CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
A list of IoCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost.exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?
Answer: A
A Chief Information Security Officer wants to lock down the users’ ability to change applications that are installed on their Windows systems. Which of the following is the best enterprise-level solution?
Answer: B
GPOs allow centralized control over system configurations, including enforcing security settings and restricting user privileges, making them ideal for preventing users from changing applications on their machines.
Source: Adapted from community discussion — study_study
An employee received a phishing email that contained malware targeting the company. Which of the following is the best way for a security analyst to get more details about the malware and avoid disclosing information?
Answer: D
"to get more details about the malware and avoid disclosing information" D is the only option that isnt sharing the details outside the company.
Source: Adapted from community discussion — 1403ad2
A Chief Finance Officer receives an email from someone who is possibly impersonating the company’s Chief Executive Officer and requesting a financial operation. Which of the following should an analyst use to verify whether the email is an impersonation attempt?
Answer: D
DomainKeys Identified Mail creates a cryptographic signature in the email header to verify the sender's domain. This ensures that the email wasn't altered during transit.
Source: Adapted from community discussion — 4a8c1a0
An analyst is investigating a phishing incident and has retrieved the following as part of the investigation: cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile - EncodedCommand Which of the following should the analyst use to gather more information about the purpose of this command?
Answer: A
Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?
Answer: A
The incident response policy or plan is a document that defines the roles and responsibilities, procedures and processes, communication and escalation protocols, and reporting and documentation requirements for handling security incidents. The incident response policy or plan should also be aligned with the organizational policies and legal obligations regarding incident notification and disclosure.
Source: Adapted from community discussion — kmordalv
An organization’s threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native Windows tools to bypass system controls and execute commands with privileged credentials. Which of the following controls would be most effective to reduce the rate of success of such attempts?
Answer: C
When undertaking a cloud migration of multiple SaaS applications, an organization’s systems administrators struggled with the complexity of extending identity and access management to cloud-based assets. Which of the following service models would have reduced the complexity of this project?
Answer: A
When migrating multiple SaaS applications to the cloud, managing identity and access across all applications can become complex. OpenID is an authentication protocol that simplifies this by enabling Single Sign-On (SSO). With OpenID, users can use a single set of credentials to access multiple cloud-based SaaS applications, reducing the complexity of identity management for systems administrators. SASE is a cloud-based security framework that integrates networking and security functions, like SD-WAN and secure web gateways. While it enhances secure connectivity, it doesn’t specifically address identity and access management challenges.
Source: Adapted from community discussion — 7167087
A security analyst reviews the following results of a Nikto scan:
Which of the following should the security administrator investigate next?
Answer: B
Which of the following explains the importance of a timeline when providing an incident response report?
Answer: C
An incident response timeline is a detailed chronological record of all events and actions taken during the response to a security incident. It includes timestamps and descriptions of each step, providing a comprehensive overview of how the incident was detected, contained, mitigated, and resolved. This timeline is crucial for post-incident analysis, helping to understand the effectiveness of the response, identify areas for improvement, and ensure accountability and transparency in the incident handling process.
Source: Adapted from community discussion — 78f9a0a
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 241. 527 questions available.
Version 1.0.0. How we source questions