COMPTIA SECURITY ANALYTICS PROFESSIONAL CERTIFICATION EXAM WITH QUESTIONS AND VERIFIED ANSWERS, PLUS DETAILED RATIONALES/EXPERT VERIFIED FOR GUARANTEED PASS 2026/LATEST UPDATE/INSTANT DOWNLOAD PDF

COMPTIA SECURITY ANALYTICS
PROFESSIONAL CERTIFICATION EXAM
WITH QUESTIONS AND VERIFIED
ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. SIEM Data Correlation
A security analyst notices that a workstation generated a successful
PowerShell process execution event, followed three minutes later by a
new outbound connection to an unfamiliar external IP address. Five
minutes later, the same workstation generated an unusual archive-
creation event. Individually, none of these events violates a security
policy. What is the PRIMARY advantage of correlating these events
within a SIEM?
A. It eliminates the need for endpoint security controls
B. It transforms isolated events into a potentially meaningful attack
sequence
C. It guarantees that the workstation has been compromised
D. It automatically determines the attacker's identity
Answer: B. It transforms isolated events into a potentially
meaningful attack sequence
Rationale: Correlation allows analysts to connect events occurring
across time and systems into a larger behavioral pattern. PowerShell
execution, unusual outbound communication, and archive creation
could collectively indicate post-compromise activity or data staging.
Correlation does not prove compromise by itself, but it significantly
improves analytical context and detection capability.

1

,2. Baseline Analysis
An organization establishes that employees normally authenticate
between 07:00 and 19:00 from corporate networks. An account suddenly
authenticates successfully at 03:15 from an unfamiliar geographic region
and immediately accesses sensitive financial records. Which analytical
technique would BEST identify the significance of this activity?
A. Signature matching
B. Behavioral baseline analysis
C. Packet fragmentation analysis
D. Static malware analysis
Answer: B. Behavioral baseline analysis
Rationale: Baseline analysis establishes what normal activity looks
like and identifies deviations from that behavior. The unusual
authentication time, geographic origin, and sensitive-data access
create a behavioral anomaly. This approach is particularly valuable
for detecting compromised credentials because legitimate credentials
may otherwise pass traditional authentication checks.


3. False Positives
A newly deployed SIEM rule generates 12,000 alerts per day. After
investigation, analysts determine that 11,700 alerts represent legitimate
administrative activity. Which problem is MOST clearly demonstrated?
A. Insufficient encryption
B. Excessive false positives
C. Insufficient log retention
D. Data exfiltration
Answer: B. Excessive false positives

2

,Rationale: A false positive occurs when a detection mechanism
identifies legitimate activity as malicious. Excessive false positives
create alert fatigue, consume analyst resources, and can cause
genuine incidents to be overlooked. The rule should be tuned using
contextual conditions, exclusions, thresholds, asset criticality, and
other relevant telemetry.


4. Alert Prioritization
A SIEM produces four alerts:
 A failed login against a low-value test account
 Malware detected on a public web server
 A successful privileged login from an unusual country
 A blocked connection to a known malicious IP from an isolated
laboratory machine
Which alert should generally receive the HIGHEST investigative
priority?
A. Failed login against the test account
B. Malware detection on the public web server
C. Privileged login from the unusual country
D. Blocked connection from the laboratory machine
Answer: C. Privileged login from the unusual country
Rationale: A successful privileged authentication from an unusual
location has potentially severe implications because it could represent
account compromise and unauthorized administrative access. Analysts
should consider both likelihood and impact. Asset criticality, privilege
level, geographic anomaly, authentication context, and subsequent
activity can all raise the priority.


3

, 5. Log Normalization
A security team receives authentication logs from Windows servers,
Linux servers, cloud applications, and network appliances. Each
platform uses different field names and timestamp formats. What is the
PRIMARY purpose of log normalization?
A. To delete duplicate events
B. To convert heterogeneous events into a consistent analytical structure
C. To encrypt all security logs
D. To reduce the number of security controls
Answer: B. To convert heterogeneous events into a consistent
analytical structure
Rationale: Normalization maps different log formats into common
fields such as username, source IP, destination IP, timestamp, event
type, and action. This allows correlation and searches to operate
consistently across different technologies. Without normalization,
analysts would have to create separate logic for every log source and
format.


6. Threat Hunting
A threat hunter suspects that attackers may be using legitimate
administrative tools to move laterally through an environment. No
existing alert has confirmed the activity. Which approach BEST
represents threat hunting?
A. Waiting until antivirus generates an alert
B. Proactively searching telemetry for suspicious administrative
behavior
C. Disabling all administrative tools
D. Reviewing only firewall-denied connections
4