CompTIA Cybersecurity Analyst (CySA+)527 questions across 53 pages are complete and free, with no account or card.
527 questions in this bank
Free access · progress saved on this device
An analyst wants to ensure that users only leverage web-based software that has been pre-approved by the organization. Which of the following should be deployed?
Answer: B
Allowlisting, also known as whitelisting, is a security practice where you explicitly specify which applications, websites, or software are allowed to run or be accessed within your organization's network or on user devices.
Source: Adapted from community discussion — kmordalv
During a cybersecurity incident, one of the web servers at the perimeter network was affected by ransomware. Which of the following actions should be performed immediately?
Answer: C
Correct Quarantining the server involves isolating it from the network to prevent further spread of the ransomware and to protect other systems on the network from potential infection.
Source: Adapted from community discussion — kmordalv
An organization recently changed its BC and DR plans. Which of the following would best allow for the incident response team to test the changes without any impact to the business?
Answer: A
Correct performing a tabletop drill based on previously identified incident scenarios, is the best choice to test the changes in the BC (Business Continuity) and DR (Disaster Recovery) plans without impacting the business. A tabletop drill involves gathering key stakeholders and walking through various hypothetical scenarios and how they would be handled based on the updated plans.This approach ensures that the organization can test its preparedness without causing any actual disruption or risk to business operations.
Source: Adapted from community discussion — kmordalv
Security analysts review logs on multiple servers on a daily basis. Which of the following implementations will give the best central visibility into the events occurring throughout the corporate environment without logging in to the servers individually?
Answer: B
Correct Configuring the servers to forward logs to a SIEM is the most effective way to achieve central visibility into events occurring throughout the corporate environment without having to log in to each server individually
Source: Adapted from community discussion — kmordalv
An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?
Answer: B
When an IP address outside of the company network is observed running network and vulnerability scans across external-facing assets, it indicates that the attacker is gathering information about the organization's network infrastructure and potential weaknesses. This activity aligns with the reconnaissance stage, as the attacker is actively probing the target's defenses and vulnerabilities to gather intelligence for potential future attacks. Therefore, the analyst is witnessing the reconnaissance stage of an attack framework.
Source: Adapted from community discussion — BanesTech
Following a recent security incident, the Chief Information Security Officer is concerned with improving visibility and reporting of malicious actors in the environment. The goal is to reduce the time to prevent lateral movement and potential data exfiltration. Which of the following techniques will best achieve the improvement?
Answer: A
Correct Improving the Mean Time to Detect (MTTD) is the most relevant technique to achieve the goal of reducing the time to prevent lateral movement and potential data exfiltration by malicious actors. MTTD measures the average time it takes for an organization to detect a security incident or malicious activity once it has occurred. By reducing MTTD, you can identify security threats more quickly, which allows for a faster response to contain the threat, prevent lateral movement, and potentially stop data exfiltration before it occurs.
Source: Adapted from community discussion — kmordalv
After identifying a threat, a company has decided to implement a patch management program to remediate vulnerabilities. Which of the following risk management principles is the company exercising?
Answer: C
It seems the most logical option In this case, the company is taking steps to reduce the risk of security vulnerabilities by patching and addressing them, thereby mitigating the potential harm or damage that could result from those vulnerabilities.
Source: Adapted from community discussion — kmordalv
A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?
Answer: D
Answer is D. The analyst has already contained the original infected machine. Next would be to identify the scope of the malware (how many users have been affected). After the spread has been contained, the analyst can go back and acquire the bit level image for further forensics. Incident response steps guys.
Source: Adapted from community discussion — Cpt_Emerald
The security analyst received the monthly vulnerability report. The following findings were included in the report: • Five of the systems only required a reboot to finalize the patch application • Two of the servers are running outdated operating systems and cannot be patched The analyst determines that the only way to ensure these servers cannot be compromised is to isolate them. Which of the following approaches will best minimize the risk of the outdated servers being compromised?
Answer: A
You have to compromise and meet in the middle sometimes. Compensating controls are the only things that reduce the risk. B, C, D don't apply in this context. From the Sybex CySA 003 study guide, page 20: Compensating Controls In some cases, security professionals may not be able to implement all of the desired security controls due to technical, operational, or financial reasons. For example, an organization may not be able to upgrade the operating system on retail point-of- sale (POS) terminals due to an incompatibility with the POS software. In these cases, security professional should seek out compensating controls designed to provide a similar level of security using alternate means. In the POS example, administrators might place the POS terminals on a segmented, isolated network and use intrusion prevention systems to monitor network traffic for any attempt to exploit an unpatched vulnerability and block it from reaching the vulnerable host. This meets the same objective of protecting the POS terminal from compromise and serves as a compensating control.
Source: Adapted from community discussion — [Removed]
The vulnerability analyst reviews threat intelligence regarding emerging vulnerabilities affecting workstations that are used within the company:
Which of the following vulnerabilities should the analyst be most concerned about, knowing that end users frequently click on malicious links sent via email?
Answer: A
A seems to be the most correct. Vulnerability A does not require user interaction, does not require authentication and the attack complexity is low. The attack vector for Vuln A is Network, which is generally easier for attackers when compared to the local one. Network base attack can spread across to multiple systems.
Source: Adapted from community discussion — 16561f6
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CS0-003 practice, question 31. 527 questions available.
Version 1.0.0. How we source questions