CySA+ Test CySA+ Difficulty Level 3 — Questions and Answers
Question 1: Which phase of the incident response lifecycle focuses on identifying lessons learned and updating playbooks?
- Containment
- Eradication
- Post-Incident Activity (Correct answer)
- Detection and Analysis
Correct answer: Post-Incident Activity
Post-Incident Activity (also called Post-Incident Review) is the phase where lessons learned are documented and controls are updated.
Question 2: An analyst notices outbound traffic to a domain registered 24 hours ago with a high entropy subdomain. Which threat technique does this MOST suggest?
- SQL Injection
- Domain Generation Algorithm (DGA) (Correct answer)
- ARP Spoofing
- Pass-the-Hash
Correct answer: Domain Generation Algorithm (DGA)
Newly registered domains with high-entropy subdomains are a hallmark of Domain Generation Algorithms used by malware to locate C2 infrastructure.
Question 3: A CySA+ candidate struggles most with performance-based questions. What study approach is MOST effective?
- Reading the CompTIA exam objectives PDF twice
- Practicing with hands-on labs and scenario simulations (Correct answer)
- Memorizing acronym lists
- Watching vendor certification ads
Correct answer: Practicing with hands-on labs and scenario simulations
Performance-based questions require applied skills; hands-on lab practice and scenario simulations directly build the competencies tested.
Question 4: Which tool would an analyst use to passively map the network topology without generating traffic?
- Nmap with SYN scan
- Wireshark packet capture analysis (Correct answer)
- Metasploit auxiliary modules
- OpenVAS
Correct answer: Wireshark packet capture analysis
Analyzing existing Wireshark captures allows topology mapping without generating new probe traffic.
Question 5: A newly discovered vulnerability has a CVSS base score of 9.8 but no public exploit exists yet. How should a CySA+ analyst BEST prioritize remediation?
- Deprioritize it since no exploit exists
- Patch immediately regardless of asset criticality
- Prioritize based on asset criticality and exploit likelihood (Correct answer)
- Wait for vendor guidance before acting
Correct answer: Prioritize based on asset criticality and exploit likelihood
Risk-based prioritization weighs CVSS score alongside asset criticality and the likelihood of exploitation, not just severity alone.
Question 6: Which network artifact would BEST help confirm data exfiltration over DNS?
- Unusually large DNS TXT or NULL record responses (Correct answer)
- High volume of ICMP echo requests
- Repeated failed SMB authentication attempts
- ARP broadcast storms
Correct answer: Unusually large DNS TXT or NULL record responses
DNS tunneling encodes data in record types like TXT or NULL; abnormally large responses are a primary indicator.
Question 7: What distinguishes threat hunting from traditional reactive incident response?
- Threat hunting relies solely on automated SIEM alerts
- Threat hunting proactively searches for hidden threats before alerts fire (Correct answer)
- Threat hunting is performed only after a breach is confirmed
- Threat hunting replaces the need for a vulnerability scanner
Correct answer: Threat hunting proactively searches for hidden threats before alerts fire
Threat hunting is a proactive, hypothesis-driven search for threats that have evaded existing detection controls.
CySA+ Test CySA+ Difficulty Level 3
Which phase of the incident response lifecycle focuses on identifying lessons learned and updating playbooks?