CySA+ Test CySA+ Test Security Architecture and Tools 2 — Questions and Answers
Question 1: A CySA+ analyst needs to capture all network traffic on a segment for analysis. Which device should be used to provide a copy of traffic to the monitoring tool without interrupting the data flow?
- Hub
- Network tap (Correct answer)
- Router
- Load balancer
Correct answer: Network tap
A network tap passively copies traffic from a link and sends it to a monitoring or analysis tool without affecting the production data flow.
Question 2: Which type of IDS/IPS detects attacks by comparing traffic patterns against a baseline of normal behavior rather than known attack signatures?
- Signature-based detection
- Anomaly-based detection (Correct answer)
- Heuristic scanning
- Reputation-based filtering
Correct answer: Anomaly-based detection
Anomaly-based detection identifies deviations from established baselines, allowing it to detect novel or unknown attacks that lack signatures.
Question 3: Which security architecture component is designed to deceive attackers by mimicking real systems and gathering intelligence on their techniques?
- Firewall
- Honeypot (Correct answer)
- VPN concentrator
- Proxy server
Correct answer: Honeypot
A honeypot is a decoy system intentionally deployed to lure and observe attackers, gathering TTPs without exposing production assets.
Question 4: Which tool automates the collection, normalization, and correlation of log data from multiple sources to support security investigations?
- EDR
- SIEM (Correct answer)
- WAF
- PAM
Correct answer: SIEM
A SIEM centralizes log collection and correlation, enabling analysts to detect threats, investigate incidents, and meet compliance requirements.
Question 5: An analyst wants to detect threats that have already bypassed perimeter defenses by monitoring endpoint processes and file activity. Which tool is BEST suited for this?
- Firewall
- EDR (Endpoint Detection and Response) (Correct answer)
- DNS sinkhole
- DHCP server
Correct answer: EDR (Endpoint Detection and Response)
EDR tools continuously monitor endpoint activity for suspicious behaviors, enabling detection and response to threats that have bypassed perimeter controls.
Question 6: Which security tool specifically protects web applications by inspecting and filtering HTTP/HTTPS traffic between clients and the application server?
- NGFW
- WAF (Web Application Firewall) (Correct answer)
- IDS
- CASB
Correct answer: WAF (Web Application Firewall)
A WAF inspects HTTP/HTTPS traffic to block web-specific attacks such as SQL injection, XSS, and CSRF before they reach the application.
CySA+ Test CySA+ Test Security Architecture and Tools 2
A CySA+ analyst needs to capture all network traffic on a segment for analysis.
Which device should be used to provide a copy of traffic to the monitoring tool without interrupting the data flow?