CySA+ Difficulty Level 1

Question 1

Basic: Which of the following best describes a brute force attack?

Accepted Answer

Attempting all possible password combinations to gain access

Answer

A brute force attack is a method of cracking passwords or encryption keys by systematically trying every possible combination of characters until the correct one is found. This exhaustive approach relies on computational power to guess credentials, often targeting weak passwords or login mechanisms without lockout policies. It's a fundamental concept in cybersecurity, highlighting the importance of strong, complex passwords.

Question 2

Intermediate: A security analyst detects unusual outbound traffic from a workstation. Which of the following should be the first step in addressing this potential incident?

Accepted Answer

Isolate the workstation from the network

Answer

When unusual outbound traffic is detected, the immediate priority is to contain the potential threat and prevent further compromise or data exfiltration. Isolating the workstation from the network severs its connection to other systems and the internet, stopping the malicious activity from spreading or continuing. This containment step is critical in incident response before further investigation and remediation can occur.

Question 3

Advanced: A recent vulnerability scan flagged a critical issue related to outdated OpenSSL libraries. What is the most appropriate action to remediate this vulnerability?

Accepted Answer

Patch or update the OpenSSL libraries to the latest version

Answer

Outdated software libraries, like OpenSSL, often contain known vulnerabilities that attackers can exploit. The most direct and effective remediation for such a critical issue is to apply the vendor-provided security patches or update to the latest stable version of the software. This action directly addresses the root cause of the vulnerability, closing the security gap and protecting the system from exploitation.

Question 4

Basic: What is the purpose of a web application firewall (WAF)?

Accepted Answer

To detect and block malicious web traffic

Answer

A Web Application Firewall (WAF) is specifically designed to protect web applications from various attacks, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It filters and monitors HTTP traffic between a web application and the internet, blocking malicious requests before they can reach the application. This provides a crucial layer of defense for web-facing services.

Question 5

Advanced: During a forensic investigation, a security analyst identifies unexpected DNS queries originating from multiple internal hosts. What might this indicate?

Accepted Answer

Malware communicating with a command-and-control server

Answer

Unexpected DNS queries from multiple internal hosts, especially to unusual or suspicious domains, are a strong indicator of malware activity. Malicious software often uses DNS to resolve the IP addresses of its command-and-control (C2) servers, allowing it to receive instructions or exfiltrate data. This pattern suggests a coordinated compromise across several systems.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Difficulty Level 1