CYSA COMPREHENSIVE 2026 QUESTIONS AND
ANSWERS SURE A+
✔✔NIST recommends using six criteria to __________ a containment strategy: the
potential damage to resources, the need for evidence preservation, service availability,
time and resources required (including cost), effectiveness of the strategy, and duration
of the solution. - ✔✔evaluate
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔the potential damage to resources
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔the need for evidence preservation
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔service availability
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔time and resources required (including cost)
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔effectiveness of the strategy
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔duration of the solution
✔✔Alice is responding to a cybersecurity incident and notices a system that she
suspects is compromised. She places this system on a quarantine VLAN with limited
access to other networked systems. What containment strategy is Alice pursuing? -
✔✔segmentation
,✔✔Alice confers with other team members and decides that even allowing limited
access to other systems is an unacceptable risk and decides instead to prevent the
quarantine VLAN from accessing any other systems by putting firewall rules in place
that limit access to other enterprise systems. The attacker can still control the system to
allow Alice to continue monitoring the incident. What strategy is she pursuing? -
✔✔isolation
✔✔After observing the attacker, Alice decides to remove the Internet connection
entirely, leaving the systems running but inaccessible from outside the quarantine
VLAN. What strategy is she pursuing? - ✔✔removal
✔✔What tool may be used to isolate an attacker so that they may not cause damage to
production systems but may still be observed by cybersecurity analysts? - ✔✔sandbox
✔✔Tamara is a cybersecurity analyst for a private business that is suffering a security
breach. She believes the attackers have compromised a database containing sensitive
information. Which one of the following activities should be Tamara's first priority? -
✔✔containment
✔✔Which one of the following activities does CompTIA classify as part of the recovery
validation effort? - ✔✔scanning
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔patching
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔permissions
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔security scanning
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔verifying logging/communication to monitoring
✔✔Which one of the following pieces of information is most critical to conducting a solid
incident recovery effort? - ✔✔root cause of the attack
✔✔Understanding the root cause of an attack is critical to the ____________________.
Analysts should examine all available information to help reconstruct the attackers'
, actions. This information is crucial to remediating security controls and preventing future
similar attacks. - ✔✔incident recovery effort
✔✔Lynda is disposing of a drive containing sensitive information that was collected
during the response to a cybersecurity incident. The information is categorized as a high
security risk and she wishes to reuse the media during a future incident. What is the
appropriate disposition for this information? - ✔✔purge
✔✔In the NIST Guidelines for Media Sanitation, ____________________ applies
logical techniques to sanitize data in all user-addressable storage locations for
protection against simple non-invasive data recovery techniques. - ✔✔clear
✔✔In the NIST Guidelines for Media Sanitation, ____________________ applies
physical or logical techniques that render target data recovery infeasible using state-of-
the-art laboratory techniques. - ✔✔purge
✔✔In the NIST Guidelines for Media Sanitation, ____________________ renders data
recover infeasible using state-of-the-art laboratory techniques and results in the
subsequent inability to use the media for storage of data. - ✔✔destroy
✔✔In the NIST Guidelines for Media Sanitation, an example of clearing is typically
applied through: ______________. - ✔✔rewriting with a new value or using a menu
option to reset the device to the factory state
✔✔In the NIST Guidelines for Media Sanitation, an example of purging includes:
__________________. - ✔✔Degaussing, overwriting, block erase, and cryptographic
erase activities when performed through the use of dedicated, standardized device
commands
✔✔In the NIST Guidelines for Media Sanitation, an example of destroying
includes____________________. - ✔✔disintegration, pulverization, melting, and
incinerating
✔✔In the NIST Guidelines for Media Sanitation, if the security categorization is low and
it is not leaving the organization's control, it can be ____________________. -
✔✔cleared then validated
✔✔In the NIST Guidelines for Media Sanitation, if the security categorization is low and
it is leaving the organization's control, it should be ____________________. -
✔✔purged then validated
ANSWERS SURE A+
✔✔NIST recommends using six criteria to __________ a containment strategy: the
potential damage to resources, the need for evidence preservation, service availability,
time and resources required (including cost), effectiveness of the strategy, and duration
of the solution. - ✔✔evaluate
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔the potential damage to resources
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔the need for evidence preservation
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔service availability
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔time and resources required (including cost)
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔effectiveness of the strategy
✔✔Which choice is one of the six criteria NIST recommends to evaluate a containment
strategy? - ✔✔duration of the solution
✔✔Alice is responding to a cybersecurity incident and notices a system that she
suspects is compromised. She places this system on a quarantine VLAN with limited
access to other networked systems. What containment strategy is Alice pursuing? -
✔✔segmentation
,✔✔Alice confers with other team members and decides that even allowing limited
access to other systems is an unacceptable risk and decides instead to prevent the
quarantine VLAN from accessing any other systems by putting firewall rules in place
that limit access to other enterprise systems. The attacker can still control the system to
allow Alice to continue monitoring the incident. What strategy is she pursuing? -
✔✔isolation
✔✔After observing the attacker, Alice decides to remove the Internet connection
entirely, leaving the systems running but inaccessible from outside the quarantine
VLAN. What strategy is she pursuing? - ✔✔removal
✔✔What tool may be used to isolate an attacker so that they may not cause damage to
production systems but may still be observed by cybersecurity analysts? - ✔✔sandbox
✔✔Tamara is a cybersecurity analyst for a private business that is suffering a security
breach. She believes the attackers have compromised a database containing sensitive
information. Which one of the following activities should be Tamara's first priority? -
✔✔containment
✔✔Which one of the following activities does CompTIA classify as part of the recovery
validation effort? - ✔✔scanning
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔patching
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔permissions
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔security scanning
✔✔CompTIA includes ____________________ in the set of validation activities that
cybersecurity analysts should undertake in the aftermath of a security incident. -
✔✔verifying logging/communication to monitoring
✔✔Which one of the following pieces of information is most critical to conducting a solid
incident recovery effort? - ✔✔root cause of the attack
✔✔Understanding the root cause of an attack is critical to the ____________________.
Analysts should examine all available information to help reconstruct the attackers'
, actions. This information is crucial to remediating security controls and preventing future
similar attacks. - ✔✔incident recovery effort
✔✔Lynda is disposing of a drive containing sensitive information that was collected
during the response to a cybersecurity incident. The information is categorized as a high
security risk and she wishes to reuse the media during a future incident. What is the
appropriate disposition for this information? - ✔✔purge
✔✔In the NIST Guidelines for Media Sanitation, ____________________ applies
logical techniques to sanitize data in all user-addressable storage locations for
protection against simple non-invasive data recovery techniques. - ✔✔clear
✔✔In the NIST Guidelines for Media Sanitation, ____________________ applies
physical or logical techniques that render target data recovery infeasible using state-of-
the-art laboratory techniques. - ✔✔purge
✔✔In the NIST Guidelines for Media Sanitation, ____________________ renders data
recover infeasible using state-of-the-art laboratory techniques and results in the
subsequent inability to use the media for storage of data. - ✔✔destroy
✔✔In the NIST Guidelines for Media Sanitation, an example of clearing is typically
applied through: ______________. - ✔✔rewriting with a new value or using a menu
option to reset the device to the factory state
✔✔In the NIST Guidelines for Media Sanitation, an example of purging includes:
__________________. - ✔✔Degaussing, overwriting, block erase, and cryptographic
erase activities when performed through the use of dedicated, standardized device
commands
✔✔In the NIST Guidelines for Media Sanitation, an example of destroying
includes____________________. - ✔✔disintegration, pulverization, melting, and
incinerating
✔✔In the NIST Guidelines for Media Sanitation, if the security categorization is low and
it is not leaving the organization's control, it can be ____________________. -
✔✔cleared then validated
✔✔In the NIST Guidelines for Media Sanitation, if the security categorization is low and
it is leaving the organization's control, it should be ____________________. -
✔✔purged then validated
