CySA+ Difficulty Level Flashcards

Basic: Which of the following best describes a brute force attack?

Answer: Attempting all possible password combinations to gain access

A brute force attack is a method of cracking passwords or encryption keys by systematically trying every possible combination of characters until the correct one is found. This exhaustive approach relies on computational power to guess credentials, often targeting weak passwords or login mechanisms without lockout policies. It's a fundamental concept in cybersecurity, highlighting the importance of strong, complex passwords.

Intermediate: A security analyst detects unusual outbound traffic from a workstation. Which of the following should be the first step in addressing this potential incident?

Answer: Isolate the workstation from the network

When unusual outbound traffic is detected, the immediate priority is to contain the potential threat and prevent further compromise or data exfiltration. Isolating the workstation from the network severs its connection to other systems and the internet, stopping the malicious activity from spreading or continuing. This containment step is critical in incident response before further investigation and remediation can occur.

Advanced: A recent vulnerability scan flagged a critical issue related to outdated OpenSSL libraries. What is the most appropriate action to remediate this vulnerability?

Answer: Patch or update the OpenSSL libraries to the latest version

Outdated software libraries, like OpenSSL, often contain known vulnerabilities that attackers can exploit. The most direct and effective remediation for such a critical issue is to apply the vendor-provided security patches or update to the latest stable version of the software. This action directly addresses the root cause of the vulnerability, closing the security gap and protecting the system from exploitation.

Basic: What is the purpose of a web application firewall (WAF)?

Answer: To detect and block malicious web traffic

A Web Application Firewall (WAF) is specifically designed to protect web applications from various attacks, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It filters and monitors HTTP traffic between a web application and the internet, blocking malicious requests before they can reach the application. This provides a crucial layer of defense for web-facing services.

Advanced: During a forensic investigation, a security analyst identifies unexpected DNS queries originating from multiple internal hosts. What might this indicate?

Answer: Malware communicating with a command-and-control server

Unexpected DNS queries from multiple internal hosts, especially to unusual or suspicious domains, are a strong indicator of malware activity. Malicious software often uses DNS to resolve the IP addresses of its command-and-control (C2) servers, allowing it to receive instructions or exfiltrate data. This pattern suggests a coordinated compromise across several systems.