CySA+ Knowledge Areas Covered Flashcards

A security analyst notices that a host is sending beaconing traffic to an external IP every 60 seconds. Which CySA+ domain does this investigation fall under?

Answer: Security Operations and Monitoring

Identifying and investigating beaconing behavior is a core Security Operations and Monitoring activity in CySA+.

Which CySA+ knowledge area covers the use of YARA rules for identifying malware samples?

Answer: Threat Intelligence

Creating and applying YARA rules to identify malware is part of the Threat Intelligence knowledge area in CySA+.

When a CySA+ analyst uses the Diamond Model to analyze an attack, which domain is primarily being applied?

Answer: Threat Intelligence

The Diamond Model is a threat intelligence framework used to analyze adversary operations and attribution.

A company wants to ensure its web application controls align with OWASP Top 10. Which CySA+ domain is most relevant?

Answer: Software and Systems Security

Evaluating and securing applications against OWASP Top 10 falls under the Software and Systems Security domain.

An analyst is reviewing firewall logs to detect lateral movement after a phishing attack. This activity primarily supports which phase?

Answer: Identification

Reviewing logs to determine the scope and path of an attack is part of the Identification phase of incident response.

Which CySA+ concept describes grouping related threat actor behaviors using a shared taxonomy like ATT&CK?

Answer: Threat Categorization

Threat categorization organizes behaviors and techniques using frameworks like MITRE ATT&CK to structure analysis.

A CySA+ analyst is tasked with reducing the attack surface of cloud-hosted workloads. Which domain does this align with?

Answer: Software and Systems Security

Hardening cloud workloads and reducing attack surface are Software and Systems Security responsibilities in CySA+.