CompTIA CySA+ (CS0-003) Practice Exam

Correct: A — investigate scheduled tasks and check for exfiltration. A regular, time-based outbound spike is a classic indicator of malicious activity such as a beaconing implant or scheduled data exfiltration. The analyst gathers evidence first — checking scheduled tasks, destinations, and volumes — before acting.

Why not the others: rebooting (B) destroys volatile evidence and may not stop the cause; disabling all accounts (C) is disruptive and premature; ignoring it (D) is negligent.

Correct: A — account lockout plus IP blocking/rate limiting. A distributed brute-force/credential-stuffing pattern is mitigated by lockout thresholds and blocking or rate-limiting the offending sources (ideally with MFA behind it).

Why not the others: more RAM (B), a logo change (C), and rebooting workstations (D) do nothing to stop authentication attacks against the web server.

Correct: A — isolate (contain) the workstation. Containment is the first incident-response priority for ransomware: removing the host from the network stops lateral spread and further encryption while the response proceeds.

Why not the others: paying the ransom (B) is discouraged and does not guarantee recovery; resolution (C) is irrelevant; deleting files (D) destroys evidence and may worsen the situation.

Correct: A — regular vulnerability assessments. Proactive scanning of external-facing assets surfaces weaknesses so they can be prioritized and remediated before an attacker finds them — the core of vulnerability management.

Why not the others: printer ink (B), a phone system (C), and disabling email (D) are unrelated to discovering system vulnerabilities.

Correct: A — patch promptly. A critical, in-use vulnerability should be remediated quickly through the patch/change process (with a compensating control if a maintenance window is needed first) to cut the window of exploitation.

Why not the others: ignoring (B) or waiting on unrelated hardware (C) leaves the exposure open; keyboard brightness (D) is irrelevant.

Correct: A — segmentation plus internal monitoring. Segmenting the network constrains how far an attacker can move, and internal monitoring gives the analyst visibility to detect that movement — together they limit and surface lateral movement.

Why not the others: printers (B), a logo (C), and rebooting switches (D) do not constrain or detect attacker movement.

Correct: A — SIEM. A SIEM aggregates and correlates log and event data from many sources, enabling cross-system detection of attack patterns — the central analyst tool for this task (a "single pane of glass").

Why not the others: a word processor (B) and spreadsheet (C) cannot ingest or correlate security telemetry at scale; a printer queue (D) is unrelated.

Correct: A — NAC. Network Access Control checks device identity and posture before granting network access, so only approved, compliant devices can connect — the control that enforces the requirement described.

Why not the others: enabling guest Wi-Fi (B) opens access rather than restricting it; leaving ports open everywhere (C) removes control entirely; monitor size (D) is irrelevant.

Correct: A — chain of custody. Documenting who handled evidence, when, and how preserves its integrity and admissibility throughout a forensic investigation — a core incident-response and forensics principle.

Why not the others: email encryption (B) protects messages, not evidence handling; weekly meetings (C) and printer maintenance (D) are unrelated to evidence preservation.

Correct: A — validate against supporting evidence. Confirming an alert by correlating it with logs and other evidence is how an analyst distinguishes a true positive from a false positive before escalating or reporting — the basis of accurate analysis and communication.

Why not the others: deleting the alert (B) discards the signal without analysis; volume (C) is irrelevant; changing passwords (D) is a premature action before the alert is even validated.