Question bank
CompTIA CySA+
42 CompTIA CySA+ questions with the correct answer and a written explanation, organised across 4 exam domains.
- 42 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Incident Response and Management
10 questions in this domain
- Question 1Single Choice
Which NIST IR phase involves establishing policies and tools before an incident?
- ADetection & Analysis
- BPreparationCorrect answer
- CContainment/Eradication/Recovery
- DPost-Incident Activity
Why this is the answer
Preparation is the initial phase where policies, tools, and training are established before any incident occurs.
- Question 2Multiple Select
Which two phases are unique to the SANS PICERL model compared to NIST?
- AIdentificationCorrect answer
- BContainment
- CEradicationCorrect answer
- DRecovery
Why this is the answer
SANS separates Identification and Eradication, while NIST combines Containment, Eradication, and Recovery into one phase.
- Question 3Interactive
The analyst runs the command shown below. Which tool is being used to capture volatile data?
- AFTK Imager
- BWinPmemCorrect answer
- CVolatility
- Ddd
Why this is the answer
WinPmem is a tool specifically designed to capture physical memory volatile data from Windows systems.
- Question 4Single Choice
According to RFC 3227, what is the most volatile data that should be collected first?
- ACPU registers and cacheCorrect answer
- BHard drive image
- CNetwork traffic logs
- DBackup tapes
Why this is the answer
CPU registers and cache are the most volatile and must be captured first before any system state is lost.
- Question 5Multiple Select
Which two items are essential components of a chain of custody document?
- ACryptographic hash valuesCorrect answer
- BNetwork topology diagrams
- CSignatures of each handlerCorrect answer
- DList of affected users
Why this is the answer
Chain of custody must include hash values to verify integrity and signatures to track each person who handled the evidence.
- Question 6Interactive
An analyst applies the firewall rule shown. What type of incident response action is this?
- ADetection
- BContainmentCorrect answer
- CEradication
- DRecovery
Why this is the answer
Blocking an IP address with a firewall rule is a containment action to stop further malicious traffic.
- Question 7Single Choice
In the SANS PICERL model, which phase directly follows Containment?
- AIdentification
- BEradicationCorrect answer
- CRecovery
- DLessons Learned
Why this is the answer
SANS order is Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.
- Question 8Multiple Select
Which two activities are part of the Lessons Learned phase?
- AUpdating playbooksCorrect answer
- BIsolating hosts
- CRoot cause analysisCorrect answer
- DRestoring from backup
Why this is the answer
Lessons Learned includes updating playbooks and conducting root cause analysis to improve future response.
- Question 9Interactive
The command shown is used during forensic acquisition. What is its purpose?
- AEncrypt the disk image
- BVerify data integrityCorrect answer
- CDelete the original drive
- DCompress the forensic copy
Why this is the answer
The SHA-256 hash is computed to verify that the forensic image has not been altered since acquisition.
- Question 10Single Choice
Which stakeholder advises on legal obligations during an incident?
- AIncident Commander
- BLegal CounselCorrect answer
- CPublic Relations
- DIT Manager
Why this is the answer
Legal Counsel advises on legal obligations, breach notifications, and evidence handling.
Reporting and Communication
7 questions in this domain
- Question 11Single Choice
What is the primary purpose of an executive summary in security reporting?
- ATo provide a high-level overview of business impact and recommended actions for leadershipCorrect answer
- BTo detail every technical finding with log excerpts and packet captures
- CTo serve as a legal document for court proceedings
- DTo list all vulnerabilities with CVSS scores and exploit code
Why this is the answer
An executive summary is intended for senior leadership and focuses on business impact, risk, and actionable recommendations, avoiding technical jargon.
- Question 12Multiple Select
Which two of the following are key components of an incident report according to CySA+ best practices?
- ATimeline of events and actions takenCorrect answer
- BExecutive summary with financial impactCorrect answer
- CFull disk image of every affected system
- DPersonal opinions of the analyst
Why this is the answer
An incident report should include a chronological timeline and an executive summary focusing on impact. Full disk images are evidence but not always required; personal opinions are not included.
- Question 13Interactive
Analyze the code block. Which type of communication channel is most appropriate for the given scenario?
- AEmail with a full forensic report attachment
- BVerbal brief or phone call for immediate actionCorrect answer
- CQuarterly written report
- DDashboard with historical trends
Why this is the answer
The code block describes a critical ongoing incident requiring immediate containment. Verbal communication (phone call) is best for urgency, followed by written documentation.
- Question 14Single Choice
Under GDPR, within how many hours must a breach be reported to the supervisory authority?
- A72 hoursCorrect answer
- B48 hours
- C24 hours
- D7 days
Why this is the answer
GDPR Article 33 requires breach notification to the supervisory authority within 72 hours of becoming aware of the breach.
- Question 15Multiple Select
Which two regulations require organizations to implement technical safeguards for protecting sensitive data? (Choose two.)
- AHIPAACorrect answer
- BPCI DSSCorrect answer
- CSOX
- DGLBA
Why this is the answer
HIPAA requires technical safeguards for ePHI; PCI DSS mandates technical controls for cardholder data. SOX and GLBA focus on financial and consumer data but do not specifically prescribe technical safeguards in the same detailed manner.
- Question 16Interactive
Examine the code block. What type of security documentation is being described?
- AIncident Response Plan (IRP)
- BPlaybookCorrect answer
- CPolicy document
- DAfter-action report
Why this is the answer
The code block describes a step-by-step guide for handling a specific threat (phishing), which is a playbook. An IRP is high-level strategy; policy is broad; after-action is post-incident.
- Question 17Single Choice
What is the primary audience for a vulnerability metrics report?
- AIT operations and risk management teamsCorrect answer
- BBoard of directors only
- CExternal auditors exclusively
- DLegal department
Why this is the answer
Vulnerability metrics reports are designed for IT operations, risk management, and compliance teams to track remediation progress and trends. Board members may receive an executive summary instead.
Security Operations
14 questions in this domain
- Question 18Single Choice
Which of the following describes passive reconnaissance?
- AGathering information through direct interaction with target infrastructure
- BCollecting data from public sources without directly contacting target systemsCorrect answer
- CPerforming port scans to identify open services
- DUsing vulnerability scanners to detect weaknesses
Why this is the answer
Passive reconnaissance relies on publicly available data sources and does not involve direct interaction with the target's systems, making it less detectable.
- Question 19Multiple Select
Which of the following are valid open-source intelligence (OSINT) sources for environmental reconnaissance? (Select TWO.)
- AWHOIS recordsCorrect answer
- BInternal network packet captures
- CSocial media platformsCorrect answer
- DFirewall logs
Why this is the answer
OSINT uses publicly available information such as WHOIS records and social media. Internal logs are not public.
- Question 20Interactive
An analyst sees the following Snort rule in the IDS configuration. What type of detection is this rule implementing?
- AAnomaly-based detection
- BSignature-based detectionCorrect answer
- CBehavioral analysis
- DHeuristic detection
Why this is the answer
Snort rules with specific content patterns are signature-based, matching known attack patterns.
- Question 21Single Choice
How does an Endpoint Detection and Response (EDR) solution differ from traditional antivirus?
- AEDR relies solely on signature-based detection
- BEDR uses behavioral analytics and machine learningCorrect answer
- CEDR cannot provide retrospective analysis
- DEDR only monitors network traffic
Why this is the answer
EDR uses behavioral analytics and machine learning to detect unknown threats, unlike signature-based antivirus.
- Question 22Multiple Select
Which of the following are true regarding host firewall configuration? (Select TWO.)
- AOutbound rules are not important for security
- BRules are processed top-down and first match appliesCorrect answer
- CHost firewalls can filter traffic based on applicationCorrect answer
- DHost firewalls only filter inbound traffic
Why this is the answer
Host firewalls process rules in order and can filter per application based on process or port.
- Question 23Interactive
A security analyst executes the following command on a Linux host firewall. What is the immediate effect?
- ABlocks all incoming traffic
- BBlocks incoming SSH traffic on port 22Correct answer
- CBlocks all outgoing traffic
- DAllows incoming SSH traffic
Why this is the answer
The rule drops incoming TCP packets to port 22 (SSH).
- Question 24Single Choice
Which security technique is most effective in preventing SQL injection attacks?
- AOutput encoding
- BInput validation with blacklists
- CParameterized queriesCorrect answer
- DUsing stored procedures without parameterization
Why this is the answer
Parameterized queries (prepared statements) separate SQL logic from data, preventing injection.
- Question 25Multiple Select
Which of the following are characteristics of Static Application Security Testing (SAST)? (Select TWO.)
- AIt analyzes running applications
- BIt requires access to source codeCorrect answer
- CIt can detect runtime configuration issues
- DIt is typically integrated into CI/CD pipelinesCorrect answer
Why this is the answer
SAST scans source code without execution and fits well in development pipelines.
- Question 26Interactive
The following SIEM query counts failed login events per source IP. What potential threat is it trying to detect?
- AMalware infection
- BBrute-force attackCorrect answer
- CData exfiltration
- DPrivilege escalation
Why this is the answer
Counting failed logins per source can reveal a brute-force password guessing attempt.
- Question 27Single Choice
Which network traffic pattern is a common indicator of beaconing malware?
- ARandom high-volume data transfers
- BPeriodic connections at consistent intervalsCorrect answer
- CContinuous streaming of packets
- DInfrequent large file downloads
Why this is the answer
Beaconing malware checks in at regular intervals to receive commands.
- Question 28Multiple Select
Which of the following are indicators of DNS tunneling? (Select TWO.)
- AShort and standard domain queries
- BLong random-looking subdomainsCorrect answer
- CHigh volume of NXDOMAIN responsesCorrect answer
- DLow frequency of DNS requests
Why this is the answer
DNS tunneling uses long subdomains and often generates many NXDOMAIN responses.
- Question 29Interactive
An administrator configures the following AppLocker rule. What is the effect?
- ABlocks all applications in Program Files
- BAllows all applications in Program Files for all usersCorrect answer
- COnly allows signed applications
- DBlocks all scripts
Why this is the answer
The rule allows any executable under Program Files for all users.
- Question 30Single Choice
Where should an intrusion prevention system (IPS) be deployed to block malicious traffic before it reaches internal servers?
- AInline between the internet and the internal networkCorrect answer
- BOut-of-band via a SPAN port
- CDirectly on each endpoint
- DInside a DMZ only
Why this is the answer
An IPS must be inline to block traffic; out-of-band only detects.
- Question 31Multiple Select
When designing firewall rules, which principles should be followed? (Select TWO.)
- APlace broad deny rules before specific allows
- BPlace specific allows before a final deny allCorrect answer
- CUse first-match logicCorrect answer
- DUse last-match logic
Why this is the answer
Firewalls use first-match, so specific allows must come before the deny all.
Vulnerability Management
11 questions in this domain
- Question 32Single Choice
What is the primary purpose of vulnerability scanning?
- AExploit vulnerabilities
- BIdentify, categorize, and assess security weaknessesCorrect answer
- CAutomatically patch systems
- DMonitor network traffic in real time
Why this is the answer
Vulnerability scanning is a systematic automated process to identify, categorize, and assess security weaknesses in systems.
- Question 33Multiple Select
Which two advantages does authenticated scanning have over unauthenticated scanning? (Select two.)
- ARequire no credentials
- BReveal missing patches and misconfigurationsCorrect answer
- CProduce fewer false positivesCorrect answer
- DCan be run without network access
Why this is the answer
Authenticated scans use credentials to inspect registry, patch levels, and configurations, yielding higher accuracy and deeper results.
- Question 34Interactive
Review the Nessus output snippet. What type of scan was likely performed?
- AAuthenticated scan
- BUnauthenticated scanCorrect answer
- CCredentialed scan
- DAgent-based scan
Why this is the answer
The output shows only network-level findings without patch status, indicating an unauthenticated scan.
- Question 35Single Choice
Why are exclusion lists important when planning a vulnerability scan?
- AReduce scan duration by skipping all ports
- BPreclude scanning of sensitive or breakable devicesCorrect answer
- CIncrease the number of findings
- DAllow scanning without authorization
Why this is the answer
Exclusion lists avoid scanning sensitive systems like printers or legacy controllers that could be disrupted.
- Question 36Multiple Select
Which two factors should be considered when scheduling a vulnerability scan? (Select two.)
- APeak business hours
- BMaintenance windowsCorrect answer
- CSystem owner coordinationCorrect answer
- DMaximum concurrent hosts without limits
Why this is the answer
Scans should be scheduled during maintenance windows and coordinated with system owners to avoid service disruption.
- Question 37Interactive
Given the CVSS vector string: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. What is the base score range?
- AConfidentiality impact is low
- BConfidentiality impact is highCorrect answer
- CAttack vector is local
- DUser interaction is required
Why this is the answer
C:H indicates high confidentiality impact, meaning the vulnerability could read all data on the system.
- Question 38Single Choice
What does the Exploit Prediction Scoring System (EPSS) predict?
- ASeverity of the vulnerability
- BProbability of exploitation in the next 30 daysCorrect answer
- CNumber of affected assets
- DTime required to patch
Why this is the answer
EPSS uses real-world data to predict the likelihood that a vulnerability will be exploited within 30 days.
- Question 39Multiple Select
Which three methods are valid remediation strategies for vulnerabilities? (Select three.)
- APatch managementCorrect answer
- BConfiguration changesCorrect answer
- CCompensating controlsCorrect answer
- DIgnoring low-severity findings
Why this is the answer
The three primary remediation strategies are patch management, configuration changes, and compensating controls.
- Question 40Interactive
Review the vulnerability report snippet. Which vulnerability should be prioritized first?
- ACVE-2024-0001 on the test server
- BCVE-2024-0002 on the internet-facing web serverCorrect answer
- CCVE-2024-0003 on the internal file server
- DCVE-2024-0004 on the admin workstation
Why this is the answer
The internet-facing web server with high EPSS and critical asset value should be prioritized over internal systems.
- Question 41Single Choice
What is the role of asset discovery in the vulnerability management lifecycle?
- AReplaces vulnerability scanning
- BIdentifies all hardware, software, and network devicesCorrect answer
- CPatches vulnerabilities automatically
- DGenerates remediation reports
Why this is the answer
Without accurate asset discovery, scanning and remediation are blind, making it a critical first step.
- Question 42Multiple Select
Which two metrics are commonly used to measure vulnerability management effectiveness? (Select two.)
- AMean Time to Detect (MTTD)Correct answer
- BMean Time to Remediate (MTTR)Correct answer
- CNumber of vulnerabilities discovered per day
- DTotal number of patches installed
Why this is the answer
MTTD and MTTR are standard metrics for evaluating detection and remediation efficiency.
Frequently asked questions
Everything about the CompTIA CySA+ question bank and how to use it.