I85PREP
⌘ K
CSA study materials
CSA study resources

CSA (EC-Council Certifications) practice questions

One question at a time. Build your CSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Operations and Management

Which security control is best classified as preventive rather than detective?

  1. Generating alerts on failed logins
  2. Deploying an intrusion detection sensor
  3. Reviewing firewall logs for blocked traffic
  4. Enforcing a mandatory access control policy Correct answer.

Explanation

Controls are categorized by when they act relative to an incident. Preventive controls stop an action before it occurs, while detective controls identify activity after the fact. Enforcing an access control policy blocks unauthorized actions, making it preventive.

Question 2Security Operations and Management

A security team needs to confirm that a server's operating system files have not been altered since deployment. Which technique directly supports this?

  1. Reviewing the change management ticket queue
  2. Comparing current file hashes to a known-good baseline Correct answer.
  3. Running a port scan against the server
  4. Checking the server's uptime counter

Explanation

File integrity monitoring works by computing cryptographic hashes and comparing them to a trusted baseline. Any modification to the protected files changes the hash and is flagged. Other activities do not verify file content integrity.

Question 3Security Operations and Management

In a SIEM, which element correlates raw log events into a meaningful security incident?

  1. The dashboard color scheme
  2. The parsing regex library
  3. The log retention period
  4. The correlation rule set Correct answer.

Explanation

Correlation rules define logical conditions across multiple events and sources that, when satisfied, generate an alert or incident. Parsing and retention support this but do not themselves define incident logic.

Question 4Security Operations and Management

What is the primary purpose of a chain-of-custody record during incident response?

  1. Recording the attacker's IP addresses
  2. Tracking the cost of the incident
  3. Listing the vulnerabilities that were exploited
  4. Documenting who handled evidence and when Correct answer.

Explanation

Chain of custody is a chronological record of evidence handling that demonstrates integrity for legal or disciplinary proceedings. It records custody transfers, not technical attack details.

Question 5Security Operations and Management

Which activity is part of the containment phase of incident response?

  1. Isolating affected hosts from the network Correct answer.
  2. Writing the post-incident report
  3. Eradicating malware from all systems
  4. Restoring data from backups

Explanation

Containment limits the spread and impact of an incident, typically by isolating affected systems. Eradication and recovery follow containment, and reporting comes later in lessons-learned.

Question 6Security Operations and Management

An organization wants to ensure that administrative actions on critical servers are recorded and reviewable. Which control best achieves this?

  1. Mandatory password rotation
  2. Network segmentation of the data center
  3. Full-disk encryption on endpoints
  4. Privileged access logging and session recording Correct answer.

Explanation

Logging and recording privileged sessions creates an auditable trail of administrative activity. The other options improve access control or confidentiality but do not produce a reviewable record of actions.

Question 7Security Operations and Management

Which metric best indicates how quickly a security team begins investigating a detected alert?

  1. Mean time to recover
  2. Mean time to detect
  3. Mean time between failures
  4. Mean time to acknowledge Correct answer.

Explanation

Time to acknowledge measures the interval between alert generation and analyst response. Time to detect measures discovery, and time to recover measures restoration after an incident.

Question 8Security Operations and Management

Which log source is most useful for detecting unauthorized changes to user group membership on a Windows domain?

  1. DHCP lease logs
  2. DNS query logs
  3. Domain controller security event logs Correct answer.
  4. Web proxy logs

Explanation

Domain controllers record account and group management events in their security logs. DNS, proxy, and DHCP logs capture name resolution, web traffic, and address assignment, not directory changes.

Question 9Security Operations and Management

During triage, an analyst finds a host beaconing to an unfamiliar external IP every 60 seconds. Which response best reflects the containment objective while preserving evidence?

  1. Isolating the host at the network layer and capturing volatile memory Correct answer.
  2. Waiting several days to confirm the pattern
  3. Immediately wiping and rebuilding the host
  4. Deleting the suspicious files from disk

Explanation

Network isolation stops further command-and-control traffic while memory capture preserves volatile evidence such as running processes and network connections. Wiping or deleting destroys evidence, and delay allows continued compromise.

Question 10Security Operations and Management

A SIEM rule fires on 500 alerts per day, and analysts close nearly all as benign. Which tuning approach best reduces alert fatigue without losing real detections?

  1. Adding contextual exclusions and thresholding based on known-good behavior Correct answer.
  2. Disabling the rule entirely
  3. Routing all alerts to the help desk
  4. Increasing the alert severity to critical

Explanation

Tuning by adding context and thresholds suppresses known-benign patterns while retaining detection of anomalous activity. Disabling the rule removes coverage, and raising severity or rerouting does not reduce volume.

Question 11Security Operations and Management

An organization must retain security logs for one year but only needs fast search over the most recent 30 days. Which design best meets both requirements?

  1. Delete logs after 30 days to save space
  2. Store all logs on the SIEM hot tier for one year
  3. Use hot storage for 30 days and archive older logs in cold storage Correct answer.
  4. Store all logs only on endpoint disks

Explanation

Tiered storage keeps recent data on fast, searchable media while moving older data to lower-cost archival storage that satisfies retention. Keeping everything hot is costly, and deleting violates retention.

Question 12Security Operations and Management

An analyst must determine whether a suspicious email actually delivered a payload to a user's mailbox. Which evidence source is most direct?

  1. The mail gateway's message tracking and attachment logs Correct answer.
  2. The DNS server's zone file
  3. The perimeter firewall's deny log
  4. The endpoint's antivirus signature version

Explanation

Mail gateway tracking and attachment logs record message delivery and content handling, directly answering whether the payload reached the mailbox. Firewall denies, signature versions, and zone files do not show delivery.

Question 13Security Operations and Management

Which practice most improves the reliability of a security monitoring program's detection coverage?

  1. Standardizing on a single log format
  2. Buying additional log storage capacity
  3. Increasing the number of dashboards available
  4. Mapping detection rules to a threat-informed framework and testing them Correct answer.

Explanation

Mapping rules to a threat framework exposes coverage gaps, and regular testing verifies that rules actually fire. Dashboards, storage, and format standardization support operations but do not by themselves validate coverage.

Question 14Security Operations and Management

A vulnerability scan reports a critical finding on a production server, but the patch requires a reboot during business hours. What is the most appropriate immediate action?

  1. Ignore the finding until the next patch cycle
  2. Disable the vulnerability scanner for that host
  3. Apply compensating controls and schedule the patch in an approved window Correct answer.
  4. Shut down the server indefinitely

Explanation

When immediate patching is impractical, compensating controls reduce exposure until the change can be applied in an approved maintenance window. Ignoring or disabling detection leaves the risk unmanaged.

Question 15Security Operations and Management

Which element of an incident response plan defines who is authorized to declare an incident and activate the team?

  1. The evidence inventory
  2. The recovery runbook
  3. The communication template
  4. The escalation and authority matrix Correct answer.

Explanation

An escalation and authority matrix specifies roles, thresholds, and who may declare an incident and activate responders. Templates, inventories, and runbooks support response but do not assign declaration authority.

Question 16Security Operations and Management

A SOC observes a spike in authentication failures followed by a successful login from an unusual country for the same account. Which detection concept does this best illustrate?

  1. Signature-based antivirus matching
  2. Data loss prevention
  3. Static code analysis
  4. Behavioral anomaly detection Correct answer.

Explanation

The pattern of failed attempts followed by success from an atypical location is a behavioral anomaly indicating possible credential compromise. Signature matching, code analysis, and DLP address different control objectives.

Question 17Security Operations and Management

What distinguishes an incident from an event in security operations?

  1. An event requires executive notification
  2. An incident is an event or series of events with confirmed negative impact Correct answer.
  3. An event is always malicious, while an incident is benign
  4. An incident only occurs after data is exfiltrated

Explanation

An event is any observable occurrence, while an incident is an event or set of events that actually or potentially harms the organization. Not every event is malicious or escalates to an incident.

Question 18Security Operations and Management

A team wants to detect data exfiltration over HTTPS to personal cloud storage. Which combination is most effective?

  1. Password complexity policy plus MFA
  2. Antivirus signature updates plus host patching
  3. Disk encryption plus backup rotation
  4. Netflow volume baselines plus proxy logs with category tagging Correct answer.

Explanation

Detecting exfiltration over encrypted channels relies on metadata such as traffic volume anomalies and proxy categorization of destinations. The other combinations strengthen access and data-at-rest controls but do not reveal outbound transfer patterns.

Question 19Security Operations and Management

Which action best preserves volatile evidence on a compromised workstation?

  1. Powering off the machine immediately
  2. Reimaging the machine from a golden image
  3. Removing the hard drive for imaging first
  4. Capturing memory and running processes before shutdown Correct answer.

Explanation

Volatile data such as memory contents and running processes is lost on shutdown, so it must be captured first. Imaging disks and reimaging are later steps that do not preserve volatile state.

Question 20Security Operations and Management

A security manager wants to demonstrate that monitoring controls are operating as intended to auditors. Which artifact is most appropriate?

  1. A sample of alerts with documented triage and closure decisions Correct answer.
  2. The list of installed endpoint agents
  3. A screenshot of a dashboard
  4. The vendor contract for the SIEM

Explanation

Auditors seek evidence that controls operate effectively, which is shown by alert records with documented triage and disposition. Dashboards, contracts, and agent inventories show capability but not operating effectiveness.

Question 21Security Operations and Management

An analyst discovers that a critical detection rule has not fired for weeks because a log source silently stopped forwarding. Which control would have caught this gap earliest?

  1. Monthly patch compliance reporting
  2. Quarterly access reviews
  3. Log source health monitoring with heartbeat alerts Correct answer.
  4. Annual penetration testing

Explanation

Health monitoring detects missing or delayed log flow through heartbeats and volume checks, revealing pipeline failures quickly. Periodic testing and reviews occur too infrequently and do not verify log ingestion.

Question 22Security Operations and Management

An organization suffers a ransomware incident. Leadership asks whether backups are safe to restore. Which verification is most important before restoration?

  1. Ensuring the backup schedule is documented
  2. Validating that backup integrity checks pass and backups are isolated from the compromised network Correct answer.
  3. Confirming the backup software license is current
  4. Checking that the backup server has the latest antivirus definitions

Explanation

Restoration safety depends on verified integrity and assurance that backups were not reachable by the attacker. Isolation and integrity validation prevent reintroducing compromised data. Licensing, antivirus state, and documentation do not establish backup trustworthiness.

Question 23Security Operations and Management

A detection engineer observes that a rule based on a single event field generates high false positives, while the malicious behavior always spans multiple related events within five minutes. What redesign is most sound?

  1. Remove the rule and rely on user reports
  2. Increase the polling interval to once per day
  3. Convert the rule to a stateful correlation over a five-minute window with multiple conditions Correct answer.
  4. Lower the rule's severity to informational

Explanation

Stateful correlation across related events within a bounded window captures the actual behavior and reduces single-event noise. Severity changes, slower polling, or removal do not improve detection logic.

Question 24Security Operations and Management

During a major incident, two teams independently block the same attacker infrastructure and one team's action invalidates the other's monitoring capture. Which process failure does this best illustrate?

  1. Lack of a unified incident command and action tracking Correct answer.
  2. Insufficient log retention
  3. Inadequate password complexity
  4. Excessive endpoint encryption

Explanation

Coordinated response requires a single command structure and a shared record of actions to prevent conflicting or duplicated measures. Retention, encryption, and password policy do not govern response coordination.

Question 25Security Operations and Management

A SOC wants to measure whether its detection content improves over time rather than merely growing. Which pair of metrics best supports that judgment?

  1. Log volume ingested and storage cost
  2. Number of analysts and tickets closed
  3. True positive rate and mean time to detect, tracked per release Correct answer.
  4. Total rule count and dashboard count

Explanation

Detection quality is demonstrated by precision (true positive rate) and speed (time to detect) measured across content releases. Volume, headcount, and cost metrics describe scale or expense, not detection effectiveness.

Question 26Security Operations and Management

Which concept describes the practice of dividing security responsibilities among multiple roles so that no single individual can perform a critical action without oversight?

  1. Job rotation
  2. Defense in depth
  3. Separation of duties Correct answer.
  4. Least privilege

Explanation

Separation of duties requires that multiple people be involved in a critical task to prevent fraud or error. Least privilege limits access to what is needed for a job, but does not enforce oversight. Defense in depth uses multiple layers of controls, and job rotation moves people through roles to detect issues, but neither directly ensures oversight of a single action.

Question 27Security Operations and Management

Which security control is primarily intended to reduce the risk of unauthorized access to a data center by requiring two different authentication factors?

  1. CCTV surveillance
  2. Multi-factor authentication Correct answer.
  3. Access control vestibule
  4. Biometric lock

Explanation

Multi-factor authentication requires two or more independent credentials, such as something you know and something you have, to verify identity. A biometric lock uses a single factor, CCTV is detective, and an access control vestibule controls physical passage but does not by itself require multiple authentication factors.

Question 28Security Operations and Management

Which phase of the incident response lifecycle involves determining the scope and severity of an incident and deciding which resources to allocate?

  1. Post-incident activity
  2. Preparation
  3. Detection and analysis Correct answer.
  4. Containment, eradication, and recovery

Explanation

Detection and analysis is the phase where the team validates incidents, assesses scope and severity, and determines the appropriate response. Preparation builds capabilities, containment and recovery execute the response, and post-incident activity focuses on lessons learned.

Question 29Security Operations and Management

What is the primary purpose of a security awareness training program?

  1. To reduce human-related security risks by educating users about threats and safe practices Correct answer.
  2. To ensure all employees have administrative access to necessary systems
  3. To test the effectiveness of firewall rules
  4. To replace technical controls with user vigilance

Explanation

Security awareness training educates users about threats such as phishing and safe computing practices, thereby reducing human-related risk. It does not grant administrative access, replace technical controls, or test firewall rules.

Question 30Security Operations and Management

An organization wants to ensure that only approved software can execute on endpoints. Which control best achieves this?

  1. Application allowlisting Correct answer.
  2. Full disk encryption
  3. Security information and event management
  4. Host-based intrusion prevention system

Explanation

Application allowlisting permits only explicitly approved applications to run, blocking all others. Encryption protects data at rest, an intrusion prevention system detects and blocks malicious activity, and SIEM aggregates logs; none of these restrict execution to approved software.

Question 31Security Operations and Management

A security team wants to verify that a critical server's configuration has not drifted from its baseline. Which practice is most appropriate?

  1. Penetration testing
  2. Log review
  3. File integrity monitoring Correct answer.
  4. Vulnerability scanning

Explanation

File integrity monitoring detects unauthorized changes to files and configurations by comparing them to a known good baseline. Vulnerability scanning identifies missing patches, penetration testing simulates attacks, and log review examines activity, but none directly verify configuration drift against a baseline.

Question 32Security Operations and Management

Which backup strategy provides the fastest recovery time objective (RTO) for a critical database?

  1. Daily full backup to tape
  2. Weekly full backup with daily incremental backups
  3. Continuous data protection with replication Correct answer.
  4. Monthly full backup to offsite storage

Explanation

Continuous data protection with replication keeps a near-real-time copy available, enabling rapid recovery and minimal data loss. Daily, weekly, or monthly backups require restoring from media, which takes longer and may lose more data.

Question 33Security Operations and Management

Which type of security control is a policy that prohibits sharing passwords?

  1. Detective
  2. Compensating
  3. Corrective
  4. Preventive Correct answer.

Explanation

A policy that prohibits an action is a preventive control because it aims to stop the behavior from occurring. Detective controls identify events after they happen, corrective controls restore systems, and compensating controls provide an alternative when a primary control cannot be used.

Question 34Security Operations and Management

An organization wants to reduce the risk of phishing emails reaching user inboxes. Which control is most directly effective?

  1. Security awareness training
  2. Endpoint detection and response
  3. Network segmentation
  4. Email filtering with attachment sandboxing Correct answer.

Explanation

Email filtering with sandboxing inspects incoming messages and attachments for malicious content before delivery, directly reducing phishing exposure. Awareness training helps users recognize phishing but does not block delivery; EDR and segmentation address other layers.

Question 35Security Operations and Management

Which of the following best describes the purpose of a tabletop exercise in security management?

  1. To evaluate the technical performance of security tools
  2. To conduct a real-time penetration test of production systems
  3. To train employees on using the ticketing system
  4. To test incident response plans and decision-making in a simulated scenario Correct answer.

Explanation

A tabletop exercise gathers stakeholders to walk through a simulated incident, testing plans, roles, and communication without affecting production. It is not a technical tool test, a penetration test, or ticketing system training.

Question 36Security Operations and Management

A security manager needs to justify the cost of a new security control to leadership. Which metric is most relevant?

  1. Return on security investment (ROSI) Correct answer.
  2. Number of alerts per day
  3. Percentage of patches applied
  4. Mean time to detect (MTTD)

Explanation

Return on security investment compares the cost of a control to the monetary benefit of risk reduction, directly supporting cost justification. MTTD, alert volume, and patch compliance are operational metrics that do not by themselves express financial value.

Question 37Security Operations and Management

Which risk treatment strategy involves transferring financial responsibility for a risk to a third party?

  1. Risk avoidance
  2. Risk transfer Correct answer.
  3. Risk mitigation
  4. Risk acceptance

Explanation

Risk transfer shifts the financial impact of a risk to another party, such as through insurance or outsourcing. Acceptance retains the risk, avoidance eliminates the activity, and mitigation reduces the risk.

Question 38Security Operations and Management

A company discovers that a former employee's account remains active weeks after termination. Which control failure does this most directly indicate?

  1. Missing security awareness training
  2. Weak password policy
  3. Inadequate access review process Correct answer.
  4. Insufficient network segmentation

Explanation

Access reviews ensure that user accounts and permissions remain appropriate, including timely removal upon termination. A weak password policy, lack of awareness training, or poor segmentation would not directly cause an orphaned account.

Question 39Security Operations and Management

An organization wants to minimize the impact of a compromised user account on a file server. Which practice is most effective?

  1. Enforcing least privilege on file share permissions Correct answer.
  2. Enabling full disk encryption
  3. Deploying antivirus software
  4. Requiring long passwords

Explanation

Least privilege ensures users have only the access necessary for their roles, limiting what a compromised account can reach. Long passwords, encryption, and antivirus help but do not directly restrict access to file shares.

Question 40Security Operations and Management

A security team is designing a disaster recovery plan. Which factor most directly determines the required frequency of backups?

  1. Service level agreement (SLA)
  2. Recovery time objective (RTO)
  3. Recovery point objective (RPO) Correct answer.
  4. Mean time between failures (MTBF)

Explanation

The recovery point objective defines the maximum acceptable amount of data loss, which dictates how often backups must be taken. RTO defines acceptable downtime, MTBF measures reliability, and an SLA is a contractual commitment.

Question 41Understanding Cyber Threats, IoCs, and Attack Methodology

Which indicator of compromise is most characteristic of a domain-generation algorithm (DGA) used by malware?

  1. A signed binary with a valid vendor certificate
  2. Many algorithmically generated domain names with high entropy appearing in DNS logs Correct answer.
  3. Outbound traffic to a fixed IP address on port 443
  4. A single domain name that resolves to a stable, well-known IP address

Explanation

DGAs produce large volumes of pseudo-random domain names so malware can locate its command-and-control server without hardcoding a fixed address. High-entropy names queried repeatedly, often with many NXDOMAIN responses, are a classic IoC.

Question 42Understanding Cyber Threats, IoCs, and Attack Methodology

An analyst observes a workstation making periodic outbound connections to an external host every 60 seconds with small, fixed-size payloads. Which behavior does this most likely represent?

  1. An SMTP relay sending bulk mail
  2. A DNS zone transfer
  3. Beaconing to a command-and-control server Correct answer.
  4. A broadcast storm on the local segment

Explanation

Regular, evenly spaced callbacks with consistent payload sizes are the signature of implant beaconing to command-and-control infrastructure. The periodicity is designed to blend in while maintaining remote control.

Question 43Understanding Cyber Threats, IoCs, and Attack Methodology

Which fileless technique executes code directly in the memory of a legitimate process without writing an executable to disk?

  1. Process hollowing Correct answer.
  2. Macro-enabled document delivery
  3. Watering hole compromise
  4. USB drop attack

Explanation

Process hollowing unmaps the legitimate process's memory and injects malicious code, so nothing malicious is written to disk. This makes it a fileless technique that evades disk-based detection.

Question 44Understanding Cyber Threats, IoCs, and Attack Methodology

A phishing email contains a link whose visible text is a trusted bank but whose actual destination is an unrelated IP address. Which term best describes this deception?

  1. Spear phishing
  2. Typosquatting
  3. Credential stuffing
  4. Mismatched hyperlink (URL obfuscation) Correct answer.

Explanation

When the displayed link text differs from the real destination, the attacker is using a mismatched hyperlink to hide the true URL. Users who trust the visible text are redirected to attacker infrastructure.

Question 45Understanding Cyber Threats, IoCs, and Attack Methodology

Which indicator most strongly suggests a host is infected with ransomware in the early stages of encryption?

  1. Rapid creation of many files with unusual extensions and deletion of shadow copies Correct answer.
  2. An increase in inbound HTTP requests to a web server
  3. A new DHCP lease being issued
  4. A single failed login in the security log

Explanation

Ransomware typically mass-renames or re-encrypts files and deletes volume shadow copies to prevent recovery. A burst of files with new extensions plus shadow copy deletion is a strong behavioral IoC.

Question 46Understanding Cyber Threats, IoCs, and Attack Methodology

Which attack relies on tricking a user into authorizing an OAuth application that then grants the attacker access to mail and files?

  1. SQL injection
  2. Pass-the-hash
  3. Cross-site scripting
  4. Consent phishing Correct answer.

Explanation

Consent phishing abuses OAuth authorization flows so the victim grants a malicious application legitimate access tokens. The attacker then uses the granted permissions rather than stealing a password.

Question 47Understanding Cyber Threats, IoCs, and Attack Methodology

What does a hash value of a known malicious file primarily provide to an analyst?

  1. The command-and-control domain of the malware
  2. The author's identity
  3. A unique fingerprint for identifying the file across systems Correct answer.
  4. The encryption key used by the malware

Explanation

A cryptographic hash acts as a unique fingerprint of file contents, so matching hashes confirm the same file exists elsewhere. It does not reveal behavior, keys, or authorship.

Question 48Understanding Cyber Threats, IoCs, and Attack Methodology

Which phase of the Cyber Kill Chain describes an attacker delivering a malicious attachment to a victim via email?

  1. Installation
  2. Weaponization
  3. Reconnaissance
  4. Delivery Correct answer.

Explanation

Delivery is the phase where the weaponized payload is transmitted to the target, such as through a phishing email attachment. Weaponization precedes it, and installation follows exploitation.

Question 49Understanding Cyber Threats, IoCs, and Attack Methodology

A security team sees DNS queries for many random-looking subdomains under a single registered domain, most returning NXDOMAIN. Which threat activity does this most likely indicate?

  1. A brute-force SSH attack
  2. A legitimate content delivery network
  3. DNS tunneling for data exfiltration Correct answer.
  4. A misconfigured DHCP server

Explanation

DNS tunneling encodes data in subdomain labels, producing many unique, often high-entropy queries under one domain. The pattern of many names and NXDOMAIN responses is consistent with covert exfiltration over DNS.

Question 50Understanding Cyber Threats, IoCs, and Attack Methodology

An attacker uses a valid but stolen username and password to log in from an unusual location without triggering lockouts. Which detection strategy is most appropriate?

  1. Disable password authentication entirely
  2. Block all outbound port 443 traffic
  3. Alert on impossible-travel and anomalous login baselines Correct answer.
  4. Rely solely on signature-based antivirus

Explanation

Because the credentials are valid, signature and lockout controls will not catch the intrusion; behavioral baselining such as impossible-travel detection is needed. It flags logins inconsistent with normal geography or timing.