CompTIA Cybersecurity Analyst (CySA+) Certification Exam (CS0-004) Free Practice Test

Question 1

An analyst performs Nmap scans to determine which hosts may need to be targeted to deploy a critical Windows patch. The patch for the vulnerability is to address a critical security flaw that targets open Server Message Block (SMB) ports on Windows systems only.
The analyst scans with the following command:

$sudo nmap -Pn 10.203.10.0/24
The analyst then receives the following output:
Which of the following hosts should the analyst prioritize for patching?

A. 10.203.10.11

B. 10.203.10.16

C. 10.203.10.13

D. 10.203.10.12

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Which of the following is the most difficult for threat actors to change according to the Pyramid of Pain model?

A. Domain names

B. Internet Protocol addresses

C. Tools

D. Tactics, techniques, and procedures

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A vulnerability analyst runs a credentialed vulnerability scan covering all addressable enterprise assets. After running the scan, the analyst discovers a large number of critical vulnerabilities that cannot be immediately remediated.
Which of the following are the most likely reasons why the vulnerabilities cannot be immediately addressed?

A. Lack of technical skills, the absence of a test environment, and the absence of an asset inventory

B. Physical access challenges, the absence of vendor support, and a lack of system documentation

C. Inaccurate asset inventory, a lack of system documentation, and an absence of authorization

D. Legacy and proprietary systems, a lack of patch availability, and vendor dependencies

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Which of the following network architectures would best implement a perimeter-less network topology?

A. Cloud-native computing

B. Content delivery networks

C. Hybrid cloud networks

D. Secure access service edge

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

An analyst reviews the following log entries:

Which of the following conclusions should the analyst reach? (Choose two.)

A. Host ws-57 delivered a phishing email via Simple Mail Transfer Protocol.

B. Host ws-57 is communicating on a service using a non-standard port.

C. Domain Controller dc-1 is performing a network scan against ws-57.

D. Host ws-57 is performing a network scan against dc-1.

E. Domain Controller dc-1 is communicating using a non-standard port.

F. Domain Controller dc-1 is infected with ransomware and initiating connections with ws-57.

Correct Answer: B,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

There is an alert coming from the security information and event management system.
Which of the following is the first task an analyst should complete?

A. Conduct remediation activities within the recovery phase.

B. Perform triage activities that will identify the risk.

C. Escalate the issue to the help desk team.

D. Contact the incident coordinator to communicate the vulnerability.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

A security analyst responds to an alert regarding identity and access management activity within the cloud environment. The attacker is currently trying to gain access from one isolated cloud subscription to another via a compromised user role.
Which of the following aspects of the MITRE ATT & CK framework is the attacker trying to perform?

A. Privilege escalation

B. Persistence

C. Execution

D. Lateral movement

E. Credential access

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

An analyst is configuring a security information and event management system to capture fileless malware execution events.
Which of the following log files requires additional configuration to accomplish this task?

A. Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

B. Microsoft-Windows-PowerShell/Operational

C. Microsoft-Windows-UserPnp/DeviceInstall

D. Microsoft-Windows-Crypto-DPAPI/Operational

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

A Chief Information Security Officer (CISO) evaluates a threat heat map and notices a substantial increase in custom scanning and enumeration activities. The CISO wants to gather as much information as possible about the activities targeting the company to help prioritize mitigations.
Which of the following solutions is the best way to accomplish this goal?

A. Implementing a web application firewall in front of all applications and having it log attacks

B. Configuring a honeypot in a separate environment to gather attacker techniques

C. Leveraging canary tokens on all production systems to detect valid intrusion attempts

D. Subscribing to information-sharing and threat intelligence reports for the industry

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

CompTIA Cybersecurity Analyst (CySA+) Certification (CS0-004) Free Practice Test