CySA+ Test Security Operations 2

Question 1

A SOC analyst notices repeated failed login attempts from the same IP address across multiple accounts within a 10-minute window. What type of attack is most likely occurring?

Accepted Answer

Password spraying

Answer

Password spraying uses a few common passwords against many accounts to avoid lockout thresholds, matching the pattern of multiple accounts targeted rapidly.

Question 2

Which SIEM correlation rule would BEST detect lateral movement after an initial compromise?

Accepted Answer

Successful login from a new host to multiple internal systems in a short timeframe

Answer

Lateral movement involves an attacker using a foothold to authenticate across multiple internal systems, making cross-host successful logins the strongest indicator.

Question 3

A threat analyst is reviewing NetFlow data and finds a host sending 50 MB of data to an external IP at 2 AM daily. What should be investigated first?

Accepted Answer

DNS query logs for the destination domain

Answer

DNS query logs reveal the domain behind the external IP, helping determine if traffic is C2 beaconing, DLP, or legitimate scheduled transfers.

Question 4

During incident response, a host is confirmed to be infected with malware. Which action preserves the most forensic evidence before remediation?

Accepted Answer

Capture a full memory dump and disk image

Answer

Memory dumps capture volatile artifacts like running processes and injected code, while disk images preserve file system state for post-incident analysis.

Question 5

Which metric BEST measures the efficiency of a SOC's incident detection capability?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

MTTD measures how quickly the SOC identifies a threat after it occurs, directly reflecting detection capability effectiveness.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Security Operations 2