COMPTIA CYSA+ CS0-002 CERTIFICATION
EXAM WITH QUESTIONS AND VERIFIED
ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A security analyst notices that a workstation is generating
thousands of outbound DNS queries to randomly generated domain
names. The domains are associated with recently registered
infrastructure, and the workstation's DNS requests occur at regular
intervals. Which activity is MOST likely occurring?
A. ARP poisoning
B. DNS tunneling
C. Password spraying
D. VLAN hopping
Answer: B. DNS tunneling
Rationale: DNS tunneling can encode command-and-control traffic or
stolen information within DNS queries. A high volume of requests to
randomly generated or suspicious domains, especially with periodic
communication, is a strong indicator of malware communicating with
a command-and-control infrastructure. ARP poisoning targets local
address resolution, password spraying targets authentication systems,
and VLAN hopping targets network segmentation.
2. A SOC analyst receives an alert indicating that a user account
successfully authenticated from Nairobi at 09:00 and then
successfully authenticated from New York at 09:05. The
1
,organization knows the user could not physically travel between
these locations in five minutes. What type of indicator is this?
A. Impossible travel
B. Port scanning
C. Data exfiltration
D. Privilege escalation
Answer: A. Impossible travel
Rationale: Impossible-travel detection identifies authentication events
from geographically distant locations within a timeframe that makes
legitimate physical travel impossible. This can indicate credential theft,
session hijacking, VPN abuse, or compromised accounts. The analyst
should correlate the events with VPN logs, endpoint telemetry,
authentication records, and device information.
3. A vulnerability scanner identifies a critical vulnerability on an
Internet-facing web server. The vulnerability has a CVSS score of
9.8, but the server is protected by multiple compensating controls
and is not currently exploitable from the Internet. What should the
analyst consider when prioritizing remediation?
A. Only the CVSS score
B. Asset criticality and exploitability in the organization's environment
C. The age of the operating system
D. The number of users logged into the server
Answer: B. Asset criticality and exploitability in the organization's
environment
Rationale: Vulnerability prioritization should consider more than the
base CVSS score. Asset criticality, business impact, exploit availability,
exposure, compensating controls, threat intelligence, and exploitability
2
,should influence remediation priority. A high CVSS score alone does
not necessarily mean it is the organization's most urgent vulnerability.
4. A security analyst wants to determine whether an endpoint
communicated with a known malicious IP address during the
previous 30 days. Which data source would be MOST useful?
A. DHCP lease logs
B. Firewall or network flow logs
C. Employee payroll records
D. Printer configuration files
Answer: B. Firewall or network flow logs
Rationale: Firewall and network-flow data can reveal source and
destination IP addresses, ports, protocols, timestamps, and connection
behavior. This allows an analyst to determine whether an endpoint
communicated with a known malicious IP. DHCP logs can help
associate an IP address with a device, but they generally do not
establish the actual communication.
5. A SOC analyst observes the following command executed by a
suspicious process:
powershell.exe -enc <encoded_data>
Why should this activity receive additional investigation?
A. PowerShell cannot communicate over a network
B. Encoded PowerShell commands can conceal malicious instructions
C. PowerShell is exclusively used for system administration
D. Encoding always means encryption
Answer: B. Encoded PowerShell commands can conceal malicious
instructions
3
, Rationale: Attackers frequently abuse PowerShell because it provides
powerful native Windows capabilities. The -enc or -EncodedCommand
option allows commands to be represented in Base64, which can make
malicious commands less obvious in logs. Encoding is not encryption
and does not inherently make the content secure.
6. An organization discovers that an employee clicked a phishing
link. The endpoint has potentially executed malicious code. What
should the SOC analyst do FIRST?
A. Immediately delete all endpoint logs
B. Determine whether compromise occurred and initiate appropriate
containment procedures
C. Reinstall every computer in the organization
D. Publicly disclose the incident
Answer: B. Determine whether compromise occurred and initiate
appropriate containment procedures
Rationale: The analyst should establish whether the endpoint was
compromised and, if necessary, contain the affected system to prevent
further damage. Evidence such as process execution, browser history,
DNS activity, network connections, authentication logs, and endpoint
telemetry should be preserved. Immediate destruction or alteration of
evidence can interfere with investigation and incident response.
7. A security team wants to identify abnormal authentication
patterns across the enterprise. Which solution would BEST support
centralized correlation of authentication events from multiple
systems?
A. SIEM
B. UPS
4
EXAM WITH QUESTIONS AND VERIFIED
ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A security analyst notices that a workstation is generating
thousands of outbound DNS queries to randomly generated domain
names. The domains are associated with recently registered
infrastructure, and the workstation's DNS requests occur at regular
intervals. Which activity is MOST likely occurring?
A. ARP poisoning
B. DNS tunneling
C. Password spraying
D. VLAN hopping
Answer: B. DNS tunneling
Rationale: DNS tunneling can encode command-and-control traffic or
stolen information within DNS queries. A high volume of requests to
randomly generated or suspicious domains, especially with periodic
communication, is a strong indicator of malware communicating with
a command-and-control infrastructure. ARP poisoning targets local
address resolution, password spraying targets authentication systems,
and VLAN hopping targets network segmentation.
2. A SOC analyst receives an alert indicating that a user account
successfully authenticated from Nairobi at 09:00 and then
successfully authenticated from New York at 09:05. The
1
,organization knows the user could not physically travel between
these locations in five minutes. What type of indicator is this?
A. Impossible travel
B. Port scanning
C. Data exfiltration
D. Privilege escalation
Answer: A. Impossible travel
Rationale: Impossible-travel detection identifies authentication events
from geographically distant locations within a timeframe that makes
legitimate physical travel impossible. This can indicate credential theft,
session hijacking, VPN abuse, or compromised accounts. The analyst
should correlate the events with VPN logs, endpoint telemetry,
authentication records, and device information.
3. A vulnerability scanner identifies a critical vulnerability on an
Internet-facing web server. The vulnerability has a CVSS score of
9.8, but the server is protected by multiple compensating controls
and is not currently exploitable from the Internet. What should the
analyst consider when prioritizing remediation?
A. Only the CVSS score
B. Asset criticality and exploitability in the organization's environment
C. The age of the operating system
D. The number of users logged into the server
Answer: B. Asset criticality and exploitability in the organization's
environment
Rationale: Vulnerability prioritization should consider more than the
base CVSS score. Asset criticality, business impact, exploit availability,
exposure, compensating controls, threat intelligence, and exploitability
2
,should influence remediation priority. A high CVSS score alone does
not necessarily mean it is the organization's most urgent vulnerability.
4. A security analyst wants to determine whether an endpoint
communicated with a known malicious IP address during the
previous 30 days. Which data source would be MOST useful?
A. DHCP lease logs
B. Firewall or network flow logs
C. Employee payroll records
D. Printer configuration files
Answer: B. Firewall or network flow logs
Rationale: Firewall and network-flow data can reveal source and
destination IP addresses, ports, protocols, timestamps, and connection
behavior. This allows an analyst to determine whether an endpoint
communicated with a known malicious IP. DHCP logs can help
associate an IP address with a device, but they generally do not
establish the actual communication.
5. A SOC analyst observes the following command executed by a
suspicious process:
powershell.exe -enc <encoded_data>
Why should this activity receive additional investigation?
A. PowerShell cannot communicate over a network
B. Encoded PowerShell commands can conceal malicious instructions
C. PowerShell is exclusively used for system administration
D. Encoding always means encryption
Answer: B. Encoded PowerShell commands can conceal malicious
instructions
3
, Rationale: Attackers frequently abuse PowerShell because it provides
powerful native Windows capabilities. The -enc or -EncodedCommand
option allows commands to be represented in Base64, which can make
malicious commands less obvious in logs. Encoding is not encryption
and does not inherently make the content secure.
6. An organization discovers that an employee clicked a phishing
link. The endpoint has potentially executed malicious code. What
should the SOC analyst do FIRST?
A. Immediately delete all endpoint logs
B. Determine whether compromise occurred and initiate appropriate
containment procedures
C. Reinstall every computer in the organization
D. Publicly disclose the incident
Answer: B. Determine whether compromise occurred and initiate
appropriate containment procedures
Rationale: The analyst should establish whether the endpoint was
compromised and, if necessary, contain the affected system to prevent
further damage. Evidence such as process execution, browser history,
DNS activity, network connections, authentication logs, and endpoint
telemetry should be preserved. Immediate destruction or alteration of
evidence can interfere with investigation and incident response.
7. A security team wants to identify abnormal authentication
patterns across the enterprise. Which solution would BEST support
centralized correlation of authentication events from multiple
systems?
A. SIEM
B. UPS
4
