CySA+ Test CySA+ Difficulty Level 2 — Questions and Answers
Question 1: Which CySA+ domain requires analysts to evaluate the effectiveness of existing security controls against threat intelligence feeds?
- Vulnerability Management
- Security Operations
- Threat Intelligence and Threat Hunting (Correct answer)
- Incident Response
Correct answer: Threat Intelligence and Threat Hunting
The Threat Intelligence and Threat Hunting domain specifically requires analysts to correlate threat intel with control effectiveness.
Question 2: A SOC analyst receives an alert that a host is beaconing to a known C2 server every 60 seconds. Which tactic in the MITRE ATT&CK framework best describes this behavior?
- Exfiltration
- Command and Control (Correct answer)
- Lateral Movement
- Persistence
Correct answer: Command and Control
Regular callback intervals to a C2 server are classified under the Command and Control tactic in MITRE ATT&CK.
Question 3: On the CySA+ exam, scenario-based questions most frequently test which skill?
- Memorizing CVE numbers
- Applying analytical reasoning to realistic security events (Correct answer)
- Listing OSI model layers
- Reciting NIST framework tier definitions
Correct answer: Applying analytical reasoning to realistic security events
CySA+ scenario questions are designed to assess whether candidates can apply analytical thinking to realistic, contextual security situations.
Question 4: Which log source would BEST help an analyst determine whether a Windows host has had its audit policy modified?
- Application Event Log
- System Event Log
- Security Event Log (Event ID 4719) (Correct answer)
- DNS debug log
Correct answer: Security Event Log (Event ID 4719)
Event ID 4719 in the Windows Security Event Log records changes to system audit policy.
Question 5: An analyst is tasked with reducing alert fatigue in the SIEM. Which action addresses the root cause most effectively?
- Increasing SIEM storage capacity
- Tuning detection rules to reduce false positives (Correct answer)
- Disabling low-priority alerts entirely
- Hiring additional analysts
Correct answer: Tuning detection rules to reduce false positives
Tuning detection rules reduces false positives, which is the primary driver of alert fatigue.
Question 6: Which vulnerability scoring metric in CVSSv3 reflects how complex the conditions must be for an attacker to exploit the vulnerability?
- Attack Vector
- Privileges Required
- Attack Complexity (Correct answer)
- User Interaction
Correct answer: Attack Complexity
Attack Complexity in CVSSv3 measures the conditions beyond the attacker's control that must exist for exploitation.
Question 7: During a purple team exercise, the blue team fails to detect a simulated lateral movement via PsExec. Which control gap does this MOST likely indicate?
- Lack of endpoint antivirus signatures
- Insufficient network segmentation
- Missing detection logic for SMB-based admin tool execution (Correct answer)
- Absence of a vulnerability scanner
Correct answer: Missing detection logic for SMB-based admin tool execution
PsExec operates over SMB using legitimate admin shares; the gap is missing behavioral detection for admin tool abuse, not AV signatures.
CySA+ Test CySA+ Difficulty Level 2
Which CySA+ domain requires analysts to evaluate the effectiveness of existing security controls against threat intelligence feeds?