CySA+ Test CySA+ Difficulty Level 4

Question 1

Which NIST SP 800-61 document revision provides guidance on computer security incident handling?

Accepted Answer

NIST SP 800-61 Rev 2

Answer

NIST SP 800-61 Rev 2, 'Computer Security Incident Handling Guide,' is the primary federal reference for incident response.

Question 2

A candidate finds the CySA+ exam's cryptography questions challenging. Which topic should they review FIRST to improve in this area?

Accepted Answer

PKI trust chains, certificate validation, and common cryptographic attacks

Answer

CySA+ cryptography questions focus on PKI, certificate validation flows, and recognizing cryptographic attack patterns rather than deep mathematics.

Question 3

An analyst observes a spike in failed logon events (Event ID 4625) targeting a single account over 5 minutes. Which attack does this MOST indicate?

Accepted Answer

Brute-force or password spray against a single account

Answer

Repeated 4625 events against a single account in a short window indicates brute-force or targeted password guessing.

Question 4

Which artifact should an analyst collect FIRST when triaging a potentially compromised Linux host to preserve volatile data?

Accepted Answer

Running process list and open network connections

Answer

Running processes and active network connections are volatile and will be lost on reboot, making them the highest-priority collection.

Question 5

In the Diamond Model of intrusion analysis, which element describes the infrastructure used by the adversary?

Accepted Answer

Infrastructure

Answer

Infrastructure in the Diamond Model encompasses IP addresses, domains, and other resources the adversary uses to conduct the attack.

CySA+ Practice Test