CompTIA CySA+ Practice Test

After a DDoS attack, you’re briefing executives. Which metric best demonstrates impact?

A penetration test flags weak passwords. Which policy should you enforce to mitigate this?

A network scan reveals an unknown device. Which tool confirms its OS and services?

A malware outbreak is detected on a workstation. Which command captures live memory for forensic analysis?

A scan identifies an outdated Apache version (2.4.29) with CVE-2019-0211. What’s the first remediation step?

A SIEM alert flags repeated login failures. Which command investigates the source on a Linux server?

A stakeholder requests a report on a recent phishing incident. Which element should you prioritize to ensure clarity?

During a ransomware attack, a system is isolated. Which step should follow to determine the attack vector?

A vulnerability scan reveals a critical SQL injection flaw on a web server. Which tool should you use to validate this finding manually?

A SOC analyst notices unusual outbound traffic from a server. Which command should they use to identify the process initiating the connections?

Which of these is NOT considered a common indicator when analyzing vulnerability-assessment tool output?

Which framework can assist in defining consistent scanning and remediation policies across an organization?

During a scan, a critical infrastructure device forbids the scanner due to sensitive configuration. How should you proceed?

Which scanning approach would you use to identify outdated or vulnerable services running on cloud-based infrastructure without installing agents?

Which control type helps reduce risk from unpatched or end-of-life software when patching is not immediately possible?

After a vulnerability scan, multiple low-severity flaws are found across many systems. What should guide the remediation priority?

Which type of vulnerability scanning is most suitable for detecting misconfigurations in developed web applications?

If a newly released zero-day vulnerability has no patch yet, what is the BEST interim mitigation measure?

What does a high Common Vulnerability Scoring System (CVSS) base score typically indicate about a vulnerability?

When planning a vulnerability scan across a corporate network, which scanning method is LEAST likely to miss internal-only vulnerabilities?

Why is understanding both host-based and network-based data important when investigating suspicious activity?

Which identity and access management (IAM) control reduces risk of compromised credentials being misused within an enterprise?

When monitoring network traffic, which pattern might indicate beaconing behavior from malware?

What is the primary advantage of integrating a SOAR (Security Orchestration, Automation, and Response) platform in a SOC workflow?

Which of the following is a host-based indicator of potentially malicious activity?

In a SIEM environment, why is log ingestion and normalization important before analysis?

Which mechanism is commonly used to protect sensitive data in transit and support secure communications?

Which architecture model helps contain trust boundaries and reduces risk across cloud and on-premises environments?

You notice unusual outbound traffic from an endpoint late at night, to an external IP not associated with normal business activity. What is your BEST next step?

Which of these is the MOST important reason to ensure time synchronization across all systems in a security monitoring environment?

An analyst notices a workstation making DNS requests for randomly generated, nonsensical domain names at a high frequency. Which technique is this pattern most indicative of?

Which SIEM concept refers to reducing the volume of low-value or duplicate alerts so analysts can focus their attention on genuinely significant security events?

Which SIEM data processing concept converts logs from many different sources and formats into a consistent, standardized structure, enabling more effective correlation and searching?

Which SIEM data processing concept adds additional context, such as geolocation or threat intelligence reputation data, to raw log entries to make them more useful for analysis?

An analyst observes a user account authenticating from New York and then, twelve minutes later, from a location that would require physically impossible travel time to reach. Which detection concept does this represent?

Which network traffic pattern, characterized by regular, periodic outbound connections at consistent intervals to an external host, is a common indicator of malware communicating with its command-and-control infrastructure?

Which security operations technology automates repetitive response actions, such as automatically isolating an infected host, based on predefined playbooks triggered by detected security events?

Which endpoint security tool continuously monitors endpoint activity for suspicious behavior patterns, going beyond traditional signature-based antivirus detection, and provides tools for detailed investigation and automated response?

Which proactive security operations activity involves an analyst forming a hypothesis about potential undetected threats and actively searching through data for evidence, rather than waiting for an automated alert?

Which industry framework provides a detailed, publicly available knowledge base of adversary tactics, techniques, and procedures (TTPs) that analysts commonly use to map observed attacker behavior?

Which access control practice involves granting elevated permissions to a user only for a limited, defined time period when genuinely needed, automatically revoking that access afterward?

Which programming/scripting skill is commonly used by security analysts to automate repetitive tasks, such as parsing log files and extracting relevant fields for further analysis?

Which cloud security concept requires understanding which security responsibilities belong to the cloud provider and which belong to the customer, varying based on the service model (IaaS, PaaS, or SaaS)?

An analyst is reviewing cloud provider logs and needs to identify all API calls made by a specific user identity over the past 24 hours. Which type of cloud log would be most directly relevant?

Which security concept involves segmenting a network into small, tightly controlled zones at the individual workload level, limiting an attacker's ability to move laterally even after compromising one specific system?

Which identity security practice continuously monitors for anomalous or risky sign-in behavior, such as a login from an unfamiliar location or device, and can automatically trigger additional verification or block access?

Which security operations practice involves regularly comparing a system's current configuration against an approved secure baseline, flagging any unauthorized deviations?

Which security practice involves reducing a system's attack surface by disabling unnecessary services, closing unused ports, and applying secure configuration standards before or during deployment?

Which network security device inspects traffic at multiple layers, incorporating capabilities such as application awareness, intrusion prevention, and TLS inspection into a single unified platform?

Which type of security control is a network-based Intrusion Prevention System (IPS) considered, since it can actively block detected malicious traffic in real time, rather than simply alerting on it?

Which vulnerability scoring system provides a standardized numerical score, typically from 0 to 10, representing a vulnerability's severity based on factors like exploitability and impact?

Which vulnerability management concept catalogs and uniquely identifies publicly known vulnerabilities using a standardized identifier, such as CVE-2024-12345?

Which vulnerability prioritization factor considers whether active, real-world exploitation of a vulnerability has been observed in the wild, beyond just its theoretical CVSS severity score?

Which type of vulnerability scan is performed with valid credentials on the target system, providing deeper visibility into missing patches and misconfigurations than an unauthenticated scan?

Which result occurs when a vulnerability scanner reports a vulnerability that does not actually exist on the scanned system, wasting analyst time investigating a non-issue?

Which result occurs when a vulnerability scanner fails to detect and report a vulnerability that genuinely exists on the scanned system, leaving the organization unaware of real risk?

Which type of vulnerability occurs when an application fails to properly validate the length of user-supplied input, potentially allowing an attacker to overwrite adjacent memory and execute arbitrary code?

Which type of vulnerability occurs when an application deserializes untrusted data without proper validation, potentially allowing an attacker to execute arbitrary code or manipulate application logic?

Which type of vulnerability allows an attacker to manipulate file path input to access files and directories outside of an intended restricted directory, such as reading a server's sensitive configuration file?

Which vulnerability class specifically covers weaknesses in how software containers, such as Docker images, are built and configured, such as running as root or including unnecessary vulnerable packages?

Which vulnerability management activity involves attempting to actively exploit identified vulnerabilities in a controlled manner to assess real-world risk and validate that a vulnerability is truly exploitable?

Which practice involves systematically applying vendor-released security updates to operating systems and applications to remediate known vulnerabilities before attackers can exploit them?

Which practice involves testing web applications and APIs specifically for security flaws during the software development lifecycle, using tools that analyze source code without executing it?

Which practice involves testing a running web application from the outside, simulating how an attacker would interact with it, to identify vulnerabilities such as injection flaws or broken authentication?

Which supply chain security concern involves a legitimate, trusted software update mechanism being compromised by an attacker to distribute malware to all downstream customers who install the update?

Which document, often provided by a software vendor, lists all the components and dependencies included in a software product, helping an organization assess exposure to a newly disclosed vulnerability in a specific library?

Which vulnerability management concept describes prioritizing remediation of vulnerabilities based on a combination of severity, exploitability, and the criticality of the affected asset to the business, rather than severity score alone?

Which cloud-specific vulnerability scanning approach continuously evaluates cloud resource configurations against security benchmarks, flagging issues such as an overly permissive storage bucket policy?

Which incident response phase involves removing the root cause of an incident from affected systems, such as deleting malware and closing the exploited vulnerability?

Which incident response phase involves restoring affected systems to normal operation and closely monitoring them as they return to production use?

Which digital forensics principle dictates that the most volatile (easily lost) data, such as CPU cache and RAM contents, should be collected before less volatile data like disk storage?

Which digital forensics principle requires maintaining a documented record of who handled evidence, when, and what was done with it, to preserve its integrity for potential legal proceedings?

Which document formally outlines an organization's specific procedures for responding to different categories of security incidents, including roles, escalation paths, and communication plans?

Which incident classification criterion helps a SOC determine how quickly and with what level of resources to respond to a given incident, based on factors like data sensitivity and business impact?

Which term describes a suspected security event that has not yet been confirmed as an actual incident, requiring further investigation and triage before being escalated?

An analyst is investigating a compromised Linux server and needs to capture the contents of RAM before powering down the system, since RAM contents will be lost upon shutdown. Which activity does this describe?

Which incident response activity involves determining the underlying, fundamental reason an incident occurred, going beyond just the immediate technical symptoms, to prevent recurrence?

Which stakeholder communication practice during an active incident involves providing regular, appropriately scoped updates to executives and other stakeholders without overwhelming them with unnecessary technical detail?

Which activity, conducted after an incident is fully resolved, involves documenting what happened, evaluating the effectiveness of the response, and identifying improvements for future incidents?

Which legal/compliance concept requires an organization to preserve all potentially relevant data and suspend normal data destruction/retention schedules once litigation or a regulatory investigation is reasonably anticipated?

Which quantitative risk calculation represents the total expected annual monetary loss from a specific risk, calculated by multiplying the Single Loss Expectancy by the Annualized Rate of Occurrence?

Which compliance framework specifically governs the protection of cardholder data for organizations that store, process, or transmit credit card information, and would be referenced in a compliance-focused vulnerability report?

Which reporting practice involves tailoring the level of technical detail and framing of a security report based on the specific audience, such as providing high-level business impact for executives versus detailed technical findings for engineers?

Which key performance indicator measures the average time it takes a SOC to detect a security incident after it has actually begun, a metric commonly tracked and reported to demonstrate SOC effectiveness?

Which key performance indicator measures the average time it takes a SOC to respond to and resolve a security incident once it has been detected, commonly reported alongside MTTD?

Which report structure section typically comes first in a formal vulnerability assessment or penetration test report, providing a concise, non-technical summary of findings and overall risk for busy executive readers?

Which compliance-related activity involves periodically verifying that an organization's security controls are actually operating as intended and documented, often performed by an internal or external auditor?

Which reporting practice involves clearly documenting specific, actionable remediation steps for each identified vulnerability, rather than simply listing the vulnerability's name and severity score?

Which practice involves communicating a security vulnerability to the affected software vendor privately, giving them a reasonable period of time to develop and release a patch before the details are made publicly available?

Which trending/reporting metric tracks the total number of open vulnerabilities across an organization over time, helping stakeholders visualize whether the overall vulnerability backlog is improving or worsening?