COMPTIA Cybersecurity Analyst (CySA+)
Examination Questions And Correct
Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant
Download Pdf
1. A security analyst notices multiple failed logins followed by a successful
login from a foreign IP. What is the MOST likely attack?
A. Brute force attack
B. Credential stuffing
C. Phishing attack
D. SQL injection
Rationale: Credential stuffing uses previously leaked username/password
combinations, often resulting in multiple failed attempts followed by a success.
The pattern of repeated failures and eventual success from a foreign IP strongly
indicates automated reuse of stolen credentials rather than brute force guessing
or application-layer injection attacks.
2. A SIEM alerts on abnormal outbound traffic to known malicious domains.
What should the analyst do FIRST?
A. Block all outbound traffic
B. Validate the alert and investigate the source host
C. Shut down the firewall
D. Format the affected system
,Rationale: The first step in incident response is validation. Analysts must confirm
whether the alert is true positive by identifying the host, process, and context
before taking disruptive containment actions like blocking traffic or shutting
down systems.
3. Which tool is MOST appropriate for analyzing packet-level network traffic?
A. SIEM
B. Vulnerability scanner
C. Wireshark
D. EDR platform
Rationale: Wireshark is a packet analysis tool that allows deep inspection of
network traffic. SIEM aggregates logs, EDR focuses on endpoints, and
vulnerability scanners identify weaknesses rather than analyzing live packet
flows.
4. A user receives an email with a fake login page link. What type of attack is
this?
A. Spoofing
B. Phishing
C. ARP poisoning
D. DDoS
Rationale: Phishing uses fraudulent emails and fake login pages to steal
credentials. It relies on social engineering rather than network-level
manipulation or denial-of-service techniques.
5. What is the PRIMARY purpose of threat intelligence?
A. Encrypt sensitive data
B. Replace antivirus software
, C. Provide actionable information about threats and adversaries
D. Eliminate the need for firewalls
Rationale: Threat intelligence provides contextual, actionable insights about
attackers, tactics, and indicators of compromise (IOCs) to improve defensive
posture. It does not replace security controls.
6. Which MITRE ATT&CK phase involves establishing persistence?
A. Reconnaissance
B. Initial Access
C. Execution
D. Persistence
Rationale: Persistence techniques ensure attackers maintain access after system
reboots or credential changes, such as scheduled tasks or registry modifications.
7. What is an Indicator of Compromise (IOC)?
A. Security policy document
B. Evidence suggesting malicious activity on a system
C. Firewall configuration file
D. Encryption algorithm
Rationale: IOCs include suspicious IPs, file hashes, or behaviors that indicate a
system has been compromised.
8. Which tool is BEST for endpoint detection and response?
A. Nmap
B. Snort
C. CrowdStrike Falcon
D. NetFlow analyzer
Examination Questions And Correct
Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant
Download Pdf
1. A security analyst notices multiple failed logins followed by a successful
login from a foreign IP. What is the MOST likely attack?
A. Brute force attack
B. Credential stuffing
C. Phishing attack
D. SQL injection
Rationale: Credential stuffing uses previously leaked username/password
combinations, often resulting in multiple failed attempts followed by a success.
The pattern of repeated failures and eventual success from a foreign IP strongly
indicates automated reuse of stolen credentials rather than brute force guessing
or application-layer injection attacks.
2. A SIEM alerts on abnormal outbound traffic to known malicious domains.
What should the analyst do FIRST?
A. Block all outbound traffic
B. Validate the alert and investigate the source host
C. Shut down the firewall
D. Format the affected system
,Rationale: The first step in incident response is validation. Analysts must confirm
whether the alert is true positive by identifying the host, process, and context
before taking disruptive containment actions like blocking traffic or shutting
down systems.
3. Which tool is MOST appropriate for analyzing packet-level network traffic?
A. SIEM
B. Vulnerability scanner
C. Wireshark
D. EDR platform
Rationale: Wireshark is a packet analysis tool that allows deep inspection of
network traffic. SIEM aggregates logs, EDR focuses on endpoints, and
vulnerability scanners identify weaknesses rather than analyzing live packet
flows.
4. A user receives an email with a fake login page link. What type of attack is
this?
A. Spoofing
B. Phishing
C. ARP poisoning
D. DDoS
Rationale: Phishing uses fraudulent emails and fake login pages to steal
credentials. It relies on social engineering rather than network-level
manipulation or denial-of-service techniques.
5. What is the PRIMARY purpose of threat intelligence?
A. Encrypt sensitive data
B. Replace antivirus software
, C. Provide actionable information about threats and adversaries
D. Eliminate the need for firewalls
Rationale: Threat intelligence provides contextual, actionable insights about
attackers, tactics, and indicators of compromise (IOCs) to improve defensive
posture. It does not replace security controls.
6. Which MITRE ATT&CK phase involves establishing persistence?
A. Reconnaissance
B. Initial Access
C. Execution
D. Persistence
Rationale: Persistence techniques ensure attackers maintain access after system
reboots or credential changes, such as scheduled tasks or registry modifications.
7. What is an Indicator of Compromise (IOC)?
A. Security policy document
B. Evidence suggesting malicious activity on a system
C. Firewall configuration file
D. Encryption algorithm
Rationale: IOCs include suspicious IPs, file hashes, or behaviors that indicate a
system has been compromised.
8. Which tool is BEST for endpoint detection and response?
A. Nmap
B. Snort
C. CrowdStrike Falcon
D. NetFlow analyzer
