CySA+ Test Security Operations 3 — Questions and Answers
Question 1: A CySA+ analyst reviews a Windows Security event log and sees Event ID 4688 repeatedly for cmd.exe spawned by a Word process. What does this most likely indicate?
- Normal document processing activity
- A macro-based malware execution chain (Correct answer)
- A scheduled task running cleanup scripts
- A user manually opening a command prompt
Correct answer: A macro-based malware execution chain
cmd.exe spawned by Office processes is a common indicator of malicious macro execution, a known technique used in document-based phishing attacks.
Question 2: Which framework provides a structured taxonomy of adversary tactics and techniques used primarily for threat detection and hunt operations?
- OWASP Top 10
- MITRE ATT&CK (Correct answer)
- NIST CSF
- CIS Controls
Correct answer: MITRE ATT&CK
MITRE ATT&CK catalogs real-world adversary TTPs organized by tactic phases, making it the standard reference for detection engineering and threat hunting.
Question 3: An organization's WAF is generating thousands of alerts daily. The security team cannot investigate each one. What is the BEST approach to reduce noise while maintaining coverage?
- Disable the WAF during off-peak hours
- Tune WAF rules by analyzing false positives and adjusting thresholds (Correct answer)
- Block all traffic from foreign countries
- Upgrade the WAF to a newer model
Correct answer: Tune WAF rules by analyzing false positives and adjusting thresholds
Tuning detection rules based on false positive analysis reduces alert fatigue without sacrificing detection coverage for real threats.
Question 4: During a forensic investigation, an analyst discovers that log files covering a critical time window have been deleted. What should be checked to recover evidence?
- The application's config files
- A centralized SIEM or remote syslog server (Correct answer)
- The local firewall rules
- Antivirus quarantine folder
Correct answer: A centralized SIEM or remote syslog server
Centralized SIEM and remote syslog servers store copies of logs off-system, making them recoverable even after local log tampering or deletion.
Question 5: Which indicator type is considered MOST actionable for immediate blocking because it has the shortest useful lifespan in threat intelligence?
- Tactics, Techniques, and Procedures (TTPs)
- IP addresses (Correct answer)
- Malware behavior patterns
- Adversary motivations
Correct answer: IP addresses
IP addresses are immediately blockable but change frequently as attackers rotate infrastructure, making them short-lived but operationally useful.
Question 6: A company wants to test whether its monitoring tools can detect a real-world attack simulation without risking production systems. What exercise should they conduct?
- Tabletop exercise
- Purple team exercise (Correct answer)
- Business continuity drill
- Compliance audit
Correct answer: Purple team exercise
A purple team exercise combines red team attack simulation with blue team detection monitoring, measuring actual detection and response capabilities collaboratively.
Question 7: An analyst receives a threat intelligence report listing IOCs from an attack campaign. What should be done FIRST before ingesting IOCs into the SIEM?
- Share the IOCs with peer organizations
- Validate the IOCs for accuracy and relevance to your environment (Correct answer)
- Block all listed IPs at the perimeter firewall
- Archive the report for future reference
Correct answer: Validate the IOCs for accuracy and relevance to your environment
Validating IOC relevance and accuracy prevents false positives, ensures the intelligence applies to your technology stack, and avoids blocking legitimate traffic.
CySA+ Test Security Operations 3
A CySA+ analyst reviews a Windows Security event log and sees Event ID 4688 repeatedly for cmd.exe spawned by a Word process.
What does this most likely indicate?