Cybersecurity Analyst (CySA+ v3) Practice Questions
Prepare for CS0-003 with more than an answer.
Unlock the full exam and previous versions
- v1CompTIA Cybersecurity Analyst (CySA+) V4 150 questions Locked
- CS0-002Legacy CompTIA Cybersecurity Analyst (CySA+ v2) 122 questions Locked
- CS0-003Legacy CompTIA Cybersecurity Analyst (CySA+ v3) 271 questions Current
- Exam fee
- $404 USD
- Level
- Intermediate
- Valid for
- 3 years
Domains covered on the exam 4
- Security Operations33%
- Vulnerability Management30%
- Incident Response Management20%
- Reporting and Communication17%
- 1
True or False: In a Zero Trust Architecture, a user who has successfully authenticated via MFA to the VPN is automatically trusted to access all internal applications without further verification.
Show answer details
Correct answer: B
False. Zero Trust operates on 'never trust, always verify'. Authentication at the perimeter (VPN) does not grant implicit trust for internal resources. Each access request is verified based on identity, device health, and context.
- 2
A security analyst is reviewing a vulnerability scan report for a fleet of IoT devices. The scan indicates that the devices are using a deprecated version of the SSH protocol (v1). Why is this considered a high-risk vulnerability?
Show answer details
Correct answer: A
SSH v1 has known design flaws, including lack of integrity checks for data streams and support for weak encryption, making it vulnerable to insertion attacks and MitM.
- 3
The incident response team has seized a laptop belonging to a suspected insider threat. To ensure the admissibility of evidence in court, they must strictly follow the Chain of Custody. Which of the following actions would BREAK the Chain of Custody?
Show answer details
Correct answer: A
Leaving evidence unattended and unsecured creates a gap in control and accountability. Anyone could have tampered with the device during that time, rendering the evidence potentially inadmissible.
- 4
A security manager needs to report a recent data breach to the Board of Directors. The board members are non-technical. Which of the following metrics would be MOST effective to include in the presentation?
Show answer details
Correct answer: C
Board members focus on business risk, financial loss, and reputation. Technical details like packet drops or CVEs are less relevant to strategic decision-making.
- 5
While investigating a compromised web server, an analyst finds a file named
shell.phpin the upload directory. The content of the file is:
This is an example of which type of malware?Show answer details
Correct answer: B
This code snippet is a classic PHP web shell. It takes a command passed via the URL parameter 'cmd' and executes it on the system using the
system()function, allowing the attacker remote control. - 6
A security analyst is configuring a Nmap scan to identify the operating system of a target host without sending aggressive probes that might trigger an IDS. Which command switch should be used?
Show answer details
Correct answer: A
The
-Oswitch enables OS detection. While it generates some traffic, it is specific to OS fingerprinting. Note: '-A' is aggressive (includes OS, version, script, traceroute). - 7
Which of the following activities is an example of 'Hypothesis-Driven' threat hunting?
Show answer details
Correct answer: B
Hypothesis-driven hunting starts with a question or theory about attacker behavior (e.g., 'Attackers are using PowerShell laterally') and then looks for evidence to support or refute it.
- 8
A financial institution is required to retain audit logs for 7 years to comply with regulatory standards. Which concept BEST describes the policy governing how long data is kept and when it should be destroyed?
Show answer details
Correct answer: A
Data Retention Policy explicitly defines the duration for keeping data and the process for disposal.
- 9
During a forensic investigation of a Linux server, the analyst needs to view the current network connections and the processes associated with them. Which command provides this information?
Show answer details
Correct answer: A
The
netstatcommand with flags-antpshows all (a) numeric (n) TCP (t) connections and the PID/Program name (p).ssis the modern replacement butnetstatis the classic answer for this context. The key is the-pflag for process info. - 10
A security analyst determines that a specific Windows Event ID 4624 (Logon Success) with Logon Type 10 is occurring frequently on a server. What does Logon Type 10 indicate?
Show answer details
Correct answer: A
Logon Type 10 is explicitly for Remote Interactive logons, typically via Remote Desktop Protocol (RDP). This is a critical indicator when investigating lateral movement or unauthorized remote access.
- 11
A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?
Show answer details
Correct answer: A
- 12
Which of the following tools would work best to prevent the exposure of PII outside of an organization?
Show answer details
Correct answer: D
