CySA+ Test Security Operations 2 — Questions and Answers
Question 1: A SOC analyst notices repeated failed login attempts from the same IP address across multiple accounts within a 10-minute window. What type of attack is most likely occurring?
- Password spraying (Correct answer)
- Credential stuffing
- Brute force
- Phishing
Correct answer: Password spraying
Password spraying uses a few common passwords against many accounts to avoid lockout thresholds, matching the pattern of multiple accounts targeted rapidly.
Question 2: Which SIEM correlation rule would BEST detect lateral movement after an initial compromise?
- Multiple failed logins from one source
- Successful login from a new host to multiple internal systems in a short timeframe (Correct answer)
- High volume outbound traffic to a single IP
- New user account creation outside business hours
Correct answer: Successful login from a new host to multiple internal systems in a short timeframe
Lateral movement involves an attacker using a foothold to authenticate across multiple internal systems, making cross-host successful logins the strongest indicator.
Question 3: A threat analyst is reviewing NetFlow data and finds a host sending 50 MB of data to an external IP at 2 AM daily. What should be investigated first?
- DNS query logs for the destination domain (Correct answer)
- The host's patch level
- Firewall rule configurations
- User authentication logs for that host
Correct answer: DNS query logs for the destination domain
DNS query logs reveal the domain behind the external IP, helping determine if traffic is C2 beaconing, DLP, or legitimate scheduled transfers.
Question 4: During incident response, a host is confirmed to be infected with malware. Which action preserves the most forensic evidence before remediation?
- Reimage the system immediately
- Capture a full memory dump and disk image (Correct answer)
- Run an antivirus scan to identify all infected files
- Disconnect the host and power it off
Correct answer: Capture a full memory dump and disk image
Memory dumps capture volatile artifacts like running processes and injected code, while disk images preserve file system state for post-incident analysis.
Question 5: Which metric BEST measures the efficiency of a SOC's incident detection capability?
- Mean Time to Respond (MTTR)
- Mean Time to Detect (MTTD) (Correct answer)
- Number of alerts closed per day
- False positive rate
Correct answer: Mean Time to Detect (MTTD)
MTTD measures how quickly the SOC identifies a threat after it occurs, directly reflecting detection capability effectiveness.
Question 6: An analyst finds a PowerShell script executing from a user's temp directory that encodes commands in Base64. What is the PRIMARY concern?
- Disk space consumption
- Living-off-the-land attack using built-in tools to evade detection (Correct answer)
- Unauthorized software installation
- User misconfiguration of system settings
Correct answer: Living-off-the-land attack using built-in tools to evade detection
Base64-encoded PowerShell executed from temp directories is a classic living-off-the-land technique that abuses trusted system tools to blend with normal activity.
Question 7: A security team wants to proactively search for signs of compromise not yet detected by automated tools. What practice should they implement?
- Vulnerability scanning
- Threat hunting (Correct answer)
- Security awareness training
- Patch management
Correct answer: Threat hunting
Threat hunting is the proactive, human-driven search for attacker TTPs and indicators that automated detection systems have not yet flagged.
CySA+ Test Security Operations 2
A SOC analyst notices repeated failed login attempts from the same IP address across multiple accounts within a 10-minute window.
What type of attack is most likely occurring?