CompTIA Cybersecurity Analyst (CySA+) Certification Exam (CS0-003) Free Practice Test

Question 1

A network analyst notices a long spike in traffic on port 1433 between two IP addresses on opposite sides of a WAN connection. Which of the following is the most likely cause?

A. An administrator executed a new database replication process without notifying the SOC.

B. A local red team member is enumerating the local RFC1918 segment to enumerate hosts.

C. A threat actor has a foothold on the network and is sending out control beacons.

D. An insider threat actor is running Responder on the local segment, creating traffic replication.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Each time a vulnerability assessment team shares the regular report with other teams, inconsistencies regarding versions and patches in the existing infrastructure are discovered. Which of the following is the best solution to decrease the inconsistencies?

A. Implementing credentialed scanning

B. Performing agentless scanning

C. Implementing a central place to manage IT assets

D. Changing from a passive to an active scanning approach

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A systems administrator receives several reports about emails containing phishing links. The hosting domain is always different, but the URL follows a specific pattern of characters. Which of the following is the best way for the administrator to find more messages that were not reported?

A. Open a support ticket with the email hosting provider

B. Query firewall logs for any traffic with a suspicious website

C. Send a memo to all staff asking them to report suspicious emails

D. Search email logs for a regular expression

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Which of the following explains how MTTD can affect incident response reporting and communication?

A. Improved MTTD ensures the leadership team is made aware of threats before exploitation.

B. MTTD is part of regulatory compliance and outlines an approved process for reporting.

C. Having a shorter MTTD reduces the potential impact of an incident.

D. MTTD defines the maximum time allowed between detection and response.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

A list of loCs released by a government security organization contains the SHA-256 hash for a Microsoft- signed legitimate binary, svchost. exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?

A. Security teams would detect rogue svchost. exe processesintheirenvironment.

B. This indicator would fire on the majority of Windows devices.

C. Malicious files with a matching hash would be detected.

D. Security teams would detect event entries detailing executionofknown-malicioussvchost. exe processes.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts. The analyst is working with the respective system owners to help determine the best methodology that seeks to promote confidentiality, availability, and integrity of the data being hosted. Which of the following should the security analyst perform first to categorize and prioritize the respective systems?

A. Scan the systems to see which vulnerabilities currently exist.

B. Configure alerts for vendor-specific zero-day exploits.

C. Interview the users who access these systems,

D. Determine the asset value of each system.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

The Chief Information Security Officer for an organization recently received approval to install a new EDR solution. Following the installation, the number of alerts that require remediation by an analyst has tripled.
Which of the following should the organization utilize to best centralize the workload for the internal security team? (Select two).

A. NGFW

B. DLP

C. MSP

D. SOAR

E. XDR

F. SIEM

Correct Answer: D,F

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?

A. CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

B. CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/1: K/A: L

C. CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

D. CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

A cybersecurity analyst is tasked with scanning a web application to understand where the scan will go and whether there are URIs that should be denied access prior to more in-depth scanning. Which of following best fits the type of scanning activity requested?

A. Uncredentialed scan

B. Discqyery scan

C. Credentialed scan

D. Vulnerability scan

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

A security analyst needs to mitigate a known, exploited vulnerability related not tack vector that embeds software through the USB interface. Which of the following should the analyst do first?

A. Review logs to see whether this exploitable vulnerability has already impacted the company.

B. Conduct security awareness training on the risks of using unknown and unencrypted USBs.

C. Write a removable media policy that explains that USBs cannot be connected to a company asset.

D. Check configurations to determine whether USB ports are enabled on company assets.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

CompTIA Cybersecurity Analyst (CySA+) Certification (CS0-003) Free Practice Test