CompTIA Certification
62 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The CompTIA CySA+ (CS0-003) certification validates professional expertise in CompTIA technologies. This study guide covers all 62 practice questions from our CS0-003 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
A security analyst is reviewing network traffic and notices unusual outbound connections to multiple IP addresses on port 443 with very short connection durations. Which of the following is the most likely explanation?
Short, numerous connections to different IPs on port 443 with quick disconnections is characteristic of data exfiltration malware testing multiple command-and-control servers or data staging endpoints.
During a vulnerability assessment, an analyst discovers that a web application is vulnerable to XXE (XML External Entity) injection. What is the primary risk associated with this vulnerability?
XXE vulnerabilities allow attackers to read arbitrary files from the server, access internal network resources, and perform SSRF attacks by exploiting how XML parsers process external entity definitions.
A company implements a Web Application Firewall (WAF) and wants to establish a baseline for normal traffic patterns. Which metric should the security team prioritize when tuning WAF rules to minimize false positives?
The false positive rate (legitimate traffic incorrectly blocked) versus true positive rate is critical for WAF tuning, as excessive false positives disrupt legitimate users while insufficient blocking leaves vulnerabilities exposed.
An organization detects a rootkit on a critical production server. Which of the following actions should be prioritized FIRST in the incident response process?
Isolating the compromised system immediately prevents the rootkit from spreading to other network resources, which is the paramount concern before any remediation or analysis activities begin.
A penetration tester discovers that a target application accepts user input and passes it directly to a database query without parameterization. What vulnerability does this represent, and what is the primary risk?
Unparameterized queries that incorporate user input directly allow SQL Injection attacks where attackers can manipulate SQL statements to access, modify, or delete database records.
During threat modeling, an analyst identifies that an application stores sensitive data in client-side JavaScript variables. Which attack vector is most likely to exploit this vulnerability?
Client-side JavaScript is visible in the page source and accessible to any script running in the same browser context, making XSS attacks the primary vector to access sensitive data stored in JavaScript variables.
A security analyst is tasked with reducing the attack surface of a multi-tier application. Which approach best aligns with the principle of least privilege?
Least privilege requires that users and services have only the minimum permissions necessary to perform their functions, which is achieved through well-designed RBAC policies.
An organization experiences a data breach where credentials were exfiltrated. The attacker used these credentials to access systems weeks later. Which security control would have most effectively prevented the lateral movement phase of this attack?
Network segmentation prevents compromised credentials from being immediately useful across the entire infrastructure by restricting access between security zones, limiting the scope of lateral movement even with valid credentials.
While performing log analysis, an analyst notices multiple failed login attempts followed by a successful login from the same source IP within seconds. What type of attack does this pattern indicate?
The pattern of multiple failed attempts immediately followed by a successful login from the same source is characteristic of brute force or credential stuffing attacks where the attacker finally guesses or uses a valid credential.
A vulnerability scanner reports a service running on a non-standard port with an outdated SSL/TLS version. During remediation, the security team discovers the service cannot be updated. What is the most appropriate compensating control?
When a vulnerable service cannot be patched, restricting access through firewall rules and network segmentation limits the potential attackers who can reach and exploit the service, providing an effective compensating control.
An analyst reviews firewall logs and sees a sudden spike in DNS queries to unusual domains with suspicious characteristics. What is the next step in the incident response process?
The priority is to identify which internal systems are compromised and understand the scope of the incident before taking any blocking actions, ensuring a comprehensive response.
A company wants to implement a Zero Trust security model. Which of the following architectural principles is fundamental to Zero Trust?
Zero Trust architecture is built on the principle that no access should be automatically trusted; every access request must be verified through continuous authentication and authorization checks.
During a security assessment, an analyst identifies that the organization uses hardcoded credentials in configuration files stored in a code repository. What is the primary risk of this practice?
Hardcoded credentials in repositories are easily exposed through accidental commits, repository breaches, or insider access, allowing attackers to compromise multiple systems with valid credentials.
A security analyst is reviewing process execution logs and notices a legitimate application spawning unusual child processes with system-level privileges. What does this behavior suggest?
A legitimate application unexpectedly spawning child processes with elevated privileges is a strong indicator of process injection or exploitation, as legitimate applications typically run with only required privileges.
An organization implements endpoint detection and response (EDR) technology. Which of the following is a primary advantage of EDR over traditional antivirus solutions?
EDR solutions detect threats through behavioral analysis, process monitoring, and threat hunting rather than signature-based detection alone, enabling detection of novel and evasive malware that traditional antivirus may miss.
While analyzing a security incident, an investigator discovers that the attacker gained initial access through a phishing email with a malicious attachment. What is the most effective control to prevent this attack vector in the future?
Advanced email filtering with sandboxing detects malicious attachments by analyzing them in an isolated environment before they reach users, preventing the initial compromise vector.
A penetration tester uses a tool to intercept and modify HTTPS traffic from a client to a web server. Which of the following conditions would allow this attack to succeed?
A man-in-the-middle attack on HTTPS requires the attacker to present a certificate that the client trusts; if a malicious CA certificate is installed in the client's trust store, the attacker can forge certificates for any domain.
An organization's intrusion detection system (IDS) generates a high volume of alerts daily, but the security team determines that most are false positives. What is the best approach to improve the situation?
Tuning IDS rules against a baseline of normal network behavior reduces false positives while maintaining the ability to detect actual threats, improving the signal-to-noise ratio for security analysts.
During a vulnerability assessment, a penetration tester discovers that a web application reflects user input back in HTTP response headers without sanitization. What vulnerability could this enable?
Unsanitized user input in HTTP response headers can allow attackers to inject additional headers or split responses, enabling attacks like cache poisoning, session fixation, or XSS through header injection.
A security analyst is implementing a vulnerability management program. Which of the following metrics should be prioritized when prioritizing remediation efforts?
Effective prioritization combines vulnerability severity (CVSS score), asset importance (criticality), and threat intelligence (active exploitation) to focus remediation on the most impactful vulnerabilities.
An organization discovers that an employee accidentally shared sensitive data in a public GitHub repository. Which immediate action would best limit potential damage?
Revoking compromised credentials immediately prevents attackers from using exposed API keys, passwords, or authentication tokens to access systems, limiting the window of exploitation.
A security team is evaluating cloud security posture management (CSPM) tools. What is the primary benefit of CSPM in a cloud environment?
CSPM tools continuously scan cloud infrastructure configurations against security benchmarks and compliance standards, identifying misconfigurations before they can be exploited.
While investigating a suspected insider threat, an analyst reviews file access logs and observes an employee accessing files outside their normal job responsibilities before copying them to external storage. What is the most appropriate next step?
Suspicious data access requires immediate escalation to management and investigation while preserving evidence and continuing monitoring, but without premature action that could compromise a legal investigation.
A company implements certificate pinning in its mobile application to prevent man-in-the-middle attacks. Which of the following is a potential disadvantage of this approach?
Certificate pinning locks the application to specific certificates, making certificate renewal challenging; if the pinned certificate expires before the app is updated, users cannot connect until the app is updated.
An analyst discovers that a legacy system cannot be patched due to vendor end-of-life constraints. The system processes non-sensitive operational data but is connected to the internal network. What is the most appropriate mitigation strategy?
Network segmentation allows the legacy system to remain operational while limiting its access to only necessary resources and preventing it from being a pivot point for lateral movement if compromised.
A security analyst discovers that an attacker has been using a command and control (C2) server to exfiltrate data over several weeks. Which of the following should be the analyst's FIRST action?
Before taking reactive measures, analysts must first understand the scope and nature of the incident through evidence preservation and assessment. This ensures effective containment and enables proper forensic analysis.
Which of the following best describes the purpose of threat modeling during the secure development lifecycle?
Threat modeling is a proactive security practice used to identify and document potential threats and vulnerabilities in an application's design before implementation, enabling early mitigation.
An analyst reviews firewall logs and notices an unusual pattern: multiple failed authentication attempts from a single source IP followed by a successful login using valid credentials from a different geographic location within seconds. What is the MOST likely explanation?
The pattern of multiple failed attempts from one IP followed by successful authentication from a different location suggests an attacker obtained valid credentials and successfully compromised the account.
Which vulnerability assessment technique involves running automated tools to scan systems for known vulnerabilities and configuration weaknesses?
Authenticated vulnerability scanning uses automated tools to identify known vulnerabilities and misconfigurations by scanning systems with valid credentials for deeper analysis.
A company experiences a security incident where ransomware encrypts critical files on a network share. During the forensic investigation, the analyst needs to determine the attack vector. Which of the following is the BEST place to begin investigating?
EDR logs and Windows Event Logs provide detailed records of process execution, network connections, and lateral movement that reveal how the ransomware was deployed and executed.
Which of the following best represents a zero-day vulnerability?
A zero-day is a previously unknown vulnerability exploited by attackers before the vendor becomes aware or releases a patch, making it particularly dangerous.
An analyst is reviewing SIEM alerts and notices that a database administrator account performed multiple unusual activities: querying sensitive customer data outside normal business hours, exporting large datasets, and accessing systems they do not normally use. What is the MOST appropriate first response?
Before assuming malicious intent, the analyst should first interview the user to determine if there was a legitimate business reason, as unusual activity can occur for authorized purposes.
During a security assessment, an analyst discovers that several servers are running outdated SSL/TLS versions that are vulnerable to known attacks. Which of the following is the BEST remediation approach?
Upgrading to TLS 1.3 and disabling older versions is the industry best practice to eliminate known SSL/TLS vulnerabilities while maintaining secure encrypted communications.
Which of the following scenarios represents a FALSE POSITIVE in the context of security alerting?
A false positive occurs when a security alert is triggered for legitimate activity rather than actual malicious behavior, wasting analyst time on investigation.
An organization uses certificate pinning in its mobile application to prevent man-in-the-middle attacks. Which statement BEST describes how certificate pinning enhances security?
Certificate pinning hardens security by binding the app to expect specific certificates, making it extremely difficult for attackers to intercept connections even with compromised certificate authorities.
Which of the following is the PRIMARY benefit of implementing a bug bounty program?
Bug bounty programs leverage external security researchers to identify vulnerabilities that internal teams might miss, providing an additional layer of security validation.
An analyst is investigating a potential insider threat where an employee transferred sensitive intellectual property to a competitor. The employee had valid access credentials. Which of the following is the MOST important evidence to examine?
Digital forensic evidence such as access logs, file transfers, and communications provides concrete proof of the data movement and is admissible in legal proceedings.
Which of the following best explains the difference between vulnerability scanning and penetration testing?
Scanning is automated identification of weaknesses; penetration testing goes further by attempting to exploit vulnerabilities to demonstrate real-world impact and exploit chains.
During incident response, an analyst determines that a compromised server has been used to launch attacks against other internal systems. What is the BEST next action regarding the compromised server?
Isolating the compromised server while preserving its state allows forensic analysts to investigate the breach, determine the attack methodology, and ensure the backup is not also compromised before restoration.
An organization discovers that an external contractor's credentials were used to access systems containing regulated data. Which of the following is the MOST important control to prevent this in the future?
PAM with time-limited access, MFA, and strong monitoring provides technical controls that limit the window of exposure and require additional authentication factors even if credentials are compromised.
Which of the following describes the main purpose of security awareness training in an organization?
Security awareness training aims to change employee behavior and understanding of security risks, significantly reducing incidents caused by human error, phishing, and social engineering.
An analyst reviewing network traffic notices suspicious DNS queries resolving to IP addresses associated with known malware command and control servers. The queries are originating from an internal workstation. What should the analyst do FIRST?
DNS queries to known malware C2 servers indicate a likely compromise. The workstation should be isolated immediately to prevent further damage while forensic analysis is conducted.
Which of the following is the BEST practice for managing security patches in a large enterprise environment?
A phased approach with testing, prioritization, and rollback procedures balances the need for timely security updates with the risk of patch-induced outages in production systems.
An organization is implementing a data loss prevention (DLP) solution. Which of the following represents the PRIMARY benefit?
DLP solutions identify sensitive data in transit and block unauthorized exfiltration attempts, protecting against data loss through email, cloud uploads, removable media, and other channels.
During a security incident, an analyst needs to determine when a file was first created and when it was last modified. Which of the following artifacts would provide this information?
File system MAC times provide definitive timestamps for file creation, modification, and metadata changes, making them critical artifacts in forensic investigations.
Which of the following best describes the purpose of a threat intelligence feed in a security operations center?
Threat intelligence feeds deliver actionable information about current threats and IOCs that help security teams detect and respond to incidents more effectively and rapidly.
An analyst discovers that a company's web application is vulnerable to reflected cross-site scripting (XSS). Which of the following is the MOST effective remediation?
Proper input validation, filtering, and output encoding at the application level is the correct fix for XSS vulnerabilities, as it prevents malicious scripts from executing in user browsers.
Which of the following statements is true regarding security metrics and key performance indicators (KPIs)?
Security metrics and KPIs should provide meaningful measurement of control effectiveness and risk trends, enabling data-driven decisions about security investments and priorities.
During a forensic investigation of a suspected data breach, the analyst discovers that the system's audit logs have been deleted. Which of the following is the BEST approach to reconstruct what occurred?
While the primary audit logs are gone, multiple alternative evidence sources can reconstruct the timeline and activities, including application logs, email, network data, and EDR solutions.
An organization implements endpoint detection and response (EDR) software on all workstations. Which of the following is a primary advantage of this approach?
EDR provides deep visibility into endpoint behavior and processes, enabling threat hunting, behavioral detection, and rapid response to sophisticated attacks that antivirus alone might miss.
Which of the following best describes the LEAST privilege principle in access control?
The least privilege principle limits each user to only the permissions absolutely necessary for their role, reducing the damage potential if an account is compromised.
An analyst is reviewing logs from a compromised server and observes multiple failed attempts to create user accounts followed by successful creation of an administrative account. What does this pattern suggest?
The pattern of failed attempts followed by successful creation of an admin account suggests an attacker enumerating and exploiting vulnerabilities in account creation processes for persistence.
A security analyst reviews firewall logs and identifies multiple failed SSH connection attempts from the same external IP address over a 2-hour period, followed by successful connections using valid credentials. What type of attack is most likely being conducted?
The pattern of initial failures followed by successful authentication using valid credentials strongly suggests credential stuffing, where an attacker uses previously compromised credentials rather than systematically guessing passwords.
Which of the following best describes the primary purpose of implementing network segmentation in a security architecture?
Network segmentation creates logical boundaries that restrict an attacker's ability to move freely across the network after initial compromise, thereby limiting the scope and impact of a potential breach.
During a vulnerability assessment, an analyst discovers that a web application fails to properly validate and encode user input before displaying it in search results. What is the primary risk associated with this finding?
The lack of input validation and output encoding in search results is a classic XSS vulnerability, allowing attackers to inject malicious JavaScript that executes in other users' browsers.
A company's intrusion detection system (IDS) generates an alert for suspicious activity, but after investigation, the security team determines the activity was legitimate and part of normal business operations. What is this type of alert called, and what is the primary concern it creates?
False positives are legitimate activities incorrectly flagged as malicious; excessive false positives cause alert fatigue, where analysts become desensitized and may miss genuine threats.
An analyst is reviewing SIEM logs and notices that an employee accessed sensitive data repositories at 3 AM from an IP address in a different country than their normal location. The employee is currently scheduled to be on vacation. What is the most appropriate immediate response?
The combination of unusual time, geographic impossibility, and known absence indicates likely account compromise and warrants immediate account disabling and incident investigation to prevent data theft.
A security team is implementing a data loss prevention (DLP) solution. During the pilot phase, the system blocks legitimate business emails containing financial reports and customer contact information. What is the primary challenge this scenario illustrates?
This scenario demonstrates the critical challenge of DLP implementation—creating policies that protect sensitive data while minimizing false positives that block legitimate business communications.
An organization discovers that an attacker has been using a zero-day vulnerability in a third-party software component to gain unauthorized access. The vendor has not yet released a patch. Which of the following represents the most effective compensating control?
When a patch is unavailable for a zero-day vulnerability, the most effective compensating control is restricting network access and limiting system connectivity to reduce exploitation impact and lateral movement potential.
A penetration tester uses a tool to capture network traffic and discovers several unencrypted passwords transmitted across the organization's internal network. The IT department states that internal network communication does not need encryption because it is behind the firewall. What is the primary flaw in this security assumption?
The assumption that internal networks are secure solely because of firewall protection ignores insider threats and compromised internal systems that can capture unencrypted credentials for lateral movement.
During threat modeling for a new application, a security team identifies that user session tokens are stored in browser local storage without httpOnly or Secure flags. What vulnerability does this create, and what is the primary attack vector?
Session tokens in local storage without httpOnly flag are accessible to JavaScript, making them vulnerable to XSS attacks where malicious scripts can steal tokens and hijack user sessions.
A security analyst reviews user access logs and observes that a contractor account has not been disabled 60 days after the contract end date, despite a policy requiring immediate access revocation. What is this finding primarily an example of?
Failing to revoke contractor access after contract termination demonstrates a breakdown in access lifecycle management and governance controls, creating risk of unauthorized access from former employees.
You've reviewed all 62 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free