CompTIA CySA+ (CS0-003) Practice Exam — 100 Questions (New Set)

Eradication is:

Eradication is:

Jump servers are:

UEBA is primarily used to:

Which evidence has highest volatility?

Best first action for active ransomware on a host:

Containment aims to:

First phase of NIST incident response is:

Which control helps reduce privilege creep?

What is the primary goal of vulnerability management?

DNS filtering primarily helps prevent:

Which log source best detects brute-force attempts?

Password spraying differs from brute force because it:

Microsegmentation primarily reduces:

Which log source best detects brute-force attempts?

Zero-day vulnerability best definition is:

A SIEM’s core function is to:

File Integrity Monitoring (FIM) detects:

Which term describes alternative measures that provide equivalent protection when a primary control is infeasible?

Certificate pinning defends mainly against:

A post-incident after-action report should:

Event correlation in a SIEM helps:

Purple teaming is:

Credential stuffing is:

Best first action for active ransomware on a host:

UEBA is primarily used to:

Jump servers are:

Forward secrecy in TLS ensures that:

Risk register is primarily used to:

Credential stuffing is:

Best way to validate scanner findings before emergency patching is to:

File Integrity Monitoring (FIM) detects:

A post-incident after-action report should:

Event correlation in a SIEM helps:

Microsegmentation primarily reduces:

Purpose of an asset inventory in vuln management is to:

Forward secrecy in TLS ensures that:

DKIM helps by:

DKIM helps by:

A SIEM’s core function is to:

EDR provides which added capability beyond AV?

WAFs primarily protect against:

What is the best action after verifying a critical vulnerability on an internet-facing server?

DKIM helps by:

SOAR adds:

EDR provides which added capability beyond AV?

Triage during incident response focuses on:

A post-incident after-action report should:

Baselining log volume is useful to:

Which activity belongs to threat modeling?

During containment, avoid powering off compromised servers primarily to:

Which factor beyond CVSS most improves prioritization?

File Integrity Monitoring (FIM) detects:

SSRF attacks abuse:

Which framework maps adversary TTPs to improve detections?

DNS filtering primarily helps prevent:

Which source often causes false positives in vulnerability scans?

WAFs primarily protect against:

Forward secrecy in TLS ensures that:

Immutable/WORM log storage primarily:

Purple teaming is:

Best first action for active ransomware on a host:

During containment, avoid powering off compromised servers primarily to:

Password spraying differs from brute force because it:

First phase of NIST incident response is:

IDOR refers to:

A SIEM’s core function is to:

SSRF attacks abuse:

Certificate pinning defends mainly against:

IDOR refers to:

EDR provides which added capability beyond AV?

A KRI measures:

Event correlation in a SIEM helps:

DNS filtering primarily helps prevent:

SSRF attacks abuse:

SOAR adds:

UEBA is primarily used to:

Baselining log volume is useful to:

WAFs primarily protect against:

Immutable/WORM log storage primarily:

Microsegmentation primarily reduces:

During containment, avoid powering off compromised servers primarily to:

IDOR refers to:

Immutable/WORM log storage primarily:

Which scan type provides the most accurate view of missing patches on a host?

Containment aims to:

Triage during incident response focuses on:

What does CVSS help analysts do?

Eradication is:

SOAR adds:

Certificate pinning defends mainly against:

Which evidence has highest volatility?

Purple teaming is:

Containment aims to:

First phase of NIST incident response is:

Which log source best detects brute-force attempts?

A KRI measures:

Primary value of baselining in security operations is to:

Baselining log volume is useful to:

Triage during incident response focuses on: