CySA+ Test CySA+ Difficulty Level 3

Question 1

Which phase of the incident response lifecycle focuses on identifying lessons learned and updating playbooks?

Accepted Answer

Post-Incident Activity

Answer

Post-Incident Activity (also called Post-Incident Review) is the phase where lessons learned are documented and controls are updated.

Question 2

An analyst notices outbound traffic to a domain registered 24 hours ago with a high entropy subdomain. Which threat technique does this MOST suggest?

Accepted Answer

Domain Generation Algorithm (DGA)

Answer

Newly registered domains with high-entropy subdomains are a hallmark of Domain Generation Algorithms used by malware to locate C2 infrastructure.

Question 3

A CySA+ candidate struggles most with performance-based questions. What study approach is MOST effective?

Accepted Answer

Practicing with hands-on labs and scenario simulations

Answer

Performance-based questions require applied skills; hands-on lab practice and scenario simulations directly build the competencies tested.

Question 4

Which tool would an analyst use to passively map the network topology without generating traffic?

Accepted Answer

Wireshark packet capture analysis

Answer

Analyzing existing Wireshark captures allows topology mapping without generating new probe traffic.

Question 5

A newly discovered vulnerability has a CVSS base score of 9.8 but no public exploit exists yet. How should a CySA+ analyst BEST prioritize remediation?

Accepted Answer

Prioritize based on asset criticality and exploit likelihood

Answer

Risk-based prioritization weighs CVSS score alongside asset criticality and the likelihood of exploitation, not just severity alone.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test CySA+ Difficulty Level 3