Master the Exam with This Free CompTIA CySA+ (CS0-003) Practice Test

What is the primary function of the Spanning Tree Protocol (STP) in a switched network?

An analyst is reviewing the CVSS v3.1 score for a vulnerability. The Attack Vector (AV) metric is rated as ‘Network’ (N). What does this imply about the vulnerability?

An organization wants to use a physical access control method that identifies individuals based on their unique physical characteristics. Which of the following technologies should they implement?

Which of the following would be considered an ‘accidental’ threat to an organization’s security?

An organization’s risk assessment identifies a high-impact risk with a very low probability of occurrence. Management decides that the cost of mitigating the risk far exceeds the potential loss. They document this decision and continue operations. What risk management strategy has been employed?

An analyst is investigating an attack where the adversary compromised a public-facing web server and then used it to scan and attack other servers in the same DMZ. What is this phase of the attack called?

A threat actor performs a DNS zone transfer against a company’s public DNS server. What is the primary type of information the actor is trying to obtain?

A security team is using a Security Orchestration, Automation, and Response (SOAR) platform. What is a primary benefit of this technology?

An organization wants to analyze potentially malicious files in a safe environment that mimics a user’s workstation, allowing them to observe the file’s behavior without risk to the corporate network. What should they use?

An attacker sends a flood of TCP SYN packets to a server with spoofed source IP addresses. The server responds with SYN-ACK packets to these fake addresses and keeps waiting for the final ACK, eventually exhausting its resources. What type of attack is this?

A company wants to implement Single Sign-On (SSO) for its cloud-based applications. They need a standard that uses XML-based assertions to exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP). Which technology should they use?

A security analyst is tasked with performing a credentialed vulnerability scan of a Windows server. What is a key requirement for this type of scan to be successful?

A company has a policy that backups must ensure no more than 4 hours of data can be lost in a disaster. The policy also states that the system must be fully operational again within 2 hours of a failure. What do these two policy statements define?

An organization’s security policy states that all sensitive data must be encrypted both when it is stored on disk and when it is being transmitted over the network. What two concepts does this policy address?

Which of the following describes a key difference between a hot site and a cold site for disaster recovery?

A security analyst is reviewing a vulnerability scan report for an internet-facing web server. Which of the following findings should be prioritized for immediate remediation?

Which of the following BEST describes the concept of a ‘zero-trust’ architecture?

A penetration tester gains access to a network segment and wants to intercept traffic between a client workstation and a server. The tester sends unsolicited ARP reply packets to both the client and the server, associating the tester’s MAC address with the other’s IP address. What attack is being performed?

Which of the following is an example of a detective security control?

What type of security control is a security guard who patrols a data center?

A security analyst is investigating a suspected malware infection. The malware appears to have modified core operating system files to hide its presence, making it invisible to standard antivirus scans and file system browsers. What type of malware is most likely involved?

Which cryptographic concept ensures that if a server’s long-term private key is compromised, past session keys encrypted with it cannot be decrypted?

A penetration tester wants to use a social engineering technique where they send a targeted email to a high-level executive, pretending to be the company’s legal counsel, to trick them into opening a malicious attachment. What is this specific type of attack called?

A security team needs to analyze network traffic but finds that it is encrypted with TLS. To inspect this traffic for threats, they implement a device that sits between the users and the internet, decrypts the traffic, inspects it, and then re-encrypts it before sending it to the destination. What is this process called?

Which of the following describes a ‘playbook’ in the context of incident response?

An analyst reviews SIEM logs and notices that a single user account has logged in from IP addresses in North America, Europe, and Asia within a 15-minute window. Which type of indicator is this?

An organization uses an Endpoint Detection and Response (EDR) solution. What is a primary capability of an EDR tool that distinguishes it from traditional antivirus software?

During a vulnerability scan, a tool reports a critical SQL injection vulnerability on a web server. However, upon manual verification, the security analyst determines that a Web Application Firewall (WAF) is in place and effectively blocks all SQL injection attempts. What has the vulnerability scanner produced?

A firewall is configured to block all incoming traffic by default and only allow traffic to specific ports and services that are explicitly defined in the ruleset. What is this security principle called?

A company is moving to a serverless computing architecture using a Function-as-a-Service (FaaS) provider. Which security tool would be LEAST effective in this new environment?

What is the primary difference between a threat and a vulnerability in the context of risk management?

What is the primary purpose of data obfuscation techniques like tokenization and masking?

What is the primary goal of the ‘lessons learned’ phase of an incident response process?

A company’s acceptable use policy (AUP) is an example of which type of security control?

An analyst is reviewing Apache web server logs and finds the entry: `GET /view.php?file=../../../../etc/passwd`. What type of attack is being attempted?

During an internal audit, an analyst discovers that a database administrator who moved to the marketing department three months ago still has administrative access to the production databases. This is an example of what security issue?

An incident response team has contained a malware outbreak and removed the malicious software from all affected systems. According to the NIST incident response lifecycle, what is the next major phase they should enter?

A company uses a single physical server to host multiple virtual machines (VMs), each running a different application. An attacker finds a vulnerability that allows them to break out of one of the guest VMs and access the underlying host operating system. What is this type of attack called?

A security analyst is hardening a Linux server. Which action would be most effective at reducing the server’s attack surface?

What is the primary security benefit of using network segmentation?

An attacker uses a compromised IoT device within a corporate network to launch a denial-of-service attack against an external website. The organization has no visibility into the IoT device’s activities because it was installed by an employee without IT’s knowledge. What is this IoT device an example of?

A document describes how an attacker group uses a specific strain of malware, delivered via spear-phishing emails, to establish a command-and-control channel over DNS, and then moves laterally using stolen credentials. This description of the adversary’s methods is an example of what?

An attacker compromises a user’s workstation that has access to a financial database. To exfiltrate large amounts of data without being detected by network monitoring tools, the attacker hides the data within normal-looking DNS query traffic. What is this technique called?

During an incident, the response team needs to collect evidence from a running server. According to the order of volatility, which of the following data sources should be collected FIRST?

An analyst is examining a disk image from a compromised Windows workstation. To determine if a specific malicious executable was ever present, even if deleted, which forensic artifact is LEAST likely to contain evidence of the file’s existence?

A security team is implementing a solution to prevent sensitive data, such as credit card numbers (CHD), from being sent out of the network via email. The solution should be able to inspect outbound traffic content and block messages that violate policy. What type of technology should they deploy?

What is the primary purpose of a ‘root of trust’ in a secure boot process?

A security analyst is investigating a breach and finds that the attacker used living-off-the-land (LotL) techniques. What does this mean?

A security policy document that states, ‘All servers must be hardened by disabling unnecessary services and applying security patches within 30 days of release,’ is an example of what?

A threat actor uses a zero-day exploit to compromise a system and then installs malware. Which phase of the Cyber Kill Chain does the use of the zero-day exploit represent?

A company wants to secure its wireless network for corporate users, requiring each user to authenticate with their own unique domain credentials. Which authentication method should be used?

An analyst runs the `netstat -an` command on a Windows server and sees a connection in the `LISTENING` state on port 3389. What service is most likely running?

During an investigation, an analyst needs to create a bit-for-bit, forensically sound copy of a hard drive. What is this copy called?

An analyst is reviewing logs from a Network Time Protocol (NTP) server and sees a massive number of responses being sent to a single target IP address, which is not the IP that sent the original requests. The requests were small, but the responses are large. What type of attack is likely occurring?

What is the primary security advantage of using an Intrusion Prevention System (IPS) over an Intrusion Detection System (IDS)?

An analyst is examining network traffic with Wireshark and wants to identify which host initiated a DHCP IP address lease process. What type of message should the analyst filter for?

A software developer wants to prevent SQL injection attacks. The application takes user input and uses it to query a database. Which of the following is the MOST effective mitigation technique?

An analyst uses the command `ps -aux | grep apache` on a Linux server. What is the analyst attempting to do?

An organization is using a cloud service where the provider manages the hardware, network, and virtualization layer, but the organization is responsible for managing the operating system, middleware, and applications. What cloud service model is this?

A company is concerned about attacks that exploit unpublished software vulnerabilities for which no patch exists. What is the term for this type of vulnerability?

An organization wants to adopt a threat intelligence sharing standard that uses JSON and defines objects like ‘attack-pattern’, ‘malware’, and ‘threat-actor’ to describe cybersecurity threats. Which standard fits this description?

An analyst is using a tool to test a web application by sending it a large amount of malformed and random data to see if it crashes or behaves unexpectedly. What is this technique called?

An organization is building a software application and wants to ensure security is integrated into every phase of the development lifecycle, from design and coding to testing and deployment. What is this methodology called?

A security analyst needs to create a forensic copy of a hard drive while ensuring the original drive is not modified in any way during the imaging process. What tool should be used?

Which of the following describes the difference between containers and traditional virtual machines (VMs)?