CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
Which of the following should be updated after a lessons-learned review?
Answer: D
D. Incident response plan Lessons Learned is apart of the post -incident acuity of incident response, therefore once lessons learned is completed , incident response should be updated.
Source: Adapted from community discussion — Kmelaun
A software developer has been deploying web applications with common security risks to include insufficient logging capabilities. Which of the following actions would be most effective to reduce risks associated with the application development?
Answer: D
A tricky one, but here is my take. OWASP (Open Web Application Security Project) provides a comprehensive set of guidelines, best practices, and tools for identifying and mitigating web application security risks. Regular code reviews using OWASP guidelines enable developers to systematically identify security vulnerabilities, including insufficient logging capabilities, within the codebase.
Source: Adapted from community discussion — Brick69
An analyst suspects cleartext passwords are being sent over the network. Which of the following tools would best support the analyst's investigation?
Answer: C
Which of the following security operations tasks are ideal for automation?
Answer: D
D is not the best answer, what if the domain of the sender is benign like gmail or yahoo or any free email services then you block those legitimate domains, that will compromise the availability of the firm. Most phishers are using free email services.
Source: Adapted from community discussion — Tonying
Using open-source intelligence gathered from technical forums, a threat actor compiles and tests a malicious downloader to ensure it will not be detected by the victim organization's endpoint security protections. Which of the following stages of the Cyber Kill Chain best aligns with the threat actor's actions?
Answer: D
Correct answer is D. Threat actor already gathered (information) intelligence from technical forums which was part of reconnaissance. As a next stage - weaponization, the threat actor is testing and getting malware ready.
Source: Adapted from community discussion — CyberPark17
An organization would like to ensure its cloud infrastructure has a hardened configuration. A requirement is to create a server image that can be deployed with a secure template. Which of the following is the best resource to ensure secure configuration?
Answer: A
A. CIS Benchmarks. Explanation: CIS (Center for Internet Security) Benchmarks provide consensus-based best practices for securely configuring various technologies, including operating systems, applications, and cloud environments. They offer specific configuration guidelines and recommendations to help organizations reduce security risks and vulnerabilities.
Source: Adapted from community discussion — section8santa
A security analyst reviews the following Arachni scan results for a web application that stores PII data:
Which of the following should be remediated first?
Answer: A
The image shows a scan result indicating various security issues for a web application. The issues are categorized by severity, with Cross-Site Scripting (XSS) identified as one of the high-severity issues. Given the options and the context of storing Personally Identifiable Information (PII), the issue that should be remediated first is: A. SQL injection SQL injection vulnerabilities are critical because they can allow attackers to access and manipulate sensitive data, including PII, directly from the database. This type of vulnerability often poses a higher risk than others, including XSS, as it can lead to data breaches and potentially complete compromise of the application and its data.
Source: Adapted from community discussion — Omo_Mushin
Which of the following stakeholders are most likely to receive a vulnerability scan report? (Choose two.)
Answer: AF
Executive management doesn't need to see the vulnerability scan report itself. Product owners and systems administration need to see it to prioritize what needs to be remediated.
Source: Adapted from community discussion — jspecht
Which of the following techniques can help a SOC team to reduce the number of alerts related to the internal security activities that the analysts have to triage?
Answer: D
D. Add a SOAR rule to drop irrelevant and duplicated notifications Implementing a Security Orchestration, Automation, and Response (SOAR) solution can help reduce the number of alerts that SOC analysts have to triage by automatically filtering out irrelevant or duplicated notifications. This can significantly reduce the noise level and allow analysts to focus on investigating and responding to genuine security incidents.
Source: Adapted from community discussion — Nishaw
An analyst is evaluating a vulnerability management dashboard. The analyst sees that a previously remediated vulnerability has reappeared on a database server. Which of the following is the most likely cause?
Answer: B
B. A rollback had been executed on the instance. If a previously remediated vulnerability has reappeared on a database server, it is possible that a rollback had been executed on the instance. A rollback can revert changes made during the remediation process, leading to the reappearance of the vulnerability. This highlights the importance of tracking and managing changes to ensure that vulnerabilities remain remediated after they have been addressed.
Source: Adapted from community discussion — Nishaw
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 121. 527 questions available.
Version 1.0.0. How we source questions