CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis?
Answer: C
I passed with 900 points. The correct answer to this question is static analysis, not reverse engineering. I believe reverse engineering is the term for analyzing software.
Source: Adapted from community discussion — hiraharu06
A security analyst has found the following suspicious DNS traffic while analyzing a packet capture: • DNS traffic while a tunneling session is active. • The mean time between queries is less than one second. • The average query length exceeds 100 characters. Which of the following attacks most likely occurred?
Answer: A
Here's the rationale: DNS traffic while a tunneling session is active: This suggests that data is being tunneled over the DNS protocol, which is a common technique used in DNS exfiltration attacks to bypass network security measures. The mean time between queries is less than one second: A high rate of DNS queries, especially with such a short interval between them, is indicative of automated or scripted behavior, which is often associated with data exfiltration attempts. The average query length exceeds 100 characters: Longer-than-normal DNS queries can be a sign that data is being encoded or hidden within the DNS queries themselves, further supporting the likelihood of DNS exfiltration.
Source: Adapted from community discussion — glenndexter
A small company does not have enough staff to effectively segregate duties to prevent error and fraud in payroll management. The Chief Information Security Officer (CISO) decides to maintain and review logs and audit trails to mitigate risk. Which of the following did the CISO implement?
Answer: B
The Chief Information Security Officer (CISO) implemented: B. Compensating controls. Compensating controls are alternative measures put in place when primary controls are not feasible or sufficient to mitigate risks adequately. In this scenario, due to staffing limitations, the small company cannot effectively segregate duties to prevent errors and fraud in payroll management. Therefore, the CISO chose to implement compensating controls by maintaining and reviewing logs and audit trails. These controls help mitigate the risk of errors and fraud by providing oversight and accountability, even in the absence of traditional segregation of duties.
Source: Adapted from community discussion — glenndexter
During the log analysis phase, the following suspicious command is detected: Which of the following is being attempted?
Answer: B
An email hosting provider added a new data center with new public IP addresses. Which of the following most likely needs to be updated to ensure emails from the new data center do not get blocked by spam filters?
Answer: B
To ensure that emails from the new data center do not get blocked by spam filters, the most likely component that needs to be updated is: B. SPF (Sender Policy Framework) The SPF record specifies which IP addresses are allowed to send emails on behalf of a domain. Since the email hosting provider has added a new data center with new public IP addresses, these new IP addresses need to be included in the SPF record to authorize them to send emails for the domain. This ensures that emails sent from the new data center are not considered unauthorized and are less likely to be blocked by spam filters.
Source: Adapted from community discussion — glenndexter
A laptop that is company owned and managed is suspected to have malware. The company implemented centralized security logging. Which of the following log sources will confirm the malware infection?
Answer: A
Among the options provided, the log source that would most likely confirm the malware infection on the company-owned and managed laptop is: A. XDR logs XDR (Extended Detection and Response) logs aggregate and correlate data from various security sources, such as endpoint detection and response (EDR), network traffic analysis (NTA), and other security tools. These logs provide comprehensive visibility into security events and incidents across the organization's infrastructure. If the laptop is suspected to have malware, the EDR component of the XDR solution would likely generate logs indicating suspicious or malicious behavior on the endpoint. This could include activities such as file modifications, process executions, network connections to known malicious domains, or other indicators of compromise (IOCs) associated with malware infections.
Source: Adapted from community discussion — glenndexter
Which of the following best describes the goal of a disaster recovery exercise as preparation for possible incidents?
Answer: A
Disaster recovery exercises are conducted to validate and assess an organization's ability to recover from a disaster or disruptive event effectively. These exercises aim to test the organization's continuity controls, procedures, and plans to ensure they can mitigate the impact of a disaster and resume critical business operations within acceptable time frames. By providing metrics on the effectiveness of the recovery process and testing continuity controls, organizations can identify weaknesses, improve their response capabilities, and enhance overall resilience against potential incidents. Therefore, option A best describes the goal of a disaster recovery exercise.
Source: Adapted from community discussion — Dub3
A security analyst has prepared a vulnerability scan that contains all of the company’s functional subnets. During the initial scan users reported that network printers began to print pages that contained unreadable text and icons. Which of the following should the analyst do to ensure this behavior does not occur during subsequent vulnerability scans?
Answer: C
The behavior described suggests that the vulnerability scan may be affecting the network printers, possibly due to the way the scan is interacting with the printers' embedded web servers or other network services. To ensure this behavior does not occur during subsequent vulnerability scans, the analyst should: C. Create a tailored scan for the printer subnet. By creating a tailored scan specifically for the printer subnet, the analyst can customize the scan parameters to exclude network printers or adjust the scan settings to minimize the impact on the printers' operations. This approach allows the analyst to focus the vulnerability scanning efforts on the appropriate targets while avoiding unintended disruptions to other network devices, such as printers.
Source: Adapted from community discussion — glenndexter
A Chief Information Security Officer has outlined several requirements for a new vulnerability scanning project: • Must use minimal network bandwidth • Must use minimal host resources • Must provide accurate, near real-time updates • Must not have any stored credentials in configuration on the scanner Which of the following vulnerability scanning methods should be used to best meet these requirements?
Answer: B
Minimal network bandwidth: Agent-based scanning distributes the scanning load to the endpoints (hosts) themselves. Since agents run locally on the host, they minimize the amount of network traffic typically generated by centralized scanners. Minimal host resources: Modern agent-based solutions are designed to have a small footprint on the host, using minimal CPU and memory resources. The agent collects and reports only relevant data, reducing the impact on the host's performance. Accurate, near real-time updates: Agents can continuously monitor the system and provide near real-time updates on vulnerabilities since they run directly on the hosts. This gives more accurate and timely results compared to periodic scans. No stored credentials in configuration on the scanner: Since agents are installed directly on the hosts, there's no need to store credentials in the scanner configuration. This reduces the risk of compromising credentials and avoids the need to configure authentication for network-based scans.
Source: Adapted from community discussion — cy_analyst
An employee is no longer able to log in to an account after updating a browser. The employee usually has several tabs open in the browser. Which of the following attacks was most likely performed?
Answer: C
CSRF is the correct answer because question mentions that the user has many tabs open usually so the cross-site request forgery makes sense
Source: Adapted from community discussion — 499f1a0
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 101. 527 questions available.
Version 1.0.0. How we source questions