CySA+ Test CySA+ Difficulty Level 5

Question 1

Which indicator type is considered the MOST actionable in threat intelligence because it is both specific and timely?

Accepted Answer

Tactics, Techniques, and Procedures (TTPs)

Answer

TTPs describe adversary behavior and remain valid longer than atomic indicators like IPs or hashes, making them the most actionable intelligence.

Question 2

A candidate with network security experience but limited scripting exposure should focus exam preparation on which CySA+ skill area?

Accepted Answer

Reading and interpreting scripts/code for malicious activity indicators

Answer

CySA+ tests the ability to read and interpret code/scripts for indicators of malicious behavior, not to write production code.

Question 3

Which scanning technique would reveal vulnerabilities that are only exploitable after authenticating to a system?

Accepted Answer

Credentialed vulnerability scan

Answer

Credentialed scans authenticate to the target and can detect misconfigurations and vulnerabilities invisible to unauthenticated scans.

Question 4

An analyst is reviewing a memory dump and finds injected shellcode in a legitimate svchost.exe process. Which attack technique does this represent?

Accepted Answer

Process hollowing or process injection

Answer

Injecting shellcode into a legitimate process like svchost.exe is a process injection technique used to evade detection.

Question 5

Which cloud security concept ensures that even a compromised cloud provider employee cannot access customer data in plaintext?

Accepted Answer

Customer-managed encryption keys (CMEK)

Answer

Customer-managed encryption keys ensure the cloud provider never has access to the plaintext decryption key, protecting data even from insider threats.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test CySA+ Difficulty Level 5