Sample CompTIA CySA+ CS0-003 Practice Questions
Q: What is the primary purpose of a SIEM system?
A: To aggregate, correlate, and analyze security log data from multiple sources — A SIEM (Security Information and Event Management) system collects and correlates log data from multiple sources across the environment to detect security events. It does not block traffic (that is a firewall/IPS function), encrypt data, or manage identities.
Q: What is the primary purpose of a vulnerability scanner?
A: To identify known security weaknesses in systems and applications — Vulnerability scanners identify known security weaknesses by comparing system configurations, software versions, and open ports against databases of known vulnerabilities. They do not exploit vulnerabilities (that is penetration testing), block attacks, or encrypt data.
Q: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?
A: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity — NIST SP 800-61 (Computer Security Incident Handling Guide) defines four phases: (1) Preparation, (2) Detection and Analysis, (3) Containment, Eradication, and Recovery, and (4) Post-Incident Activity (lessons learned). This is the most widely referenced incident response framework.
Q: What is the primary purpose of a vulnerability assessment report?
A: To communicate identified vulnerabilities, their severity, and recommended remediation actions to stakeholders — A vulnerability assessment report communicates the findings from vulnerability scans and assessments, including identified vulnerabilities, their severity ratings, affected systems, potential business impact, and prioritized remediation recommendations for technical and management stakeholders.
Q: Which protocol is commonly used for centralized log collection from network devices?
A: Syslog — Syslog (typically UDP port 514 or TCP port 514) is the standard protocol for sending log messages from network devices to a centralized log server. SNMP is for monitoring, LDAP for directory services, and RADIUS for authentication.
Q: A security analyst notices that their SIEM is generating an excessive number of alerts for normal business traffic. What should the analyst do FIRST?
A: Tune the correlation rules and adjust thresholds to reduce false positives — The correct first step is to tune correlation rules and adjust thresholds. Disabling rules removes visibility, ignoring alerts risks missing real threats, and replacing the SIEM is premature without attempting tuning first.
Q: What does SOAR stand for in the context of security operations?
A: Security Orchestration, Automation, and Response — SOAR stands for Security Orchestration, Automation, and Response. It integrates security tools and automates repetitive tasks such as incident triage, enrichment, and response actions through playbooks.
Q: Which capability distinguishes SOAR from a traditional SIEM?
A: Automated playbook-driven response actions — SOAR's distinguishing feature is its ability to execute automated response playbooks that orchestrate actions across multiple security tools. Log aggregation, correlation, and storage are core SIEM capabilities.
Q: STIX and TAXII are standards used for which purpose?
A: Sharing cyber threat intelligence — STIX (Structured Threat Information Expression) defines a standardized language for representing threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) defines how that intelligence is transported and shared between organizations.
Q: The MITRE ATT&CK framework categorizes adversary behavior into which of the following?
A: Tactics, techniques, and procedures (TTPs) — MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It maps adversary behavior across the attack lifecycle from initial access through exfiltration and impact.