I85PREP
⌘ K
CySA+ study materials
CySA+ study resources

CySA+ practice questions

One question at a time. Build your CySA+ understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Operations

During incident response, which data source should be collected first according to the order of volatility?

  1. Files stored on the hard disk
  2. Backups stored on tape
  3. Logs archived to a remote syslog server
  4. Contents of RAM Correct answer.

Explanation

The order of volatility prioritizes data that changes or disappears fastest, starting with CPU registers and cache, then RAM and swap, then network state, disk, remote logs, and backups. Collecting RAM first preserves volatile evidence such as running processes and network connections.

Question 2Security Operations

What is the primary purpose of maintaining a chain of custody for digital evidence?

  1. To record who handled evidence and when to preserve its admissibility Correct answer.
  2. To compress evidence to save storage space
  3. To encrypt evidence so unauthorized users cannot read it
  4. To automatically analyze evidence for malware

Explanation

A chain of custody documents every transfer and access of evidence, showing that it was handled without alteration. This record supports the reliability and admissibility of evidence in legal or disciplinary proceedings.

Question 3Security Operations

An analyst images a suspect disk and computes a SHA-256 hash before and after analysis. What does matching hashes demonstrate?

  1. The disk contained no malware
  2. The suspect used full-disk encryption
  3. The evidence has not been altered since acquisition Correct answer.
  4. The image can be safely deleted

Explanation

A cryptographic hash acts as a fingerprint; matching values before and after analysis show that the image is bit-for-bit unchanged. Hash integrity does not prove the absence of malware or encryption.

Question 4Security Operations

In vulnerability management, what is a false positive?

  1. A vulnerability reported by a scanner that does not actually exist on the target Correct answer.
  2. A vulnerability that is exploited in the wild
  3. A real vulnerability that the scanner fails to report
  4. A vulnerability that has no available patch

Explanation

A false positive is a finding that the scanner reports but that is not present or not exploitable on the target. False negatives are the opposite: real issues the scanner misses.

Question 5Security Operations

A workstation is confirmed to be infected with ransomware and is actively encrypting files. Which action is the best immediate containment step?

  1. Run a full antivirus scan on the workstation
  2. Reimage the workstation immediately
  3. Restore the workstation from backup
  4. Isolate the workstation from the network Correct answer.

Explanation

Containment aims to stop the spread; isolating the host prevents ransomware from reaching network shares or other systems. Reimaging and restoring are eradication or recovery actions and should follow containment.

Question 6Security Operations

What is the primary goal of the lessons-learned phase of incident response?

  1. To determine which employee to terminate
  2. To restore systems to normal operation
  3. To identify improvements to processes and controls after an incident Correct answer.
  4. To calculate the exact financial loss

Explanation

Lessons learned reviews the incident to improve future prevention, detection, and response. It focuses on process and control gaps rather than blame or exact loss calculation.

Question 7Security Operations

Which Windows Security event ID indicates a failed logon attempt?

  1. 4672
  2. 4624
  3. 4688
  4. 4625 Correct answer.

Explanation

Windows Security event 4625 records a failed logon. Event 4624 records successful logon, 4672 records special privileges assigned, and 4688 records process creation.

Question 8Security Operations

What is the main advantage of a credentialed vulnerability scan over an uncredentialed scan?

  1. It automatically exploits discovered vulnerabilities
  2. It cannot produce false positives
  3. It requires no network access to the target
  4. It provides more accurate detection of missing patches and local misconfigurations Correct answer.

Explanation

Credentialed scans log on to the target and can inspect local patch levels, registry settings, and installed software, producing more accurate results. They still require network access and can still generate false positives.

Question 9Security Operations

A legal team notifies security that litigation is pending and certain logs must be preserved. What should the security team do first?

  1. Delete all logs to reduce legal exposure
  2. Suspend routine log rotation and deletion for the specified systems Correct answer.
  3. Continue normal log retention without changes
  4. Encrypt the logs and discard the keys

Explanation

A legal hold requires preserving potentially relevant data and stopping routine destruction such as log rotation or deletion. The scope of preserved systems and data should follow legal guidance.

Question 10Security Operations

Which of the following is the best example of a tactic, technique, and procedure (TTP) rather than an indicator of compromise?

  1. A file hash of a known malware sample
  2. An IP address associated with a known botnet
  3. A domain name used for phishing
  4. Use of PowerShell to download and execute a payload Correct answer.

Explanation

TTPs describe adversary behavior and methodology, such as using PowerShell for download and execution. IP addresses, hashes, and domains are atomic indicators that can change quickly.

Question 11Security Operations

Which pair of standards is commonly used to exchange cyber threat intelligence in a structured, automated way?

  1. SAML and OAuth
  2. SNMP and Syslog
  3. STIX and TAXII Correct answer.
  4. DNSSEC and HTTPS

Explanation

STIX provides a structured language for threat intelligence, and TAXII defines a transport protocol for exchanging it. The other pairs serve network management, authentication, or DNS/web security.

Question 12Security Operations

A vulnerability has a CVSS base vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. What does this indicate?

  1. It is remotely exploitable with low complexity and no privileges or user interaction Correct answer.
  2. It requires local access and high privileges
  3. It cannot be exploited over the network
  4. It affects only availability

Explanation

AV:N means network exploitable, AC:L low complexity, PR:N no privileges required, and UI:N no user interaction. C:H, I:H, and A:H indicate high impact to confidentiality, integrity, and availability.

Question 13Security Operations

An analyst runs an Nmap scan and sees port 22 open with service SSH, port 80 open with HTTP, and port 443 open with HTTPS. Which conclusion is best supported?

  1. The host is likely running a web server with remote administration enabled Correct answer.
  2. The host has no network services
  3. The host is a database server
  4. The host is definitely compromised

Explanation

Open ports identify services that are listening; SSH plus HTTP/HTTPS suggests remote administration and a web server. Open ports alone do not prove compromise or reveal the host's full role.

Question 14Security Operations

EDR output shows winword.exe spawning powershell.exe with an encoded command. What is the most likely interpretation?

  1. Normal Microsoft Word update behavior
  2. A hardware driver installation
  3. A possible malicious macro is executing PowerShell Correct answer.
  4. A routine DNS lookup

Explanation

Microsoft Word does not normally spawn PowerShell, especially with encoded commands. This parent-child relationship is a common sign of a malicious macro or exploit launching a payload.

Question 15Security Operations

Hosts on the network make regular HTTPS connections to the same external IP every 60 seconds with small, consistent payloads. Which activity does this most likely represent?

  1. A scheduled software update check
  2. Normal NTP time synchronization
  3. Command-and-control beaconing Correct answer.
  4. DNS zone transfer

Explanation

Repeated, periodic small connections to the same external endpoint are characteristic of malware beaconing to command-and-control infrastructure. NTP uses UDP 123, updates are less rigidly periodic, and zone transfers use DNS TCP 53.

Question 16Security Operations

A DNS log shows many long, random-looking subdomain queries to a single domain, such as a1b2c3.example.com. What should the analyst suspect?

  1. DNS tunneling or data exfiltration Correct answer.
  2. A misconfigured DHCP server
  3. A legitimate reverse DNS lookup
  4. A denial-of-service attack against the DNS server

Explanation

Long, random subdomains sent to one domain can encode data in DNS queries, a common tunneling or exfiltration technique. Legitimate reverse lookups use PTR records and are not random subdomain floods.

Question 17Security Operations

After containing a malware outbreak, the team removes the malware and closes the initial access vector. Which incident response phase does this describe?

  1. Lessons learned
  2. Preparation
  3. Eradication Correct answer.
  4. Recovery

Explanation

Eradication removes the malicious code and the root cause, such as the exploited vulnerability or compromised account. Recovery then restores normal operations and validates that systems are clean.

Question 18Security Operations

A SIEM rule alerts when more than 10 failed logons for the same account occur within 5 minutes from different source IPs. What type of attack does this rule best detect?

  1. SQL injection
  2. A distributed brute-force attack Correct answer.
  3. Cross-site scripting
  4. ARP spoofing

Explanation

Multiple failed authentication attempts for one account in a short window indicate password guessing, such as brute force or credential stuffing. The rule correlates authentication events rather than web or network-layer attacks.

Question 19Security Operations

An email header shows SPF fail, DKIM fail, and DMARC fail, but the display name matches the CEO. What is the best conclusion?

  1. The email is likely spoofed and should be treated as phishing Correct answer.
  2. The email is definitely legitimate because the display name matches
  3. The email was sent from an internal server
  4. The failure is caused by the recipient's mailbox being full

Explanation

SPF, DKIM, and DMARC failures indicate the sending domain was not authenticated; a matching display name is easily forged. Such messages should be treated as suspected phishing until verified.

Question 20Security Operations

Two vulnerabilities have the same CVSS base score. One has a public exploit available and is actively exploited in the wild. Which should be prioritized first?

  1. The vulnerability with no known exploit
  2. The one with the lower CVSS temporal score
  3. The vulnerability with known active exploitation Correct answer.
  4. Both should be ignored until the next annual scan

Explanation

Risk prioritization considers threat context, not just base score. Active exploitation and public exploit availability increase the likelihood and urgency of remediation.

Question 21Security Operations

A vulnerability has a high CVSS base score but a low EPSS score and no known exploitation. How should an analyst interpret this?

  1. EPSS replaces the need for patching
  2. The CVSS score is invalid
  3. The vulnerability is guaranteed to be exploited soon
  4. The vulnerability is severe in theory but less likely to be exploited in the near term Correct answer.

Explanation

EPSS estimates the probability that a vulnerability will be exploited in the wild in the near term. A high CVSS with low EPSS and no known exploitation suggests high theoretical severity but lower immediate likelihood, though remediation should still be planned.

Question 22Security Operations

Which process behavior is most suspicious on a Linux web server?

  1. A web server process spawning a shell that connects to an external IP Correct answer.
  2. The package manager installing security updates
  3. The cron daemon executing a scheduled backup script
  4. The SSH daemon accepting a login from an administrator

Explanation

A web server process spawning an interactive shell and making an outbound connection is a common indicator of a web shell or remote code execution. Normal administrative and maintenance processes do not typically produce that parent-child chain.

Question 23Security Operations

An analyst observes a workstation uploading 10 GB to an unfamiliar cloud storage domain at 2 a.m. while the user is offline. What is the most likely explanation?

  1. DNS resolution failure
  2. Normal software patching
  3. Data exfiltration Correct answer.
  4. Printer driver update

Explanation

Large outbound transfers to an unfamiliar destination outside business hours and user activity suggest unauthorized data exfiltration. Patching and driver updates do not typically involve large uploads to unknown cloud storage.

Question 24Security Operations

Which approach best describes hypothesis-driven threat hunting?

  1. Proactively searching for evidence of a specific adversary behavior based on threat intelligence Correct answer.
  2. Reviewing firewall rules for compliance
  3. Running a vulnerability scan and patching all findings
  4. Waiting for SIEM alerts before investigating

Explanation

Threat hunting starts with a hypothesis about adversary behavior, often derived from threat intelligence, and proactively searches telemetry for evidence. It is not reactive alert triage or compliance review.

Question 25Security Operations

A suspicious process is running on a server, but its executable file has been deleted from disk. Which artifact is most useful for determining what the process was doing?

  1. The DNS zone file
  2. A memory capture of the server Correct answer.
  3. The firewall rule set
  4. The disk image of the server

Explanation

When the executable is deleted from disk, the running process and its code, strings, and network connections may still exist in memory. A memory capture preserves that volatile evidence for analysis.

Question 26Security Operations

Which protocol do many network devices use to send event logs to a centralized SIEM?

  1. SNMP trap messages
  2. SMTP email relay
  3. NTP time synchronization
  4. Syslog Correct answer.

Explanation

Syslog is the standard protocol for transporting event messages from network devices and servers to a central collector. It carries facility and severity information that a SIEM can parse and correlate.

Question 27Security Operations

What is the primary security benefit of deploying a honeypot?

  1. It provides early warning of attacks. Correct answer.
  2. It filters outbound email messages for sensitive content.
  3. It authenticates users who connect to wireless networks.
  4. It encrypts all data stored on production servers.

Explanation

A honeypot is a decoy system with no legitimate production use, so any interaction with it is suspicious. It provides early warning and can reveal attacker tools or techniques before real assets are affected.

Question 28Security Operations

What does NetFlow primarily record about network traffic?

  1. Connection metadata such as addresses and byte counts Correct answer.
  2. The complete payload of every packet for later replay and analysis
  3. The decrypted content of every TLS session on the network
  4. User keystrokes captured from monitored endpoint devices

Explanation

NetFlow exports metadata about flows, including source and destination addresses, ports, protocol, and byte and packet counts. It does not capture full packet payloads, so content analysis requires packet capture.

Question 29Security Operations

What does inclusion in the CISA Known Exploited Vulnerabilities catalog indicate?

  1. The vulnerability is confirmed to have been exploited in the wild Correct answer.
  2. The vulnerability has a CVSS base score greater than 9.0 and a network attack vector
  3. The vulnerability affects only operating systems that are past end-of-life support
  4. The vulnerability can be remediated only by physically replacing the affected hardware

Explanation

The KEV catalog lists vulnerabilities that have been observed being exploited in the wild. It is used to prioritize remediation because exploitation is confirmed, not merely theoretical.

Question 30Security Operations

Which Windows Security event ID records a successful logon?

  1. 4688
  2. 4625
  3. 4624 Correct answer.
  4. 5140

Explanation

Event ID 4624 is generated when an account successfully logs on. The logon type field in the event distinguishes interactive, network, and other logon methods.

Question 31Security Operations

What is the primary role of a security orchestration, automation, and response (SOAR) platform?

  1. To provide a managed detection and response service staffed by a third-party vendor
  2. To encrypt endpoint disks and manage the associated recovery keys
  3. To automate response tasks through playbooks Correct answer.
  4. To replace all human analysts with fully autonomous decision-making systems

Explanation

SOAR platforms coordinate security tools and execute playbooks that automate repetitive investigation and response steps. This reduces response time and lets analysts focus on decisions requiring judgment.

Question 32Security Operations

What is the purpose of detonating a suspicious file in a sandbox?

  1. To permanently remove the file from the production network
  2. To distribute it to other hosts for testing
  3. To observe its behavior in an isolated environment Correct answer.
  4. To calculate its MD5 hash for the file inventory

Explanation

A sandbox executes the file in an isolated environment and records its behavior, such as file changes, network connections, and process creation. This provides behavioral evidence without risking production systems.

Question 33Security Operations

Which control is designed to alert when a critical system file is modified?

  1. Security awareness training
  2. Data loss prevention
  3. File integrity monitoring Correct answer.
  4. Network access control

Explanation

File integrity monitoring baselines critical files and alerts when their content, permissions, or attributes change. It is commonly used to detect tampering with system binaries and configuration files.

Question 34Security Operations

Authentication logs show a user account logging in from New York and then from Singapore eight minutes later. Which detection should this trigger?

  1. Password spraying attack
  2. Impossible travel Correct answer.
  3. ARP spoofing attack
  4. Kerberoasting attack

Explanation

The two locations are too far apart to travel between within eight minutes, so the logins cannot both be legitimate from the same user. This pattern is called impossible travel and may indicate compromised credentials.

Question 35Security Operations

A packet capture shows thousands of TCP SYN packets from spoofed source addresses, with no completed handshakes. Which attack does this indicate?

  1. Pass-the-hash
  2. SYN flood Correct answer.
  3. SQL injection
  4. DNS amplification

Explanation

A SYN flood exhausts connection state by sending many half-open connection requests without completing the TCP handshake. Spoofed sources make the final ACK unlikely, which is characteristic of the attack.

Question 36Security Operations

What is the primary purpose of the MITRE ATT&CK framework?

  1. To define approved encryption algorithms for data at rest
  2. To assign CVSS base scores to software vulnerabilities
  3. To catalog adversary tactics and techniques Correct answer.
  4. To certify organizations against an international security standard

Explanation

ATT&CK organizes observed adversary behavior into tactics and techniques, giving defenders a common vocabulary for detection and threat hunting. It is not a scoring system or certification standard.

Question 37Security Operations

Which metric estimates the probability that a vulnerability will be exploited in the next 30 days?

  1. CVSS
  2. CVE
  3. EPSS Correct answer.
  4. CWE

Explanation

The Exploit Prediction Scoring System (EPSS) produces a probability score for exploitation in the near term. It complements severity scoring by helping teams prioritize vulnerabilities that are more likely to be attacked.

Question 38Security Operations

Which Windows artifact is most useful for determining whether a program executed on a host?

  1. Prefetch files Correct answer.
  2. Pagefile backing store
  3. Hosts file mappings
  4. SAM account database

Explanation

Prefetch files are created when programs execute and record details such as the executable path and run count. This makes them valuable for confirming execution during forensic analysis.

Question 39Security Operations

On a Linux server, which file typically records authentication successes and failures?

  1. /var/www/html/access.log
  2. /etc/passwd
  3. /etc/fstab
  4. /var/log/auth.log Correct answer.

Explanation

On many Linux distributions, authentication events are written to /var/log/auth.log, or to /var/log/secure on some systems. These entries include logon successes, failures, and privilege escalation through sudo.

Question 40Security Operations

Which activity is best identified by reviewing web proxy logs?

  1. Outbound web requests by internal users Correct answer.
  2. Disk partition layout on a workstation
  3. Local file permission changes on a server
  4. Memory allocation by a kernel driver

Explanation

Web proxy logs record outbound HTTP and HTTPS requests, including URLs, user agents, and source users or hosts. They are useful for identifying suspicious downloads, command-and-control callbacks, and policy violations.

Question 41Security Operations

EDR alerts that a non-standard process opened a handle to lsass.exe with read access. What activity is most likely?

  1. Disk defragmentation
  2. Credential dumping Correct answer.
  3. DNS zone transfer
  4. Print spooler crash

Explanation

LSASS stores credential material, so a non-standard process reading its memory is a common sign of credential dumping tools such as Mimikatz. Defragmentation, spooler crashes, and DNS zone transfers do not require reading LSASS.

Question 42Security Operations

A threat hunter forms a hypothesis that attackers may use scheduled tasks for persistence and searches endpoint telemetry for evidence. What is this activity called?

  1. Vulnerability scanning
  2. Asset inventory
  3. Penetration testing
  4. Threat hunting Correct answer.

Explanation

Threat hunting is a proactive, hypothesis-driven search for evidence of compromise that may not have triggered existing alerts. It differs from scanning, testing, and inventory, which have different primary purposes.

Question 43Security Operations

What is the primary security benefit of network segmentation?

  1. It limits lateral movement between systems Correct answer.
  2. It eliminates the need for user authentication
  3. It increases the maximum speed of internet links
  4. It automatically patches operating systems

Explanation

Segmentation divides the network into zones with controlled traffic paths, which limits how far an attacker can move after compromising one host. It does not replace authentication, patching, or bandwidth planning.

Question 44Security Operations

What is the primary purpose of data loss prevention (DLP)?

  1. To detect and block inbound malware downloads
  2. To authenticate users before they access email
  3. To encrypt all network traffic between switches
  4. To block unauthorized transfers of sensitive data Correct answer.

Explanation

DLP inspects data in motion, at rest, or in use and applies policy to prevent sensitive information from leaving authorized boundaries. It focuses on data confidentiality rather than inbound malware or link encryption.

Question 45Security Operations

Why would a security team configure TLS inspection on a forward proxy?

  1. To decrypt HTTPS traffic for threat inspection Correct answer.
  2. To replace the need for endpoint antivirus software
  3. To prevent users from visiting any external websites
  4. To increase the strength of server-side encryption keys

Explanation

TLS inspection decrypts outbound HTTPS sessions at the proxy so security controls can examine the content for malware, data exfiltration, or policy violations. The proxy then re-encrypts traffic to the destination.

Question 46Security Operations

A domain controller logs event 4769 with RC4 encryption for several service accounts from one workstation in a short period. Which attack is most likely?

  1. Kerberoasting Correct answer.
  2. DCSync
  3. Golden Ticket
  4. LLMNR poisoning

Explanation

Kerberoasting requests service tickets for service accounts and then attempts to crack the ticket encryption offline. A burst of 4769 events with weak RC4 encryption from one host is a characteristic sign.

Question 47Security Operations

A memory analysis shows a running process whose executable path does not exist on disk and whose memory contains a PE header. What does this most likely indicate?

  1. A normal Windows update
  2. Process injection Correct answer.
  3. A scheduled backup job
  4. A disk fragmentation issue

Explanation

A process with no corresponding executable on disk and executable code in memory suggests code was injected or reflectively loaded. This is a common malware technique for evading file-based detection.

Question 48Security Operations

An analyst finds a large password-protected RAR archive in a user's temp directory containing many documents, and outbound traffic to a cloud storage site follows. Which stage of the attack does this represent?

  1. Privilege escalation
  2. Data staging Correct answer.
  3. Initial access
  4. Reconnaissance

Explanation

Collecting and compressing files into an archive before sending them out is data staging, which immediately precedes exfiltration. The outbound transfer to cloud storage supports the exfiltration interpretation.

Question 49Security Operations

Which CVSS metric group reflects characteristics that change over time, such as exploit code maturity and remediation level?

  1. Scope metric
  2. Temporal metrics Correct answer.
  3. Environmental metrics
  4. Base metrics

Explanation

Temporal metrics adjust the score for factors that can change as time passes, including exploit code maturity, remediation level, and report confidence. Base metrics describe intrinsic properties, and environmental metrics reflect the organization's context.

Question 50Security Operations

A SIEM rule shows one account authenticating to many servers over SMB within a few minutes from a single workstation. What should the analyst investigate first?

  1. Lateral movement Correct answer.
  2. A physical break-in at the data center
  3. A DNS zone transfer request
  4. A ransomware file encryption event

Explanation

A single account rapidly authenticating to many servers over SMB is consistent with credential reuse to move laterally. The analyst should identify the account, source host, and accessed systems before containment.