CompTIA CS0-003 CompTIA Cybersecurity Analyst (CySA+) Exam Practice Test

Answer : B

Risk Acceptance means acknowledging a risk and choosing not to take further action because the cost of mitigation may outweigh the benefits.

It is the last resort when:

The risk is low impact or unlikely to occur.

Other options (mitigation, transfer, avoidance) are not feasible.

Why Not Other Options?

A (Transfer) Moving risk to a third party (e.g., insurance).

C (Mitigation) Implementing security controls to reduce risk.

D (Avoidance) Eliminating the risk entirely (e.g., discontinuing a service).

Answer : B

Reimaging the device is the most effective way to eliminate persistent malware because some sophisticated malware, such as rootkits and firmware-level threats, can survive traditional scans and removals.

If a system keeps getting reinfected after cleaning, it may indicate a deeply embedded persistent threat, possibly in:

The Master Boot Record (MBR) or EFI firmware.

A compromised system restore point.

A hidden backdoor left by the malware.

Why Not Other Options?

A (Update and scan in safe mode) Might help, but if malware is persistent, it will likely return.

C (Upgrade OS) Does not necessarily remove malware; some malware survives OS upgrades.

D (Secondary scanner) Useful for detection but does not guarantee complete removal.

Best Practice:

Replace the hard drive to eliminate firmware-level infections.

Reimage the system from a known-good source.

Update the OS and security patches before reconnecting to the network.

Answer : D

D ('grnail.com') is a suspicious domain that resembles 'gmail.com.'

The high 'bytes out' value (525,984 bytes) indicates potential data exfiltration.

Attackers often use typosquatting (e.g., 'grnail.com' instead of 'gmail.com') to trick users into visiting malicious sites.

Why Not Other Options?

A (Netflix, B YouTube, C TikTok) Large downloads, but expected behavior for streaming sites.

E (Google Translate) Low data volume, no exfiltration risk.

F (Office.com) Microsoft service, no indication of malicious activity.

Answer : A

SOAR (Security Orchestration, Automation, and Response) platforms help automate and orchestrate incident response tasks, including phishing triage.

SOAR reduces triage time by automatically:

Parsing phishing emails (checking headers, links, attachments).

Running automated playbooks to check for known malicious indicators.

Escalating real threats while dismissing false positives.

Why Not Other Options?

B (Increase security awareness) Helps prevent phishing but does NOT reduce triage time.

C (Implement EDR) EDR is useful for endpoint protection but does NOT specifically reduce phishing triage time.

D (Install a 'Report Phishing' button) Helps report phishing but does NOT automate the triage process.

Answer : D, G

D (4: HTTPS traffic to an external IP - 5.29.1.5)

The log entry shows an internal system (172.16.1.30) communicating with an external IP (5.29.1.5) over TCP 443 (HTTPS) using Browser.exe.

HTTPS traffic to an unknown external IP could indicate data exfiltration, as attackers often use encrypted channels to disguise stolen data transfers.

G (7: FTP traffic to an external backup server - bank.backup.com)

The log entry indicates that an internal machine (172.16.1.25) is transferring data to bank.backup.com using FTP (port 21) and FileZilla.

FTP is a major concern because it is an outdated, unencrypted protocol that can be exploited for data exfiltration. If unauthorized, this could be a serious data breach.

Other Options:

A (ARP traffic) Not a concern (Just address resolution)

B (RPC Kerberos traffic) Normal for authentication

C (SMB traffic) Internal file sharing

**E (DNS traffic) Common, though could be exfiltration in some cases, but not in this log)

F (WUS traffic) Appears to be Windows Update Service traffic, likely legitimate

Answer : C

The discovery of unapproved accounts accessing shared data, along with data discrepancies, strongly indicates unauthorized changes.

Indicators of Unauthorized Changes:

Unexpected user permissions found during audits.

Modified or deleted data without proper documentation.

Altered system or security configurations, allowing unintended access.

Why Not Other Options?

A . Filesystem Anomaly: This refers to unexpected behavior in the file structure, such as corrupt metadata or missing files, rather than unauthorized user access.

B . Illegal Software: Would involve unlicensed or unauthorized applications, not unauthorized file modifications.

D . Data Exfiltration: If data was removed, it might be exfiltration, but in this case, data modifications were detected instead.

To prevent unauthorized changes, security teams should use:

File Integrity Monitoring (FIM) to detect unauthorized modifications.

Access control audits to verify correct user permissions.

SIEM tools to analyze logs for anomalies.

Answer : A

A CVSS 10 vulnerability represents a critical security risk, often leading to remote code execution or complete system compromise.

Option A (Shut down the asset) is the best immediate containment action for preventing exploitation.

Option B (Monitor patches) is important but should be done after containment.

Option C (Rescanning) is unnecessary when a high-confidence security advisory has been issued.

Option D (Forwarding advisory) is good practice but does not immediately mitigate the threat.