CompTIA CySA+ (CS0-003) Practice Exam (100 Questions)

Which of the following best matches this description: Vulnerability scanning discovers and rates weaknesses for remediation without active exploitation.?

Which of the following best matches this description: CVSS normalizes severity to compare and prioritize remediation across systems.?

Which of the following best matches this description: Zero-day flaws have no patch at disclosure and pose elevated risk.?

Which of the following best matches this description: Strategic intel guides executive risk decisions and long-term security posture.?

Which of the following best matches this description: Accurate inventories ensure scans/patches cover in-scope assets and critical systems.?

Which of the following best matches this description: Authenticated scans provide deeper visibility into missing patches and configs.?

Which of the following best matches this description: Act promptly with patching or mitigations to reduce risk exposure.?

Which of the following best matches this description: ATT&CK enumerates tactics and techniques to improve detections and hunts.?

Which of the following best matches this description: Risk registers document risks, ownership, and acceptance/mitigation decisions.?

Which of the following best matches this description: Regular reviews remove unneeded entitlements and enforce least privilege.?

Which of the following best matches this description: SIEM platforms centralize telemetry to detect and investigate events.?

Which of the following best matches this description: UEBA models behavior to identify insider threats and compromised accounts.?

Which of the following best matches this description: Flow data summarizes conversations for traffic analysis and threat hunting.?

Which of the following best matches this description: TLS inspection decrypts/inspects and then re-encrypts traffic at secure gateways.?

Which of the following best matches this description: Sandboxes execute samples in isolation to reveal behavior/IOCs.?

Which of the following best matches this description: Mean Time To Detect measures detection latency and SOC effectiveness.?

Which of the following best matches this description: Allow-listing permits only approved binaries, reducing malware risk.?

Which of the following best matches this description: Blocking malicious domains disrupts phishing and C2 lookups.?

Which of the following best matches this description: Proper evidence handling preserves timeline and integrity for legal processes.?

Which of the following best matches this description: EDR collects events (process, file, registry) and supports containment/rollback.?

Which of the following best matches this description: Preparation establishes plans, tools, training, and communications.?

Which of the following best matches this description: Triage rapidly categorizes events by severity and scope.?

Which of the following best matches this description: Short-term containment isolates affected assets; long-term containment hardens.?

Which of the following best matches this description: Eradication removes malware, disables accounts, and fixes vulnerabilities.?

Which of the following best matches this description: Recovery validates systems, applies monitoring, and returns to service.?

Which of the following best matches this description: RCA determines the fundamental cause and corrective actions.?

Which of the following best matches this description: Tabletops validate plans and identify gaps with minimal risk/cost.?

Which of the following best matches this description: Lateral movement broadens attacker access after initial compromise.?

Which of the following best matches this description: C2 channels maintain attacker control and tasking of implants.?

Which of the following best matches this description: Anomalous outbound volume, destinations, and DLP triggers reveal exfil.?

Which of the following best matches this description: AARs capture improvements, gaps, and action items for resilience.?

Which of the following best matches this description: KPIs measure performance; KRIs measure risk level.?

Which of the following best matches this description: Minimization reduces exposure and compliance burden.?

Which of the following best matches this description: Tokenization substitutes a reference token; encryption transforms data with keys.?

Which of the following best matches this description: Contracts should include SLAs, right-to-audit, and security obligations.?

Which of the following best matches this description: PCI DSS governs handling and protection of cardholder data.?

Which of the following best matches this description: PIAs analyze how PII is collected, processed, stored, and protected.?

Which of the following best matches this description: Federation plus provisioning APIs assign roles and deprovision promptly.?

Which of the following best matches this description: Executives need high-level risk, cost, and decision points.?

Which of the following best matches this description: Heuristics catch novel/obfuscated threats by behavior models.?

Which of the following best matches this description: Hunting proactively queries telemetry for TTPs and anomalies.?

Which of the following best matches this description: Indicators of Attack describe intent/behavior; IOCs are evidence of compromise.?

Which of the following best matches this description: SOAR integrates tools/playbooks to automate triage and containment steps.?

Which of the following best matches this description: Normalized schemas (e.g., CEF/LEEF) support analytics and detection.?

Which of the following best matches this description: Version parsing can misidentify vulnerabilities leading to false positives.?

Which of the following best matches this description: Context like business impact and weaponized exploits refines priorities.?

Which of the following best matches this description: Modern auth and least privilege reduce reusable hash abuse.?

Which of the following best matches this description: Fine-grained policies constrain east-west traffic blast radius.?

Which of the following best matches this description: WAFs inspect HTTP(S) to enforce application-layer security policies.?

Which of the following best matches this description: DKIM uses public-key signatures to validate sender domain integrity.?

Which of the following best matches this description: Ephemeral key exchanges protect prior sessions from future key compromise.?

Which of the following best matches this description: Insecure Direct Object Reference allows unauthorized access via IDs.?

Which of the following best matches this description: SSRF forces servers to fetch internal URLs, often exposing metadata or services.?

Which of the following best matches this description: Containment limits spread and preserves evidence for response.?

Which of the following best matches this description: Jump hosts centralize privileged access and auditing.?

Which of the following best matches this description: Key Risk Indicators quantify risk levels for trending and thresholds.?

Which of the following best matches this description: Repeated login failures and lockouts indicate brute-force activity.?

Which of the following best matches this description: Pinning ties apps to a known cert/public key, reducing CA trust abuse.?

Which of the following best matches this description: Baselines help identify deviations indicative of incidents.?

Which of the following best matches this description: Vaulting and ephemeral credentials minimize exposure risk.?

Which of the following best matches this description: Playbooks codify steps to reduce MTTR and human error.?

Which of the following best matches this description: Stuffing uses known username/password pairs from breaches.?

Which of the following best matches this description: Spraying avoids lockouts by rotating common passwords across users.?

Which of the following best matches this description: Notices inform users about collection and processing to meet compliance.?

Which of the following best matches this description: Order of volatility prioritizes capturing memory-resident data first.?

Which of the following best matches this description: Geo policies restrict access when devices leave allowed regions.?

Which of the following best matches this description: Compensating controls substitute when primary controls aren’t feasible.?

Which of the following best matches this description: Correlation rules tie signals across sources to surface true positives.?

Which of the following best matches this description: Write-once logs deter tampering and support forensics/compliance.?

Which of the following best matches this description: Purple teaming shares TTPs and improves detections in real time.?

Which of the following best matches this description: FIM alerts when critical files deviate from a known-good baseline.?

Which of the following best matches this description: DLP monitors data in motion/at rest/in use to stop leaks.?

Which of the following best matches this description: Risk models weight context (asset, user, threat) to prioritize response.?

Which of the following best matches this description: SLAs set measurable service targets for MSSPs and internal teams.?

Which of the following best matches this description: GDPR defines lawful basis, rights, and obligations for personal data.?

Which of the following best matches this description: Memory and live artifacts can be critical; isolate instead of power off.?

Which of the following best matches this description: Abnormal volume can signal outages, floods, or stealthy behavior.?

Which of the following best matches this description: Traceability supports accountability and non-repudiation.?

Which of the following best matches this description: Mismatched SNI vs Host or CDN anomalies can indicate domain fronting.?

Which of the following best matches this description: Reviewing autoruns, services, tasks reveals persistence mechanisms.?

Which of the following best matches this description: KPIs track outcomes; KRIs track exposure—together inform decisions.?

Which of the following best matches this description: Noisy rules and poor tuning overwhelm analysts and hide true positives.?

Which of the following best matches this description: Vulnerability scanning discovers and rates weaknesses for remediation without active exploitation.?

Which of the following best matches this description: CVSS normalizes severity to compare and prioritize remediation across systems.?

Which of the following best matches this description: Zero-day flaws have no patch at disclosure and pose elevated risk.?

Which of the following best matches this description: Strategic intel guides executive risk decisions and long-term security posture.?

Which of the following best matches this description: Accurate inventories ensure scans/patches cover in-scope assets and critical systems.?

Which of the following best matches this description: Authenticated scans provide deeper visibility into missing patches and configs.?

Which of the following best matches this description: Act promptly with patching or mitigations to reduce risk exposure.?

Which of the following best matches this description: ATT&CK enumerates tactics and techniques to improve detections and hunts.?

Which of the following best matches this description: Risk registers document risks, ownership, and acceptance/mitigation decisions.?

Which of the following best matches this description: Regular reviews remove unneeded entitlements and enforce least privilege.?

Which of the following best matches this description: SIEM platforms centralize telemetry to detect and investigate events.?

Which of the following best matches this description: UEBA models behavior to identify insider threats and compromised accounts.?

Which of the following best matches this description: Flow data summarizes conversations for traffic analysis and threat hunting.?

Which of the following best matches this description: TLS inspection decrypts/inspects and then re-encrypts traffic at secure gateways.?

Which of the following best matches this description: Sandboxes execute samples in isolation to reveal behavior/IOCs.?

Which of the following best matches this description: Mean Time To Detect measures detection latency and SOC effectiveness.?

Which of the following best matches this description: Allow-listing permits only approved binaries, reducing malware risk.?

Which of the following best matches this description: Blocking malicious domains disrupts phishing and C2 lookups.?