CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
An organization plans to use an advanced machine-learning tool as a central collection server. The tool will perform data aggregation and analysis. Which of the following should the organization implement?
Answer: A
A vulnerability analyst is writing a report documenting the newest, most critical vulnerabilities identified in the past month. Which of the following public MITRE repositories would be best to review?
Answer: B
B. Common Vulnerabilities and Exposures (CVE) The CVE database is a widely recognized repository for standardized identifiers and descriptions of publicly known information security vulnerabilities. It's the go-to resource for vulnerability analysts to stay informed about the latest threats. By reviewing the CVE database, the analyst can identify the most critical vulnerabilities that have emerged in the past month and prioritize remediation efforts.
Source: Adapted from community discussion — ChopSNap
An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:
Which of the following tuning recommendations should the security analyst share?
Answer: C
The answer is actually C if there is only one option to choose since this has the most issues and highlighted in the picture, if it's multiple options then B and C since it's also vulnerable to clickjacking
Source: Adapted from community discussion — ms123451
Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:
Which of the following choices should the analyst look at first?
Answer: E
The analyst should first look at E. p4wnp1_aloa.lan (192.168.86.56). This device is particularly suspicious because it is running services commonly associated with unauthorized or malicious activity, including: SSH (port 22): Often used for remote administration, it can be used for unauthorized remote access. rpcbind (port 111): Typically associated with Remote Procedure Call (RPC) services, which could be a vector for attacks. netbios-ssn (port 139) and microsoft-ds (port 445): Both ports are related to SMB, which is often exploited in network attacks. http-alt (port 8000): This could be a web service running on a non-standard port, potentially for malicious purposes. The MAC address indicates the device is from the Raspberry Pi Foundation, suggesting it might be a Raspberry Pi, which is sometimes used as a platform for penetration testing or unauthorized network activities (e.g., using the P4wnP1 tool, which is a popular pentesting tool for Raspberry Pi). This combination of factors makes it the most suspicious device in the list.
Source: Adapted from community discussion — Wole_excel
A corporation wants to implement an agent-based endpoint solution to help: • Flag various threats • Review vulnerability feeds • Aggregate data • Provide real-time metrics by using scripting languages Which of the following tools should the corporation implement to reach this goal?
Answer: C
A new SOC manager reviewed findings regarding the strengths and weaknesses of the last tabletop exercise in order to make improvements. Which of the following should the SOC manager utilize to improve the process?
Answer: D
Following an attack, an analyst needs to provide a summary of the event to the Chief Information Security Officer. The summary needs to include the who-what-when information and evaluate the effectiveness of the plans in place. Which of the following incident management life cycle processes does this describe?
Answer: B
Which of the following most accurately describes the Cyber Kill Chain methodology?
Answer: C
The Cyber Kill Chain is a proactive defense model that focuses on breaking the chain at any stage to stop an attack. It provides a clear view of how an attacker typically progresses through an attack, from reconnaissance to data exfiltration.
Source: Adapted from community discussion — 4ee1800
After a recent vulnerability report for a server is presented, a business must decide whether to secure the company’s web-based storefront or shut it down. The developer is not able to fix the zero-day vulnerability because a patch does not exist yet. Which of the following is the best option for the business?
Answer: D
A WAF enforces input validation rules, which prevent attackers from sending malicious payloads to the application: Filters or sanitizes requests for SQL, XSS, and other injection attempts. Blocks unauthorized file uploads or parameter tampering.
Source: Adapted from community discussion — JacksonTrite
During a tabletop exercise, engineers discovered that an ICS could not be updated due to hardware versioning incompatibility. Which of the following is the most likely cause of this issue?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 221. 527 questions available.
Version 1.0.0. How we source questions