Skip to content

CompTIA CySA+ (CS0-003) - Practice Questions

15 questions for CySA+ prep across security operations, vulnerability management, incident response and management, and reporting and communication.

CySA+ is analyst-level and behavioral: it tests what you do with the data, not just what the terms mean.

Cert page: exams/comptia/cysa-plus/

Question 1

Scenario: A vulnerability scan returns 4,000 findings. What drives remediation order?

A. Risk in context: known exploitation, asset criticality, exposure, compensating controls, and CVSS B. CVSS base score alone, since it is the only vendor-neutral number and context scoring adds subjective bias C. Alphabetical by host D. Oldest first

Answer **Correct: A** **Why:** A critical CVSS on an isolated internal test box outranks nothing. Environmental and temporal CVSS metrics exist for exactly this adjustment, and known-exploited catalogs turn "theoretically severe" into "actively used", which is the strongest prioritization signal available.

Question 2

Scenario: A scanner reports a vulnerability the analyst confirms is not present.

A. Report it anyway, since the scanner's database is maintained by the vendor and the analyst should not second-guess it B. Ignore all scanner output C. A false positive: validate, document it with evidence, and tune the scanner or add an exception D. Disable the scanner

Answer **Correct: C** **Why:** Validation is the analyst's core job, because untuned scanner output erodes trust in the whole program. Note the counterpart: a false negative is more dangerous and is why scanning is layered with configuration review and penetration testing.

Question 3

Scenario: A SIEM rule fires 300 times a day for benign administrative activity.

A. Raise the alert threshold from one event to a few thousand so that only large bursts of activity still create alerts B. Disable the rule C. Tune it: exclude the known-good identity or process, and consider grouping alerts D. Ignore the alerts

Answer **Correct: C** **Why:** Alert fatigue is a real security failure because analysts stop reading. Tuning preserves the detection for the malicious version of the behavior; disabling the rule loses that coverage entirely, which is what makes the two options meaningfully different.

Question 4

Scenario: Which describes threat hunting?

A. Reading vendor advisories and threat feeds each morning to see whether new indicators match anything in the environment B. Hypothesis-driven proactive searching for adversary activity that existing detections have not caught, starting from a theory C. Responding to alerts raised by the SIEM, working the queue in order of severity until each one is closed D. Running vulnerability scans

Answer **Correct: B** **Why:** Hunting starts from a hypothesis ("an attacker would establish persistence via scheduled tasks") rather than from an alert. The lifecycle matters: a validated hunt becomes a new detection, which is how hunting improves the SOC rather than being a one-off exercise.

Question 5

Scenario: An analyst maps observed attacker behavior to a common framework.

A. OWASP Top 10 B. NIST CSF, which catalogs the tactics and techniques adversaries use and is the usual basis for detection coverage maps C. MITRE ATT&CK, mapping tactics and techniques D. CVSS, which scores each technique by the attacker's tactics and is used to map observed behavior to a shared vocabulary

Answer **Correct: C** **Why:** ATT&CK gives a shared vocabulary for behavior, which supports coverage analysis: which techniques do we detect, and where are the gaps. The Cyber Kill Chain and the Diamond Model are the other two models CySA+ expects you to recognize.

Question 6

Scenario: Indicators of compromise versus indicators of attack.

A. IOCs are behavioral, describing what an attacker does as it runs, while IOAs are static file hashes from prior incidents B. They are identical C. IOAs are historical records of past breaches kept for reporting, while IOCs show activity that is currently in progress D. IOCs are artifacts of past activity (hashes, IPs, domains); IOAs describe behavior in progress

Answer **Correct: D** **Why:** Hash and IP indicators are trivially changed by an attacker, which is why behavior-based detection outlives them. The practical implication is where to invest detection effort: atomic indicators for cheap coverage, behavioral analytics for durability.

Question 7

Scenario: A host is confirmed compromised. What comes first?

A. Run antivirus on the host and clean what it finds, then return it to service once the scan comes back clear B. Isolate the host from the network but keep it running, and capture volatile data first C. Shut it down at the power button so the attacker loses access, then image the disk before anything else is touched D. Reimage immediately so the malware is removed and the business impact is as short as possible, then investigate from logs

Answer **Correct: B** **Why:** Powering off destroys memory-resident evidence, which is often where the malware actually lives. Order of volatility guides collection: registers and cache, then memory, then network state, then disk. Isolation stops the spread without losing the artifacts.

Question 8

Scenario: Evidence must hold up in a legal proceeding.

A. Analyze the original disk directly, since making a verified copy would take too long B. Screenshot every screen the analyst looks at, as a dated and signed record of what the original evidence contained C. Copy the relevant files to a shared drive where the legal team can open them without special tools D. Keep chain of custody, take hashed forensic images, and work from copies

Answer **Correct: D** **Why:** Chain of custody documents every handler and transfer; hashing proves the image is unaltered. Working on the original rather than a verified copy is what gets evidence excluded, regardless of what the analysis found.

Question 9

Scenario: Network traffic shows periodic outbound connections to an unknown domain at exact intervals.

A. Possible beaconing: check the destination's reputation, the process behind it, and the payload B. A backup job by definition, since only scheduled tasks connect at exact intervals C. Normal traffic D. A DNS issue, since resolvers retrying a failing lookup produce regular outbound traffic to the domain

Answer **Correct: A** **Why:** Regularity is the signature; legitimate traffic is usually more irregular, though jitter is used to evade this exact detection. The pivot from network observation to the responsible process on the host is what turns a suspicion into a finding.

Question 10

Scenario: A web server log shows requests containing ' OR '1'='1.

A. SQL injection attempt: check if it succeeded, review parameterization, and assess data exposure B. A malformed request from a broken client library, which the web server logs whenever quotes are not escaped C. A scanner artifact to ignore D. A DDoS attack, because repeated single-purpose requests of this form are meant to exhaust the server's connection pool

Answer **Correct: A** **Why:** The follow-up matters more than the identification: attempted and successful are different incidents. Response codes and response sizes in the log usually distinguish them, and parameterized queries are the fix rather than input filtering.

Question 11

Scenario: Which log source best answers "which process opened this network connection"?

A. EDR or host process telemetry, correlated with the network connection B. DNS logs, which record the process name and process ID of the application that asked for each lookup C. Firewall logs, which record the source process because the firewall inspects the application layer of each session D. Web server logs, which store the originating process of each client request alongside the user agent and URL

Answer **Correct: A** **Why:** Network logs identify endpoints, not processes. Correlating host and network telemetry is the standard analyst pivot, and it is why EDR deployment coverage gaps are a detection problem rather than just a tooling preference.

Question 12

Scenario: A patch cannot be applied to a critical production system.

A. Accept the risk silently and note it in the next quarterly report so that business owners are not alarmed B. Patch anyway during business hours C. Apply compensating controls (segmentation, virtual patching, tighter monitoring) and document the exception with owner and review date D. Take the system offline permanently, since a vulnerable production system cannot be protected by other controls

Answer **Correct: C** **Why:** Exceptions are legitimate when they are documented, time-bounded, and owned. The failure mode is the permanent undocumented exception, which is indistinguishable from having forgotten about the vulnerability entirely.

Question 13

Scenario: A report is being written for executives after an incident.

A. Full packet captures and log excerpts, so the executives can verify events for themselves B. Business impact, what was affected, actions taken, status, and recommendations with owners; detail in an appendix C. Technical detail only D. A single sentence

Answer **Correct: B** **Why:** Audience-appropriate reporting is an examinable CySA+ skill. Executives need impact and decisions; the technical team needs the detail. Sending packet captures to an executive is the same communication failure as sending "it's fixed" to the engineers.

Question 14

Scenario: Which metric best shows whether the SOC is improving?

A. Number of alerts, since a higher count proves the detection coverage has widened and the SOC is seeing more attacks B. Number of rules C. Number of tools deployed, since each added platform expands visibility and so shows the SOC's capability growing D. Mean time to detect and respond, trended over time

Answer **Correct: D** **Why:** MTTD and MTTR measure outcomes; alert and rule counts measure activity and can rise while effectiveness falls. Trending matters more than the absolute value, since the baseline differs by environment.

Question 15

Scenario: A phishing email reached 200 users and 12 clicked.

A. Block the sender domain at the gateway and close the ticket, since the campaign cannot continue once the source is gone B. Scope it: find who clicked or gave credentials, purge the email, reset those accounts, hunt for follow-on activity C. Send all 200 users a reminder email about reporting phishing, and take no further technical action on the affected mailboxes or accounts D. Reset every user's password across the company and close the ticket, since this removes any credentials that were taken

Answer **Correct: B** **Why:** Clicking and entering credentials are different exposure levels requiring different responses. Blocking the sender addresses the next campaign, not this one, and the hunt for post-compromise activity is what distinguishes closing the ticket from closing the incident.

Where to go deeper