access and enhanced monitoring, and record the accepted residual risk with an owner and a replacement plan
- B. Close the finding as not applicable since no patch exists
- C. Continue scanning without any other action
- D. Remove the system from the scan scope to clear the report
Show answer & explanation
Answer: A
An unpatchable vulnerability is still an exposure, so the response shifts from remediation to mitigation plus documented risk acceptance with an owner. Removing the asset from scope makes the metric improve while the risk remains, which is a reporting failure rather than a security one.
41. A scan finding is investigated and proves not to exist on the host. What has occurred and what should follow?
- A. A false positive, which should be documented and the scanner tuned, since repeated false positives erode confidence in the entire report
- B. A false negative, requiring the scan to be rerun
- C. A true positive that was remediated automatically
- D. A configuration error requiring the host to be rebuilt
Show answer & explanation
Answer: A
False positives consume remediation effort and, more damagingly, teach system owners to distrust findings, which delays response to genuine ones. A false negative is the opposite and more dangerous error, where a real vulnerability is not reported, and it is detected only through penetration testing or an incident.
42. An organization must decide the frequency of vulnerability scanning. What consideration should drive it?
- A. The scanner licence's maximum permitted scans
- B. The calendar quarter boundaries for reporting convenience
- C. The rate at which the environment changes and new vulnerabilities are disclosed, since the interval between scans is a window of unknown exposure
- D. The availability of the security team to read reports
Show answer & explanation
Answer: C
Quarterly scanning in an environment deploying daily means the organization is unaware of its exposure for most of the period, which is why continuous or event-triggered scanning has largely replaced fixed schedules. Integrating scanning into deployment pipelines catches issues before they reach production rather than reporting them afterward.
43. A web application scan reports a SQL injection finding. How should the analyst verify it before escalating?
- A. Confirm the behaviour in a controlled, authorized manner against a non-production instance where possible, documenting the evidence
- B. Exploit it fully against production to demonstrate impact
- C. Escalate immediately without any verification
- D. Assume it is a false positive and close it
Show answer & explanation
Answer: A
Verification distinguishes a real finding from scanner noise and provides the evidence a development team needs to act, but it must stay within authorized scope. Fully exploiting production risks data damage and may exceed the authorization the analyst holds, which converts a defensive activity into an incident.
44. An organization must prioritize among thousands of open vulnerabilities. What information most improves prioritization beyond severity?
- A. The alphabetical order of the affected products
- B. The age of the scanning tool's signature database
- C. The number of characters in the vulnerability identifier
- D. Whether the vulnerability is being actively exploited in the wild, which changes the probability of attack far more than the score alone
Show answer & explanation
Answer: D
Known exploitation moves a vulnerability from theoretical to imminent, which is why exploitation catalogues and threat intelligence are combined with severity to produce a defensible ranking. Asset criticality and exposure complete the picture, since the same vulnerability carries different risk on different systems.
45. During incident response, an analyst must decide whether to isolate a compromised host immediately. What is the tension?
- A. Isolation destroys all forensic evidence on the host
- B. Isolation has no downside and should always be immediate
- C. Isolation is only possible after the investigation concludes
- D. Isolation stops further damage but alerts the attacker and may end the opportunity to observe their objectives and full footprint
Show answer & explanation
Answer: D
Containment timing balances limiting damage against preserving visibility, and the decision depends on what is at risk and how confident the team is that they have found everything. Isolating one host while an attacker holds credentials for others achieves little except warning them, which is why scoping precedes containment where the risk permits.
46. Evidence is collected from a compromised system. In what order should sources be captured?
- A. Archived backups first, since they are furthest from the incident
- B. Disk images first, since they contain the most data
- C. Most volatile first, beginning with memory and network connections before disk and archived data
- D. In whatever order the tooling completes fastest
Show answer & explanation
Answer: C
Order of volatility exists because memory contents, running processes and network state disappear on power loss or reboot while disk contents persist. Injected code, decryption keys and connections often exist only in memory, so capturing disk first can lose the evidence that explains the entire intrusion.
47. An analyst images a disk for forensic analysis. What step establishes that the image is a faithful copy?
- A. Comparing the file counts between source and image
- B. Opening the image and browsing the file system visually
- C. Computing a cryptographic hash of the source and the image and confirming they match, with a write blocker preventing modification of the source
- D. Confirming the image file size is larger than the source
Show answer & explanation
Answer: C
Matching hashes demonstrate bit-level equivalence, and a write blocker ensures the acquisition process did not alter the original. Analysis is then performed on a copy of the image rather than on the original or the master image, so the verified acquisition remains untouched for later re-examination.
48. During eradication, the team removes the attacker's known persistence mechanism. What must be verified before declaring the incident closed?
- A. That the antivirus signature database is current only
- B. That the incident ticket has been assigned a severity rating
- C. That the initial access vector is closed and no other persistence remains, since removing one mechanism while the entry path stays open invites immediate reinfection
- D. That the affected user has changed their desktop wallpaper
Show answer & explanation
Answer: C
Attackers commonly establish multiple persistence mechanisms precisely so removal of one does not end their access, and the unclosed entry vector allows a fresh compromise regardless. Enhanced monitoring for a period after recovery is what detects the reinfection that eradication missed.
49. An incident involves personal data of customers in several countries. What obligation arises alongside the technical response?
- A. Deferring any legal assessment until the technical investigation is complete
- B. Assessing notification requirements under each applicable regime, since deadlines and thresholds differ and legal counsel determines what must be reported and when
- C. Assuming a single notification satisfies all jurisdictions
- D. Notifying all customers immediately regardless of the facts established
Show answer & explanation
Answer: B
Notification clocks in several regimes start from awareness rather than from investigation completion, so waiting for technical certainty can breach a deadline. Involving legal counsel early also preserves privilege over investigative work product, which is a consideration that cannot be applied retrospectively.
50. An analyst prepares an incident report for executive leadership. What should it emphasize?
- A. Business impact, what was affected, what is being done, decisions required and the timeline, with technical detail available but not leading
- B. A packet-level analysis of the attacker's traffic
- C. The full text of every log entry collected
- D. The analyst's personal assessment of who is at fault
Show answer & explanation
Answer: A
Executives allocate resources and make disclosure and escalation decisions, so they need impact, status and the decisions being asked of them rather than a technical narrative. Attribution of blame in a written report is both unhelpful and legally risky, since the document may later be produced in litigation.
51. A vulnerability management programme reports remediation metrics. Which metric best reflects risk reduction?
- A. Time to remediate weighted by risk, since closing many low-risk findings quickly can accompany critical ones remaining open for months
- B. The total number of findings closed per month
- C. The number of scans executed per month
- D. The size of the vulnerability database
Show answer & explanation
Answer: A
Raw closure counts reward addressing the easiest findings, which is why a programme can show excellent numbers while its actual exposure is unchanged. Measuring remediation time for critical and actively exploited findings separately is what makes the metric reflect risk rather than activity.
52. A security team must communicate a required patch to a business unit that resists the disruption. What approach is most effective?
- A. Presenting the specific risk to that unit's operations and offering options such as a maintenance window or compensating controls, rather than asserting policy alone
- B. Escalating immediately to executive leadership without discussion
- C. Applying the patch without notification to avoid the argument
- D. Withdrawing the request to preserve the relationship
Show answer & explanation
Answer: A
Framing the risk in terms of the business unit's own exposure converts a compliance demand into a shared decision, and offering options acknowledges the operational cost is real. Patching without notification destroys the working relationship and can cause an outage nobody was prepared for, which sets the programme back further than the delay would have.
53. An analyst performs threat hunting rather than responding to alerts. What distinguishes the activity?
- A. It is performed only after a confirmed breach
- B. It responds to alerts more quickly than standard triage
- C. It proactively searches for adversary activity that existing detections did not surface, starting from a hypothesis rather than from an alert
- D. It replaces the need for detection rules entirely
Show answer & explanation
Answer: C
Hunting assumes detections are incomplete and looks for what they miss, which is why a hunt that finds nothing still produces value by converting a hypothesis into a new detection or confirming coverage. Findings should feed back into automated detection so the same hunt does not need repeating manually.
54. An analyst examines a suspicious executable in a sandbox. What limitation should be understood?
- A. Sandbox analysis cannot capture network activity
- B. Malware commonly detects sandbox environments and alters or suspends its behaviour, so benign observed behaviour does not establish the file is safe
- C. Sandbox results are always definitive
- D. Sandboxes execute files faster than a real host
Show answer & explanation
Answer: B
Evasion techniques check for virtualization artefacts, analysis tools, limited user activity and short runtimes, so a sample can appear inert while behaving maliciously on a real host. Static analysis and behavioural detection on the endpoint complement sandboxing rather than being replaced by it.
55. An analyst identifies encoded PowerShell in a command line captured by endpoint logging. What does the encoding typically indicate?
- A. An attempt to obscure the command's content from casual inspection and simple string-based detection, warranting decoding and full investigation
- B. A routine administrative practice requiring no investigation
- C. A corrupted log entry that should be discarded
- D. Evidence that the command failed to execute
Show answer & explanation
Answer: A
Encoding is a recognized obfuscation technique, and while some legitimate tooling uses it, the base rate for malicious use makes it a strong investigative lead. Decoding is straightforward and reveals the actual command, which is why script block logging that records the decoded content is a valuable detection capability.
56. A host shows a scheduled task created at an unusual hour running an executable from a user profile directory. What technique does this pattern suggest?
- A. Persistence, since scheduled tasks survive reboots and a user-writable location avoids requiring elevated privilege to place the payload
- B. Data exfiltration over an encrypted channel
- C. A denial of service against the local host
- D. Normal software update behaviour requiring no review
Show answer & explanation
Answer: A
Persistence mechanisms must survive reboot, and scheduled tasks, run keys, services and startup folders are the common locations to check. The user-writable path is significant because it indicates the attacker may not have obtained elevation, which affects both the scope assessment and the response.
57. Network traffic shows regular small outbound connections to the same external address at consistent intervals. What does this pattern suggest?
- A. Command and control beaconing, where an implant checks in on a schedule, which regularity of interval helps distinguish from human-driven traffic
- B. A large file transfer in progress
- C. Normal web browsing by a user
- D. A denial of service attack against the external address
Show answer & explanation
Answer: A
Periodicity is the signature, since human activity produces irregular timing while an implant polls on a timer, and jitter is added by attackers precisely to blur that pattern. Beacon analysis examines interval regularity, payload size consistency and destination reputation together rather than any single attribute.
58. An analyst reviews an authentication log showing successful logins for one account from two countries within minutes. What does this indicate?
- A. Impossible travel, suggesting credential compromise since one person cannot be in both locations, though a VPN or proxy can produce the same signal legitimately
- B. A clock synchronization error on the authentication server
- C. Normal behaviour for a mobile user
- D. A failed authentication attempt recorded incorrectly
Show answer & explanation
Answer: A
The detection is valuable but produces false positives from VPN use, corporate proxies and mobile carrier routing, so it warrants investigation rather than automatic action. Combining it with device, application and behavioural signals is what raises confidence enough to justify disabling an account.
59. An analyst automates a repetitive containment action through a response playbook. What should govern which steps are automated?
- A. Avoiding automation entirely so an analyst reviews each action
- B. Automating every step to minimize response time regardless of impact
- C. Automating only steps that generate no logs
- D. The reversibility and confidence of the action, so high-confidence reversible steps run automatically while disruptive or irreversible ones require human approval
Show answer & explanation
Answer: D
Automation earns its value on high-volume high-confidence actions such as enrichment and blocking a known-bad indicator, while automatically disabling an account or isolating a host on a low-confidence signal turns a false positive into a self-inflicted outage. Building the approval gate into the playbook keeps the speed benefit for the safe steps without accepting that risk on the consequential ones.
60. An analyst must recommend a detection improvement after an incident. What makes the recommendation actionable?
- A. Specifying the data source, the observable behaviour and the logic, so the detection can be implemented and tested rather than aspired to
- B. Recommending that monitoring be improved generally
- C. Recommending the purchase of additional tooling without specifics
- D. Recommending that users be more careful
Show answer & explanation
Answer: A
A detection recommendation must state what to look at, what pattern indicates the behaviour and how the rule expresses it, or it cannot be built. Vague recommendations survive post-incident reviews unchallenged and are never implemented, which is why the specificity matters more than the sentiment.
61. Security tooling generates a metric showing mean time to detect has increased. What should be investigated?
- A. Whether detection coverage has degraded, whether alert volume is delaying triage, or whether the incidents detected simply differed in character from prior periods
- B. Only whether more analysts should be hired
- C. Only the vendor's product roadmap
- D. Nothing, since the metric fluctuates naturally
Show answer & explanation
Answer: A
A single aggregate metric can move for reasons ranging from genuine degradation to a change in the incident mix, so the investigation must separate them before acting. Small sample sizes make security metrics volatile, which is why trend and distribution matter more than any single period's figure.
62. A cloud workload's configuration is scanned rather than its software. What class of finding does this surface?
- A. Misconfiguration such as overly permissive access, public exposure or absent logging, which causes a large share of cloud incidents independently of software vulnerabilities
- B. Only missing operating system patches
- C. Only application source code defects
- D. Only expired TLS certificates
Show answer & explanation
Answer: A
Cloud incidents are dominated by configuration errors rather than exploited software flaws, since a publicly readable storage bucket requires no vulnerability to exploit. Configuration scanning and policy-as-code enforcement therefore address a distinct and larger risk surface than traditional vulnerability scanning.
63. An analyst must assess the risk of a vulnerability in a third-party library used across many applications. What complicates the response?
- A. Determining which applications actually include the library and whether the vulnerable function is reachable, which requires dependency inventory the organization may not have
- B. The library's licence terms
- C. The programming language the library is written in
- D. The number of contributors to the library
Show answer & explanation
Answer: A
Transitive dependencies mean a library can be present without any team having chosen it, so answering which systems are affected becomes an archaeology exercise under time pressure. A maintained software bill of materials converts that question into a lookup, which is why it matters most during exactly this scenario.
64. A penetration test report and a vulnerability scan report are both received. How do their findings differ in character?
- A. The test demonstrates exploitable paths and their business impact on a smaller set of issues, while the scan enumerates a far larger set of potential weaknesses without proving exploitability
- B. The scan proves exploitability while the test enumerates potential issues
- C. Both produce identical findings by different means
- D. The test covers only physical security
Show answer & explanation
Answer: A
Depth versus breadth is the distinction, and chained findings are the test's particular value, since two individually moderate issues can combine into a critical path a scanner would never connect. Neither substitutes for the other, and a programme relying only on scanning misses the chains while one relying only on testing misses the volume.
65. A SOC analyst reviewing SIEM alerts notices a marketing employee's account authenticating to the finance department's file share at 3 AM, a resource the account has never accessed before. Which analysis technique BEST explains why this alert was generated?
- A. User and entity behavior analytics (UEBA) flagging a deviation from established access baselines
- B. Signature-based detection matching a known malware hash
- C. A vulnerability scanner correlating CVE data with the account's login pattern
- D. Network flow analysis identifying a change in packet size distribution
Show answer & explanation
Answer: A
UEBA builds behavioral baselines per user and entity and flags deviations such as unusual access times or resources, which is exactly what generated this alert; signature-based detection instead matches known malicious file or traffic patterns and would not trigger on a legitimate account's atypical login timing alone.
66. During triage of a phishing report, an analyst finds the email's sender domain uses valid SPF and DKIM signatures but the display name spoofs the CEO and the reply-to address points to a free webmail domain. Which conclusion is MOST supported by this evidence?
- A. The email originated from an internal compromised mailbox, confirmed by the passing DKIM signature
- B. The email is legitimate because SPF and DKIM both passed
- C. The email is likely a business email compromise attempt using a lookalike or compromised domain despite passing authentication
- D. The email cannot be phishing since it passed email authentication checks
Show answer & explanation
Answer: C
Passing SPF and DKIM only proves the message was sent from a server authorized for its own domain, not that the sender is trustworthy or affiliated with the impersonated executive; a mismatched reply-to address paired with a spoofed display name is a classic business email compromise indicator that authentication checks alone cannot catch.
67. An analyst needs to identify which specific tactics and techniques an intrusion used, from initial access through exfiltration, in a way that supports comparison with other campaigns industry-wide. Which reference framework BEST supports this goal?
- A. The organization's internal ticketing taxonomy
- B. MITRE ATT&CK
- C. CVSS
- D. The vulnerability scanner's proprietary severity scale
Show answer & explanation
Answer: B
MITRE ATT&CK provides a standardized, publicly maintained taxonomy of adversary tactics and techniques that analysts across organizations use consistently, enabling comparison of an intrusion's behavior against known campaigns; CVSS instead scores the severity of individual vulnerabilities and has no bearing on describing attacker behavior.
68. An analyst is building a detection rule for command-and-control beaconing that must avoid alerting on legitimate periodic traffic such as software update checks. Which characteristic BEST distinguishes malicious beaconing from routine polling in traffic analysis?
- A. The destination IP address is external to the network
- B. The connection occurs during business hours
- C. The traffic uses an encrypted protocol such as TLS
- D. The interval and payload size show unusually consistent jitter-free timing combined with a low-reputation or newly registered destination
Show answer & explanation
Answer: D
Legitimate polling services typically vary somewhat in timing and connect to well-established, reputable domains, while malicious beacons often show highly regular, low-jitter intervals paired with connections to newly registered or low-reputation infrastructure; external destination or encrypted transport alone are far too common in benign traffic to serve as reliable discriminators.
69. A cloud security team receives an alert that a storage service's access logging was disabled shortly before an unusual spike in data downloads from an unfamiliar IAM role. What should the analyst do FIRST?
- A. Immediately delete the IAM role to prevent further access
- B. Preserve available logs and cloud audit trail evidence while investigating the scope of the role's activity
- C. Close the alert since logging was disabled and no further evidence can be gathered
- D. Wait for the next scheduled vulnerability scan to confirm the finding
Show answer & explanation
Answer: B
Even when data-access logging was disabled, cloud providers typically retain a separate control-plane audit trail of administrative actions such as disabling logging and role activity, so the priority is to preserve that available evidence and scope the incident before taking disruptive actions; deleting the role immediately could destroy forensic value and tip off an attacker who still has access elsewhere.
70. A SOC uses a SOAR platform to automatically disable a user account whenever three failed login attempts are followed by a successful login from a new geographic location. What is the PRIMARY benefit of this automation?
- A. It eliminates the need for analysts to ever review authentication logs again
- B. It guarantees zero false positives in account compromise detection
- C. It replaces the need for multi-factor authentication on the account
- D. It reduces analyst response time for a well-defined, repeatable scenario, freeing analysts for higher-judgment tasks
Show answer & explanation
Answer: D
SOAR playbooks are best suited to consistent, well-understood scenarios where the response logic is clear, allowing the platform to act faster than a human and freeing analysts to focus on ambiguous or high-judgment investigations; automation does not eliminate the need for oversight, guarantee accuracy, or substitute for independent security controls like multi-factor authentication.
71. An analyst investigating an endpoint alert discovers that a legitimate, digitally signed system utility was used to download and execute a secondary payload, leaving minimal artifacts of its own. Which technique does this behavior MOST closely describe?
- A. A distributed denial-of-service attack
- B. A zero-day exploit against the operating system kernel
- C. Living-off-the-land (LOTL) technique abusing a trusted binary
- D. Credential stuffing against a web application
Show answer & explanation
Answer: C
Living-off-the-land techniques abuse legitimate, often signed system utilities already present on the host to perform malicious actions, which helps the activity blend in with normal administrative behavior and evade signature-based detection; this scenario describes exactly that abuse pattern rather than a kernel exploit, a denial-of-service attack, or credential stuffing, none of which involve reusing trusted binaries.
72. A CVSS v3.1 base score for a vulnerability shows an Attack Vector of Network, Attack Complexity of Low, and no privileges required, but the environmental score is later adjusted downward significantly by the analyst. Which factor MOST likely justifies that adjustment?
- A. The base score calculation was performed incorrectly by the scanner
- B. The vulnerability has since been assigned a new CVE identifier
- C. The vendor released a blog post describing the vulnerability
- D. The affected asset sits in a segmented environment with compensating controls that reduce real-world exploitability
Show answer & explanation
Answer: D
CVSS environmental metrics let analysts adjust a base score to reflect an organization's actual security controls and asset placement, such as network segmentation or compensating controls that reduce practical exploitability, even though the underlying technical severity of the flaw itself has not changed; a new CVE identifier or vendor publicity has no bearing on the score's environmental component.
73. An organization runs the same authenticated vulnerability scan monthly against a server farm. This month, a previously reported critical finding no longer appears, but no patch was deployed and no change ticket exists for that host. What should the analyst do?
- A. Assume the vulnerability was a false positive originally and close it permanently
- B. Reduce the scan frequency since the finding is no longer present
- C. Investigate why the finding disappeared without a corresponding remediation record, since this could indicate scan failure, agent issues, or unauthorized changes
- D. Escalate directly to law enforcement without further investigation
Show answer & explanation
Answer: C
A critical finding vanishing without any documented remediation is itself a red flag that warrants investigation, since possible causes include a failed or incomplete scan, a disabled or misconfigured scanning agent, or an undocumented change made outside of normal change control, any of which could mask real risk rather than eliminate it.
74. A vulnerability management team is choosing between agent-based and network-based scanning for a fleet of laptops that frequently leave the corporate network. Which factor MOST favors an agent-based approach for this asset group?
- A. Agent-based scanning requires no software installation on endpoints
- B. Agents can continue scanning and reporting even when the laptop is off the corporate network
- C. Agent-based scanning always produces lower false-positive rates than network scanning
- D. Agent-based scanning eliminates the need for credentialed access entirely
Show answer & explanation
Answer: B
Because agents run locally on the endpoint, they can assess the system and report findings regardless of network location, which is a significant advantage for mobile or remote devices that a purely network-based scanner could never reach when off the corporate network; agents still require installation and credentialed context, so the other statements do not hold.
75. A remediation team wants to reduce exposure on a legacy industrial control system that cannot be patched or taken offline for business-continuity reasons. Which compensating control BEST reduces risk without altering the vulnerable software itself?
- A. Upgrading the operating system to the newest version immediately
- B. Installing the latest vendor patch despite the compatibility risk
- C. Ignoring the finding since the system cannot be patched
- D. Placing the system behind a dedicated firewall segment with strict access control lists limiting connectivity to only required hosts
Show answer & explanation
Answer: D
Network segmentation with tightly scoped access control lists is a classic compensating control that reduces the attack surface and limits who can reach a vulnerable, unpatchable system, without touching the software itself; patching or upgrading are explicitly ruled out by the scenario, and ignoring the finding leaves risk unmanaged.
76. A software composition analysis tool flags a critical vulnerability in an open-source library embedded in a homegrown application. The library is used indirectly through several layers of nested dependencies. What is the analyst's BEST first step?
- A. Generate or consult a software bill of materials (SBOM) to trace exactly where and how the vulnerable library is used before determining remediation
- B. Ignore the finding since it is only an indirect dependency
- C. Wait for the application's original developers to leave the company before acting
- D. Delete the application since the dependency cannot be traced
Show answer & explanation
Answer: A
A software bill of materials maps out an application's full dependency tree, including nested and transitive dependencies, which allows the analyst to precisely identify where the vulnerable library is invoked and assess whether it is reachable and exploitable before deciding on remediation such as an update, replacement, or compensating control.
77. During a scan review, an analyst finds a finding classified with high confidence that turns out, upon manual verification, to genuinely exist and be exploitable. What term correctly describes this scan result?
- A. True positive
- B. False positive
- C. False negative
- D. Indicator of compromise
Show answer & explanation
Answer: A
A true positive is a finding that the scanner correctly identifies as present and that manual verification confirms is genuinely exploitable, which is exactly the outcome described; a false positive would instead be a finding that does not actually exist, and a false negative would be a real vulnerability the scan failed to detect at all.
78. An organization's change advisory board delays deploying a critical security patch to a production database server because the patch window conflicts with a quarter-end financial close. What is the MOST appropriate action for the vulnerability management team in the interim?
- A. Take no action until the approved patch window since the risk is fully accepted
- B. Deploy the patch anyway without change approval since it is critical
- C. Permanently remove the vulnerability from the tracking system
- D. Recommend and implement interim compensating controls, such as enhanced monitoring or restricted access, until the patch can be applied
Show answer & explanation
Answer: D
When a critical patch must be delayed for legitimate business reasons, the standard practice is to reduce risk in the interim through compensating controls like heightened monitoring, tightened access, or additional network restrictions rather than either bypassing change control or leaving the exposure entirely unmanaged until the deferred window arrives.
79. Which of the following BEST describes the purpose of a vulnerability scanner's plugin or signature database?
- A. It encrypts network traffic between the scanner and target hosts
- B. It stores the organization's incident response playbooks
- C. It logs all successful user authentications across the network
- D. It contains the checks used to detect known vulnerabilities, misconfigurations, and missing patches on target systems
Show answer & explanation
Answer: D
A vulnerability scanner relies on a regularly updated plugin or signature database containing the specific checks it uses to identify known CVEs, misconfigurations, and missing patches on scanned systems; the other choices describe unrelated functions such as incident response documentation, authentication logging, or traffic encryption that a scanner's detection database does not perform.
80. During an active intrusion, an analyst confirms an attacker has established multiple footholds across several systems using different persistence mechanisms. Immediately isolating the first discovered host risks alerting the attacker before full scope is known. What approach BEST balances these competing concerns?
- A. Take no containment action until every single compromised host is identified
- B. Isolate all systems on the network immediately regardless of business impact
- C. Perform quiet, coordinated containment across identified footholds simultaneously while continuing scoping efforts on any remaining unknowns
- D. Notify the attacker's ISP and wait for their response before acting
Show answer & explanation
Answer: C
When multiple footholds exist, containing them all at once in a coordinated fashion minimizes the chance of tipping off the attacker through a single early, isolated action while still limiting further damage, rather than waiting indefinitely for perfect scope or overreacting with an indiscriminate full-network shutdown that causes unnecessary business disruption.
81. A forensic analyst must decide the order in which to collect evidence from a live, compromised system before it is powered down for imaging. Which of the following correctly reflects a MORE volatile data source that should generally be prioritized over a LESS volatile one?
- A. Contents of system memory (RAM) are more volatile than data stored on the local hard disk
- B. Disk image data is more volatile than data held in RAM
- C. Archived log files on backup tape are more volatile than active network connection state
- D. Data stored on disk is more volatile than data stored on backup media
Show answer & explanation
Answer: A
The order of volatility principle ranks data by how quickly it disappears once the system is powered off or time passes, and RAM contents are lost almost immediately upon shutdown, making them far more volatile than data persisted to a local hard disk, which survives a power-off; the other pairings in this question reverse that relationship.
82. After eradicating a confirmed persistence mechanism during an incident, the response team wants to declare the incident closed. Which action is MOST important to complete FIRST before closure?
- A. Immediately delete all forensic images to free up storage
- B. Restore all systems from the most recent backup without further verification
- C. Publish the incident details externally to warn other organizations
- D. Verify through monitoring and follow-up scanning that no additional persistence mechanisms or indicators of compromise remain active
Show answer & explanation
Answer: D
Before declaring an incident closed, the team must verify that eradication was complete and no additional persistence mechanisms, backdoors, or indicators of compromise remain, since attackers frequently establish redundant footholds; deleting evidence prematurely, publishing sensitive details externally, or restoring from backup without verification could all leave residual compromise undetected or destroy evidence needed later.
83. A breach involving customer personal data affects individuals across multiple states and countries. Beyond the technical incident response, which additional obligation MOST likely arises for the organization?
- A. A requirement to publicly release the full forensic investigation report
- B. Legal and regulatory notification requirements to affected individuals and applicable authorities within defined timeframes
- C. An obligation to immediately terminate all affected employees
- D. A requirement to disable the organization's entire network permanently
Show answer & explanation
Answer: B
Breaches involving personal data commonly trigger legal and regulatory notification obligations to affected individuals and relevant authorities, often within specific timeframes defined by applicable privacy laws, which runs alongside and beyond the purely technical containment, eradication, and recovery work of incident response; the other listed actions are not standard obligations arising from a data breach.
84. During the lessons-learned phase of an incident, the team identifies that a critical detection gap allowed an attacker to persist undetected for weeks. Which corrective action MOST directly addresses the root cause rather than just the symptom?
- A. Develop and deploy a new detection rule or data source specifically targeting the technique that went undetected, then validate it catches the behavior
- B. Increase the number of analysts on shift without changing detection coverage
- C. Document the gap in the report and take no further action
- D. Purchase a new SIEM platform without addressing the underlying gap
Show answer & explanation
Answer: A
Addressing the root cause of a detection gap requires building and validating a specific detection capability targeting the technique that was missed, ensuring the same class of activity would be caught in the future, rather than simply adding headcount, buying new tooling without changing coverage, or documenting the gap without remediating it.
85. A security team tracks both mean time to detect (MTTD) and mean time to respond (MTTR) across incidents each quarter. An executive asks which metric best reflects how quickly the team notices a threat once it enters the environment, as opposed to how quickly it is resolved. Which metric answers that question?
- A. Mean time to respond (MTTR)
- B. Number of open vulnerabilities at quarter end
- C. Total number of incidents reported
- D. Mean time to detect (MTTD)
Show answer & explanation
Answer: D
Mean time to detect specifically measures the interval between a threat first entering the environment and the team becoming aware of it, which is exactly what the executive is asking about, while mean time to respond instead measures the time from detection to resolution and therefore answers a different question about remediation speed rather than detection speed.
86. An analyst is preparing two different reports on the same vulnerability finding: one for the development team that will fix the code and one for a business unit director who will decide on resourcing. Which approach BEST fits this dual-audience need?
- A. Tailor each report's content and framing to its audience: technical remediation detail for developers, and business risk and resourcing impact for the director
- B. Send the identical highly technical report to both audiences to save time
- C. Send only the CVSS score to both audiences without further explanation
- D. Omit technical details from the developer report to keep it brief
Show answer & explanation
Answer: A
Effective security communication tailors content to its audience: developers need specific technical detail such as affected code paths and remediation steps to actually fix the issue, while a business director needs a risk- and resourcing-focused framing to make a decision, so a single undifferentiated report or a bare score fails to serve either audience well.
87. A CySA+ analyst must present a risk to a business stakeholder who will decide whether to accept, mitigate, transfer, or avoid it. Which framing of the finding is MOST useful for supporting that decision?
- A. The full technical exploit code demonstrating the vulnerability
- B. The exact CVSS vector string and its component metric values
- C. The likelihood and potential business impact of the risk, expressed in terms the stakeholder can weigh against cost and operational disruption
- D. A list of every CVE identifier related to the affected software over the past decade
Show answer & explanation
Answer: C
A business stakeholder making a risk treatment decision needs the finding framed in terms of likelihood and potential business impact weighed against cost and disruption, since that is the information relevant to choosing among accept, mitigate, transfer, or avoid; raw CVSS vector strings, exploit code, or historical CVE lists are technical artifacts that do not translate directly into a business risk decision.
88. A quarterly security report shows the number of critical vulnerabilities remediated has increased, but the average age of open critical findings has also increased. What does this combination MOST likely indicate to a reviewing stakeholder?
- A. New critical findings are being discovered or introduced faster than the team can remediate them, growing the backlog despite higher output
- B. The scanning tool is malfunctioning and should be replaced
- C. No further analysis is needed since remediation volume increased
- D. The vulnerability management program has fully eliminated its backlog
Show answer & explanation
Answer: A
An increasing remediation count alongside a rising average age of open critical findings signals that new critical vulnerabilities are entering the backlog faster than the team can close them out, so despite doing more remediation work in absolute terms, the overall backlog is aging and growing rather than shrinking, which is a meaningful trend for a stakeholder to understand rather than a reason to stop analysis.

Explore more Technology & IT Certifications

Family overview →

In the same family

More in this category

2026 statistics

Key facts: CompTIA CySA+ exam

MCQ questions

750 (on a scale of…

To pass

2h 45m

Time limit

Review the key concepts

Use the compact reference to prepare for your next practice session

Open cheat sheet →

Every free resource for this exam

CompTIA CySA+ study guide CompTIA CySA+ exam guide CompTIA CySA+ cheat sheet

Get a free CompTIA CySA+ study plan

A week-by-week plan plus new practice questions, straight to your inbox.

Official sources

Primary documents used to verify the exam details shown on this page.

CySA+ Certification V3 (Retiring Version) | CompTIACompTIAcomptia.org
CompTIA CySA+ (CS0-003) Certification Exam DetailsCompTIAcomptia.org
CompTIA CySA+ Certification OverviewCompTIAcomptia.org
Pearson VUE — CompTIA Exam Delivery and SchedulingPearson VUEpearsonvue.com
CompTIA Certification Renewal PolicyCompTIAcomptia.org

Last verified against the official exam content outline: July 18, 2026

Frequently asked questions

How many questions are on the CySA+ (CS0-003) exam, and how long do I have?

The CS0-003 exam contains a maximum of 85 questions, and you're given 165 minutes to complete it. That works out to just under two minutes per question if you hit the maximum, so pace yourself and flag anything you're unsure of to revisit at the end. The questions are a mix of standard multiple-choice items and performance-based questions (PBQs) — the PBQs are hands-on simulations that typically appear first and can eat up time, so budget accordingly rather than getting stuck early.

What score do I need to pass CySA+?

You need a score of 750 on a scale of 100–900 to pass. Note that this is a scaled score, not a raw percentage — you don't need to answer 750 out of some number of questions, and the raw number of correct answers required isn't published, so treat any "you need X% correct" claim you see online with skepticism. The scale bottoms out at 100 (not 0), so 750 represents strong-but-not-perfect performance. Focus on mastering the four exam domains rather than chasing an exact percentage target.

What topics does the CySA+ exam cover, and how should I weight my study time?

CySA+ (CS0-003) is broken into four domains: Security Operations (33%), Vulnerability Management (30%), Incident Response Management (20%), and Reporting and Communication (17%). Security Operations and Vulnerability Management together make up 63% of the exam, so that's where the bulk of your study time should go. The certification is designed to validate your ability to detect, analyze, and respond to cybersecurity threats, and it targets professionals working in a Security Analyst role — so expect scenario-driven questions grounded in real analyst workflows rather than pure memorization.

Where do I take the exam, and how long does the certification stay valid?

Pearson VUE is the official test delivery provider for CompTIA exams, including CySA+, and you can take it either at a physical Pearson VUE test center or through online proctored delivery (OnVUE) from home. Once you pass, the certification is valid for three years from your certification date. You don't have to retake the exam to stay certified — you can renew by earning Continuing Education Units (CEUs), so plan to log qualifying activities throughout the three-year window rather than scrambling at the end.