CySA+ Test Security Operations 3

Question 1

A CySA+ analyst reviews a Windows Security event log and sees Event ID 4688 repeatedly for cmd.exe spawned by a Word process. What does this most likely indicate?

Accepted Answer

A macro-based malware execution chain

Answer

cmd.exe spawned by Office processes is a common indicator of malicious macro execution, a known technique used in document-based phishing attacks.

Question 2

Which framework provides a structured taxonomy of adversary tactics and techniques used primarily for threat detection and hunt operations?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK catalogs real-world adversary TTPs organized by tactic phases, making it the standard reference for detection engineering and threat hunting.

Question 3

An organization's WAF is generating thousands of alerts daily. The security team cannot investigate each one. What is the BEST approach to reduce noise while maintaining coverage?

Accepted Answer

Tune WAF rules by analyzing false positives and adjusting thresholds

Answer

Tuning detection rules based on false positive analysis reduces alert fatigue without sacrificing detection coverage for real threats.

Question 4

During a forensic investigation, an analyst discovers that log files covering a critical time window have been deleted. What should be checked to recover evidence?

Accepted Answer

A centralized SIEM or remote syslog server

Answer

Centralized SIEM and remote syslog servers store copies of logs off-system, making them recoverable even after local log tampering or deletion.

Question 5

Which indicator type is considered MOST actionable for immediate blocking because it has the shortest useful lifespan in threat intelligence?

Accepted Answer

IP addresses

Answer

IP addresses are immediately blockable but change frequently as attackers rotate infrastructure, making them short-lived but operationally useful.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Security Operations 3