CompTIA CySA+ (CS0-004) - Blueprint Practice Exam 1

1. A cloud audit log shows a service identity listing secrets it has never accessed before, shortly after a new access key was created. What data is most useful next?
2. A dashboard shows 2,000 closed alerts, but many were duplicates. What measure better indicates validated incident-handling outcomes?
3. A detection searches only for a malware hash that changes with every build. What additional signal would improve resilience to simple file changes?
4. A DNS log shows one endpoint issuing many long, high-entropy subdomain queries to one newly observed domain. Which hypothesis should be investigated?
5. A generative AI tool summarizes an incident and invents a log entry that is absent from the evidence. What should the analyst do?
6. A package is vulnerable only when an optional feature is enabled. Which information is most important when validating applicability?
7. A packet capture contains encrypted application sessions. Which claim can normally be made without decryption, assuming the headers are visible?
8. A potentially compromised domain controller supports critical business operations. Who should determine a high-impact containment action?
9. A production appliance cannot be patched until a planned outage. Which response best manages the interim risk?
10. A remediation report should help a server owner fix one verified finding. Which content is most useful?
11. A remediation team patches an internet-facing service. What should close the finding?
12. A report attributes malicious activity to a group based only on one commonly used tool. What should the reviewer request?
13. A responder wants to reconstruct how an attacker first gained access. Which approach is strongest?
14. A rule for administrative commands triggers heavily during an approved maintenance window. What is the best tuning approach?
15. A scanner floods fragile industrial devices and disrupts operations. How should future assessments be planned?
16. A scanner identifies a vulnerability using an application banner, but the vendor's maintained package includes a backported fix. What is the best disposition?
17. A security tool flags a script run by a deployment agent. What distinguishes useful validation from a filename-only decision?
18. A server is restored from backup after ransomware. What should precede return to normal production access?
19. A SOC correlation rule matches events from several systems, but device clocks differ by nine minutes. What should be corrected before relying on fine-grained event ordering?
20. A SOC reports a lower mean time to respond after changing when its timer starts. What should the report disclose?
21. A SOC wants to correlate a suspicious cloud login with later object downloads. Which two fields are particularly useful when available? Select 2.
22. A SOC wants to hunt for credential misuse that has not triggered an existing alert. What is the best starting point?
23. A software inventory discovers an unsupported library embedded inside a packaged application. What is the best next step?
24. A suspicious process beaconed every five minutes for three days. Which data source most directly helps establish the remote destination and connection timing across that period?
25. A team removes malware but leaves the stolen service credential unchanged. What response gap remains?
26. A team wants to distinguish likely near-term exploitation from the general severity expressed by CVSS. Which additional input is useful?
27. A threat-intelligence feed labels an IP address malicious based on observations from a year ago. It belongs to shared cloud infrastructure today. How should an analyst use it?
28. A user signs in from a new country, registers a new MFA method, and exports thousands of customer records within minutes. Which conclusion is best supported initially?
29. A vulnerability report lists a deprecated cryptographic protocol still enabled on an external service. What remediation most directly addresses the finding?
30. After closing an incident, repeated delays are traced to unclear on-call authority. What is the most useful improvement?
31. An analyst shares an incident report outside the organization. What should determine which sensitive details can be included?
32. An analyst suspects an active compromise on one endpoint. Which response balances immediate containment with evidence needs?
33. An attacker changes a user's cloud refresh-token access while the password is reset. What additional action may be necessary?
34. An endpoint launches a command interpreter from a document reader and immediately contacts an uncommon external domain. What should an analyst prioritize?
35. An incident is contained but responders disagree whether regulated data left the environment. What is the best reporting approach?
36. An incident team must explain every transfer of a collected disk image. Which record supports that need?
37. An unauthenticated scan reports few findings, but administrators need deeper evidence of missing local patches. What improves coverage?
38. During triage, an alert's IP indicator matches a shared proxy used by many employees. What should the analyst do before assigning a specific user as the source?
39. Executives need a briefing on an ongoing incident. Which content is most appropriate?
40. Two findings affect different systems: a high-score flaw on an isolated lab host and an actively exploited flaw on an internet-facing payment server. What should drive prioritization?

Comments — 0