CySA+ Test CySA+ Difficulty Level 2

Question 1

Which CySA+ domain requires analysts to evaluate the effectiveness of existing security controls against threat intelligence feeds?

Accepted Answer

Threat Intelligence and Threat Hunting

Answer

The Threat Intelligence and Threat Hunting domain specifically requires analysts to correlate threat intel with control effectiveness.

Question 2

A SOC analyst receives an alert that a host is beaconing to a known C2 server every 60 seconds. Which tactic in the MITRE ATT&CK framework best describes this behavior?

Accepted Answer

Command and Control

Answer

Regular callback intervals to a C2 server are classified under the Command and Control tactic in MITRE ATT&CK.

Question 3

On the CySA+ exam, scenario-based questions most frequently test which skill?

Accepted Answer

Applying analytical reasoning to realistic security events

Answer

CySA+ scenario questions are designed to assess whether candidates can apply analytical thinking to realistic, contextual security situations.

Question 4

Which log source would BEST help an analyst determine whether a Windows host has had its audit policy modified?

Accepted Answer

Security Event Log (Event ID 4719)

Answer

Event ID 4719 in the Windows Security Event Log records changes to system audit policy.

Question 5

An analyst is tasked with reducing alert fatigue in the SIEM. Which action addresses the root cause most effectively?

Accepted Answer

Tuning detection rules to reduce false positives

Answer

Tuning detection rules reduces false positives, which is the primary driver of alert fatigue.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test CySA+ Difficulty Level 2