Free CySA+ CS0-003 Practice Test

12 free CySA+ practice questions

1. Q1Security Operations

   Question 1. After a peer company reports an intrusion that persisted through scheduled tasks, a hunt team wants to check its own finance workstations. Before it queries any EDR telemetry, what should the team define FIRST?

   1. AAn isolation plan that disconnects every finance workstation during the hunt
   2. BA blocklist built from the file hashes published in the peer company's report
   3. CA testable hypothesis mapped to an ATT&CK technique and the data needed to test it
   4. DAn authenticated vulnerability scan schedule covering all finance endpoints

   Show the answer

   Correct answer: C. A testable hypothesis mapped to an ATT&CK technique and the data needed to test it

   Structured threat hunting starts with a hypothesis, here mapped to the ATT&CK scheduled task technique, that names the telemetry needed to prove or disprove it. Blocking the peer's hashes only catches that exact sample and is not a hunt.

2. Q2Vulnerability Management

   Question 2. Only one fix fits this week's change window. Flaw A: CVSS 9.8, EPSS 0.02, not in CISA KEV, on an isolated lab host. Flaw B: CVSS 7.5, EPSS 0.91, listed in CISA KEV, on the internet-facing VPN gateway. Which should be remediated first?

   1. AFlaw B, because known exploitation and internet exposure outweigh the higher base score of Flaw A
   2. BFlaw A, because the highest CVSS base score must always be remediated first
   3. CFlaw A, because EPSS only records past attacks and says nothing about future exploitation
   4. DNeither; both should wait until a full-environment rescan confirms the findings

   Show the answer

   Correct answer: A. Flaw B, because known exploitation and internet exposure outweigh the higher base score of Flaw A

   KEV listing confirms active exploitation, a high EPSS predicts likely exploitation, and the asset is exposed to the internet, so Flaw B carries more real risk. CVSS base scores measure severity, not likelihood or asset context, so ranking by base score alone misprioritizes.

3. Q3Incident Response and Management

   Question 3. An EDR console shows one workstation encrypting files on a mapped departmental share, and new SMB sessions from that host to other servers are appearing. Which action should the responder take FIRST?

   1. AReimage the workstation from the approved gold image
   2. BRestore the departmental share from last night's backup
   3. CSchedule a lessons-learned meeting with the affected department
   4. DIsolate the workstation from the network through the EDR agent

   Show the answer

   Correct answer: D. Isolate the workstation from the network through the EDR agent

   Containment comes before eradication and recovery: EDR network isolation stops further encryption and lateral movement while the host stays powered on, preserving volatile evidence. Restoring the share now would simply let the still-active host encrypt the restored data.

4. Q4Reporting and Communication

   Question 4. A CISO wants a single metric showing how long intrusions go unnoticed, measured from the start of malicious activity until the SOC first identifies it. Which metric should the SOC report?

   1. AMean time to respond (MTTR)
   2. BMean time to detect (MTTD)
   3. CPatch compliance rate per business unit
   4. DAlerts closed per analyst per shift

   Show the answer

   Correct answer: B. Mean time to detect (MTTD)

   MTTD measures the gap between when an incident begins and when it is detected, which is exactly what the CISO asked for. MTTR starts after detection and tracks how quickly the team responds or resolves the incident.

5. Q5Security Operations

   Question 5. A new EDR detection fires whenever winword.exe launches powershell.exe with an -EncodedCommand argument, no matter which file hash, domain or IP address is involved. How is this detection BEST classified?

   1. AAn indicator of compromise built on atomic artifacts
   2. BAn indicator of attack based on adversary behavior
   3. CA signature match against a known malware hash
   4. DA finding from a credentialed vulnerability scan

   Show the answer

   Correct answer: B. An indicator of attack based on adversary behavior

   The rule keys on a suspicious behavior chain (an Office app spawning encoded PowerShell), which makes it an indicator of attack. An IoC relies on specific artifacts such as hashes or IPs, which this rule deliberately ignores.

6. Q6Vulnerability Management

   Question 6. A wireless controller flaw is scored with Attack Vector Adjacent, Privileges Required Low and Scope Changed. A facilities manager asks who could realistically abuse it and how far the damage could spread. Which answer is accurate?

   1. AAnyone on the internet can exploit it without an account
   2. BThe attacker needs physical hands-on access to the controller
   3. CExploitation is trivial and any damage stays inside the controller itself
   4. DSomeone on the same segment with a basic account, with impact beyond the controller

   Show the answer

   Correct answer: D. Someone on the same segment with a basic account, with impact beyond the controller

   AV:A means the attacker must be on an adjacent network, PR:L requires a low-privilege account, and S:C means impact crosses into components beyond the vulnerable one. Internet-wide, unauthenticated exploitation would instead be AV:N with PR:N.

7. Q7Incident Response and Management

   Question 7. An intel analyst tags each event with who operated it, the tooling used, the servers that relayed it and who was hit. Pivoting on a shared relay server then surfaces a second campaign against payroll staff. Which analytic model is in use?

   1. AThe Diamond Model of Intrusion Analysis
   2. BThe Lockheed Martin Cyber Kill Chain
   3. CThe OWASP Top 10
   4. DThe NIST Cybersecurity Framework implementation tiers

   Show the answer

   Correct answer: A. The Diamond Model of Intrusion Analysis

   The Diamond Model links adversary, infrastructure, capability and victim, and analysts pivot across those vertices to connect related activity. The Cyber Kill Chain orders intrusion phases in sequence instead of relating these four features.

8. Q8Reporting and Communication

   Question 8. Several sales reps had their mailboxes hijacked, and the response is on day two. Their VP, who has no security background, asks the incident lead what is going on. What should the reply contain?

   1. AThe EDR process tree and command lines captured from each affected laptop
   2. BEvery hash, domain and IP gathered so far, formatted for firewall import
   3. CPlain-language impact, current actions, what sales staff must do, and next update time
   4. DThe correlation rule logic the SIEM used to raise the first alert

   Show the answer

   Correct answer: C. Plain-language impact, current actions, what sales staff must do, and next update time

   A business stakeholder needs to know the impact on their team, what is being done, what their people must do and when to expect the next update. IoC lists and process trees serve technical responders, not a department head.

9. Q9Security Operations

   Question 9. SIEM query results for the last 10 minutes: 312 event ID 4625 failures, each against a different username, one attempt per account, all from 203.0.113.44. No account locked out. Which activity BEST explains this pattern?

   1. APass-the-hash using a stolen NTLM hash
   2. BKerberoasting of service account tickets
   3. CBrute forcing a single privileged account
   4. DPassword spraying across many accounts

   Show the answer

   Correct answer: D. Password spraying across many accounts

   One source trying a single attempt against hundreds of usernames stays under lockout thresholds, the signature of password spraying. A brute force attack would show many attempts against one account and would likely trigger lockouts.

10. Q10Vulnerability Management

    Question 10. A critical flaw is disclosed in a widely used open-source compression library. The security team must quickly identify which in-house applications ship the library, including as a transitive dependency. Which resource is MOST useful?

    1. ANetwork scan results from an unauthenticated port sweep
    2. BA software bill of materials (SBOM) for each application
    3. CThe DHCP lease table for the data center
    4. DThe perimeter firewall rule base

    Show the answer

    Correct answer: B. A software bill of materials (SBOM) for each application

    An SBOM lists every component in a build, including nested dependencies, so affected applications can be found without rescanning. An unauthenticated port sweep cannot see which libraries an application bundles.

11. Q11Incident Response and Management

    Question 11. A responder is at a live Linux web host believed to run an in-memory implant that leaves nothing on disk. Before the host is shut down, which acquisition takes priority under the order of volatility?

    1. AA capture of system RAM
    2. BA forensic image of the system disk
    3. CLast month's backup tapes for the server
    4. DFirewall logs already forwarded to the SIEM

    Show the answer

    Correct answer: A. A capture of system RAM

    Memory is the most volatile source here and is where fileless malware lives, so it must be captured before anything else. The disk image matters too but survives a reboot, while RAM contents are lost.

12. Q12Security Operations

    Question 12. SOC analysts spend about 15 minutes on each user-reported phishing email, pulling out URLs, checking their reputation and searching other mailboxes for copies. Which change BEST cuts this effort while keeping an analyst in the decision loop?

    1. AExtend SIEM log retention from 90 days to one year
    2. BDeploy a honeypot mailbox to attract more phishing messages
    3. CA SOAR playbook that automates enrichment and search, with analyst approval to purge
    4. DRemove the report-phishing button to lower the ticket volume

    Show the answer

    Correct answer: C. A SOAR playbook that automates enrichment and search, with analyst approval to purge

    A SOAR playbook automates the repetitive enrichment and search steps and holds the destructive purge for analyst approval. Longer log retention does nothing to speed up the manual triage work.