CySA+ Test CySA+ Test Security Architecture and Tools 2

Question 1

A CySA+ analyst needs to capture all network traffic on a segment for analysis. Which device should be used to provide a copy of traffic to the monitoring tool without interrupting the data flow?

Accepted Answer

Network tap

Answer

A network tap passively copies traffic from a link and sends it to a monitoring or analysis tool without affecting the production data flow.

Question 2

Which type of IDS/IPS detects attacks by comparing traffic patterns against a baseline of normal behavior rather than known attack signatures?

Accepted Answer

Anomaly-based detection

Answer

Anomaly-based detection identifies deviations from established baselines, allowing it to detect novel or unknown attacks that lack signatures.

Question 3

Which security architecture component is designed to deceive attackers by mimicking real systems and gathering intelligence on their techniques?

Accepted Answer

Honeypot

Answer

A honeypot is a decoy system intentionally deployed to lure and observe attackers, gathering TTPs without exposing production assets.

Question 4

Which tool automates the collection, normalization, and correlation of log data from multiple sources to support security investigations?

Accepted Answer

SIEM

Answer

A SIEM centralizes log collection and correlation, enabling analysts to detect threats, investigate incidents, and meet compliance requirements.

Question 5

An analyst wants to detect threats that have already bypassed perimeter defenses by monitoring endpoint processes and file activity. Which tool is BEST suited for this?

Accepted Answer

EDR (Endpoint Detection and Response)

Answer

EDR tools continuously monitor endpoint activity for suspicious behaviors, enabling detection and response to threats that have bypassed perimeter controls.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test CySA+ Test Security Architecture and Tools 2