10 CompTIA CySA+ (CS0-003) Practice Questions That Mirror the Real Exam
Here are 10 multiple-choice questions designed to mirror the difficulty, style, and domain coverage of the CompTIA CySA+ (CS0-003) exam. These questions focus on practical application, threat detection, and analysis rather than rote memorization.
Question 1
During a security incident, a forensic analyst discovers a timestamp in the Windows Event Log that is 4 hours ahead of the system’s local time zone. The analyst needs to correlate this event with a network log from a firewall located in a different time zone. Which of the following is the most appropriate action to ensure accurate correlation? For a deeper dive, check out How Hard Is CompTIA CySA+ (CS0-003), Really? An Honest Difficulty Rating.
A. Convert all timestamps to the local time zone of the analyst.
B. Convert all timestamps to UTC (Coordinated Universal Time).
C. Adjust the firewall logs to match the Windows Event Log time.
D. Ignore the time difference, as timestamps are not critical for correlation.
Answer: B
Explanation: UTC is the standard time reference used in incident response and forensics to avoid confusion between time zones. Converting all logs to UTC ensures a single, unambiguous timeline for correlation. Options A and C introduce bias or errors by favoring one system’s local time, while option D is incorrect because accurate time correlation is critical for reconstructing the attack sequence.
Question 2
A security analyst is reviewing a vulnerability scan report and sees a critical finding for a web server. The report indicates the server is vulnerable to CVE-2023-XXXXX, a known Remote Code Execution (RCE) vulnerability. However, the analyst checks the server configuration and finds that the vulnerable parameter is not exposed to the internet due to a Web Application Firewall (WAF) rule. What should the analyst do first according to the CySA+ framework?
A. Immediately patch the server to remediate the vulnerability.
B. Mark the finding as a false positive and close the ticket.
C. Adjust the risk score based on the mitigating controls and re-assess.
D. Disable the WAF rule to test if the vulnerability is truly exploitable.
Answer: C
Explanation: The CySA+ approach emphasizes risk-based analysis. The WAF is a compensating control that reduces the likelihood of exploitation, so the analyst should re-calculate the risk severity (e.g., lower the score) and document the mitigation. Patching (A) is still a good practice but not the first step if the risk is mitigated; marking as false positive (B) is incorrect because the vulnerability exists, just not currently exploitable; D is a dangerous action that would increase exposure.
Question 3
A security operations center (SOC) analyst observes a series of failed login attempts from a single IP address against the company’s VPN endpoint. The attempts are spaced 30 seconds apart, using usernames that follow a standard naming convention (e.g., jdoe, jsmith). After 10 attempts, the account gets locked out, but the attempts continue against other accounts. Which of the following best describes this attack pattern?
A. Credential stuffing
B. Password spraying
C. Brute force attack
D. Keylogging
Answer: B
Explanation: Password spraying involves trying a small set of common passwords against many different accounts to avoid account lockouts. The scenario describes a few attempts per account (spaced out) rather than many attempts on one account. Credential stuffing (A) uses previously breached username/password pairs; a classic brute force (C) would try many passwords against a single account; keylogging (D) is a form of malware, not an active network attack.
Question 4
An analyst is writing a new SIEM correlation rule to detect internal reconnaissance. The rule triggers when a single host performs a TCP port scan on more than 25 different destination IP addresses within a 10-minute window. After deploying the rule, the analyst receives 500 alerts in the first hour, mostly from a legitimate vulnerability scanner. Which of the following is the best method to reduce false positives while maintaining detection capability?
A. Add a filter to exclude the vulnerability scanner’s IP address from the rule.
B. Increase the threshold from 25 to 100 destination IP addresses.
C. Change the rule to trigger only on UDP scans instead of TCP scans. Want to go further? You Passed CompTIA CySA+ (CS0-003). What Is the Next Certification Worth Doing? is a good next step.
D. Disable the rule and rely on manual log review.
Answer: A
Explanation: The vulnerability scanner is a known, authorized source of scanning activity. The best practice is to add an exclusion list (allowlist) for known benign IPs to reduce noise. Increasing the threshold (B) might miss actual slow, distributed scans; changing to UDP (C) ignores the fact that TCP scans are more common for reconnaissance; disabling the rule (D) eliminates visibility entirely.
Question 5
A security analyst is investigating a potential malware infection on a Windows workstation. The analyst wants to check for persistence mechanisms. Which of the following registry keys or scheduled tasks would be the most likely location for an attacker to maintain persistence?
A. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
B. HKLM\SYSTEM\CurrentControlSet\Services
C. HKCU\Control Panel\Desktop
D. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Answer: A
Explanation: The Run registry key is a common and simple persistence mechanism that executes a program automatically at user logon. While Services (B) and Winlogon (D) can also be used, the Run key is the most frequently abused by commodity malware for persistence. Control Panel\Desktop (C) is typically used for wallpaper and screen saver settings, not standard malware persistence.
Question 6
During a tabletop exercise, a manager asks the security team how they would verify that a newly patched server is actually compliant with the organization’s security baseline. Which of the following tools or techniques would provide the most definitive evidence of compliance?
A. Reviewing the patch management system’s report showing the patch was installed.
B. Running a vulnerability scanner against the server to check for missing patches.
C. Performing a configuration compliance scan using CIS benchmarks.
D. Asking the system administrator to confirm the patch was applied.
Answer: C
Explanation: A configuration compliance scan (e.g., CIS benchmarks) checks the actual system state against a defined security baseline, including patch levels, registry settings, and file permissions. This provides direct evidence. A patch management report (A) only shows what was pushed, not if it took effect; a vulnerability scanner (B) checks for known vulnerabilities but may not check all baseline items; D is unverifiable and prone to error.
Question 7
A security analyst is analyzing network traffic and notices a large amount of DNS queries for random subdomains under a domain that the company does not own. The queries are coming from a single internal workstation. This behavior is most indicative of which of the following?
A. DNS tunneling (data exfiltration)
B. A misconfigured DNS resolver
C. Normal web browsing activity
D. A distributed denial-of-service (DDoS) attack
Answer: A
Explanation: Random subdomain generation for a single domain is a classic technique for DNS tunneling, where an attacker encodes data in DNS queries to bypass firewalls and exfiltrate data. Misconfigured resolvers (B) would typically cause NXDOMAIN errors, not random queries; normal browsing (C) would use meaningful domain names; a DDoS (D) would originate from many sources, not a single workstation. You can explore this further in 10 CompTIA PenTest+ Practice Questions That Mirror the Real Exam.
For a quick check of weak topics, take the free CompTIA Cybersecurity Analyst readiness check.
Question 8
A security analyst is reviewing a log from a Linux server and sees the following command executed by an unprivileged user:
sudo cat /etc/shadow
The user does not have sudo privileges. Which of the following log entries would the analyst expect to find to confirm this was a failed attempt?
A. user : command not found
B. sudo: user not in the sudoers file. This incident will be reported.
C. kernel: segfault at 0x0000000000000000
D. sshd: Failed password for invalid user
Answer: B
Explanation: When a user without sudo privileges attempts to use sudo, the system logs an error to syslog indicating the user is not in the sudoers file and that the incident will be reported. Option A is a shell error for a missing command, not a permission issue; C is a kernel memory error; D is an SSH authentication failure, unrelated to local sudo usage.
Question 9
An organization has a critical business application that cannot be patched during business hours. A new critical vulnerability is announced for that application, and the vendor has released a patch. Which of the following compensating controls would be the most effective to implement immediately until the patch can be applied?
A. Disable the application’s network access.
B. Implement an application allowlist on the host.
C. Increase the logging level for the application.
D. Apply a virtual patch via an intrusion prevention system (IPS).
Answer: D
Explanation: A virtual patch via an IPS provides immediate, temporary protection by inspecting traffic and blocking exploit attempts without modifying the application. Disabling network access (A) would make the application unusable, which is not acceptable for a critical business app; an application allowlist (B) protects against unauthorized executables but not against exploiting the app’s own vulnerabilities; increasing logging (C) only aids detection, not prevention.
Question 10
After a security incident, the incident response team has successfully contained the threat and eradicated the malware. Which of the following is the primary goal of the "Lessons Learned" phase?
A. To assign blame to the responsible parties.
B. To identify improvements to the security posture and incident response process.
C. To restore the affected systems to full production operation.
D. To collect and preserve forensic evidence for potential litigation.
Answer: B
Explanation: The lessons learned phase is a review process focused on improving future responses and security controls, not assigning blame (A). Restoration (C) is part of the recovery phase, which occurs before lessons learned. Evidence preservation (D) is a forensic activity that is typically done during the initial investigation, not during the post-incident review.
These questions should give you a solid feel for the analytical thinking required for the CySA+ exam. Remember to always look for the best answer, not just a correct one, and pay close attention to keywords like "first," "most," and "best" in the question stem.
As you plan your remaining study time, the free CompTIA Cybersecurity Analyst study plan gives you a week-by-week schedule that fits your hours.
Rehearse under realistic conditions with CompTIA Cybersecurity Analyst (CySA+) mock exam and build the stamina exam day demands.