PRA C TI C E E X A MI N ATI O N | C Y B E RSE C U RI TY A N A LY ST
COMPTIA CYSA+
(CS0-003) EXAM
85 exam-aligned questions with verified answers and
detailed rationales covering Security Operations,
Vulnerability Management, Incident Response and
Management, and Reporting and Communication -
including 15 performance-based tasks, 15 priority-
setting scenarios, and 10 tool identification items.
Cybersecurity Analyst Certification Series
Aligned to CS0-003 Exam Objectives and DoD 8140 Approved Standards
2026/ 2027 ED I TI ON | VERI FI ED ANSWERS I NC L UD ED
,CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition - Practice Exam Questions and Verified Answers
CYBERSECURITY ANALYST | CERTIFICATION PRACTICE EXAMINATION
COMPTIA CYSA+ (CS0-003) EXAM
2026/2027 EDITION
PRACTICE EXAM QUESTIONS AND VERIFIED ANSWERS (MULTIPLE-CHOICE &
PERFORMANCE-BASED | COMPLETE ANSWER KEY & RATIONALES)
Aligned with CompTIA CySA+ CS0-003 Exam Objectives, Cybersecurity Analyst Job Roles, and DoD 8140 Approved
Standards (2026/2027 Edition).
85 Questions | Security Operations 33% | Vulnerability Management 30% | Incident Response and Management
20% | Reporting and Communication 17% | 15 Performance-Based | 15 Priority-Setting | 10 Tool Identification
Section 1: Security Operations
Questions 1-28 | SIEM operations, network analysis, threat intelligence, malicious activity indicators, threat hunting,
tools and techniques, process improvement, and applied frameworks | Exam weight 33%
Q1. A SOC analyst is prioritizing log sources for onboarding into a newly deployed SIEM. The
team wants the fastest improvement in detecting credential-based attacks such as brute force and
password spraying. Which log source should be onboarded first?
A. Printer and spooler service logs
B. Windows Security event logs containing logon events (4624/4625) [CORRECT]
C. Workstation CPU and memory performance counters
D. Wireless access point signal strength telemetry
Correct Answer: B
Rationale: Authentication event logs directly capture successful and failed logons, enabling the
correlation rules used against brute force and password spraying, which reflects CS0-003 objective 1.1 on
log ingestion and 1.3 on SIEM analysis. Printer logs, performance counters, and RF telemetry contribute
little direct evidence of credential abuse and are lower priority in an aggregation strategy.
Q2. A security operations center wants a SIEM correlation rule that fires when a password
spraying campaign is underway against the domain. Which logic best matches this attack
pattern?
A. Five hundred failed logons for a single account from one host
B. A successful privileged logon occurring outside business hours
C. Repeated outbound TLS connections to a known-bad IP address
D. Multiple failed logons across many distinct usernames from one source host within ten
minutes [CORRECT]
Independent practice material aligned to published exam objectives. Not affiliated with or endorsed by CompTIA, Inc. 1
,CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition - Practice Exam Questions and Verified Answers
Correct Answer: D
Rationale: Password spraying tries a small number of common passwords against many accounts, so the
signature is few failures per account spread across many usernames from a single source, consistent with
objective 1.2. Option A describes classic single-account brute force, while B and C indicate unrelated
behaviors such as off-hours administration and command and control.
Q3. During the Monday morning shift, an analyst faces four open alerts. Which alert should be
triaged first?
A. EDR alert showing PowerShell accessing lsass.exe memory on a domain
controller [CORRECT]
B. Antivirus quarantining an EICAR test file on a training workstation
C. One failed VPN logon for a single service account
D. The patch management server reporting that it is offline
Correct Answer: A
Rationale: Credential dumping from lsass.exe on a domain controller is a high-confidence indicator of
active privilege escalation and potential domain compromise, so it carries the highest impact and urgency
under objectives 1.2 and 3.2. The EICAR file is a harmless test artifact, a single failed logon is routine
noise, and the offline patch server is an operational issue rather than an active attack.
Q4. A SOC analyst needs a SIEM search that counts failed Windows logon events per user
account over the last 24 hours and returns only accounts with more than ten failures. Which
query is correct?
index=main sourcetype=win:security earliest=-24h
| search EventCode=4625
| stats count by user
| where count > 10
A. index=main EventCode=4624 | stats count by user
B. index=main sourcetype=win:security EventCode=4625 | top limit=20 user
C. index=main sourcetype=win:security EventCode=4625 | stats count by user | where
count > 10 [CORRECT]
D. index=main sourcetype=win:security EventCode=4625 | table user, EventCode
Correct Answer: C
Rationale: EventCode 4625 identifies failed logons, stats count by user aggregates per account, and the
where clause enforces the threshold, matching the requirement for objective 1.3 query writing. Option A
uses the successful logon code, B returns a popularity list without thresholding, and D lists raw rows
without aggregation.
Q5. A SOC manager asks for a dashboard that communicates detection performance to
executives each quarter. Which element fits an executive security operations dashboard best?
A. Full packet payloads exported from the IDS sensor
Independent practice material aligned to published exam objectives. Not affiliated with or endorsed by CompTIA, Inc. 2
, CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition - Practice Exam Questions and Verified Answers
B. Mean time to detect and mean time to respond, trended over 90 days [CORRECT]
C. The current contents of the firewall session table
D. A live feed of every SIEM alert ordered by arrival time
Correct Answer: B
Rationale: Executives need aggregated KPIs such as MTTD and MTTR trends to judge program
effectiveness over time, which aligns with SIEM dashboarding under objective 1.3 and reporting under
objective 4.1. Raw payloads, session tables, and unfiltered alert feeds are operational artifacts that
obscure rather than summarize performance.
Q6. A SIEM rule that alerts on outbound SSH from any production server generates 300
false-positive alerts per day from a documented administration jump host. Which tuning action
best preserves detection coverage while reducing noise?
A. Disable the rule until the alert volume decreases
B. Increase the rule severity to critical so it receives faster attention
C. Leave the rule unchanged and accept the alert volume
D. Scope the rule to suppress the documented jump host range while alerting on all other
sources [CORRECT]
Correct Answer: D
Rationale: Effective tuning applies environmental context such as asset ownership and documented
administrative workflows to suppress known-good behavior while retaining visibility everywhere else, per
objective 1.3 rule tuning. Disabling or ignoring the rule eliminates coverage, and raising severity only
amplifies analyst fatigue.
Q7. An analyst is reviewing a packet capture in Wireshark and needs a display filter that shows
only HTTP traffic exchanged with the web server at 10.2.2.15. Which filter should be used?
A. tcp.port eq 80 and host 10.2.2.15
B. ip.addr == 10.2.2.15 && http [CORRECT]
C. http.request contains 10.2.2.15
D. port 80 host 10.2.2.15
Correct Answer: B
Rationale: The display filter syntax combines ip.addr == 10.2.2.15 with the http protocol qualifier,
restricting the view to that host's HTTP traffic under objective 1.3 packet analysis. Options A and D mix
Berkeley Packet Filter capture syntax into the display filter bar, and C searches payload content for a text
string rather than filtering by endpoint.
Independent practice material aligned to published exam objectives. Not affiliated with or endorsed by CompTIA, Inc. 3
COMPTIA CYSA+
(CS0-003) EXAM
85 exam-aligned questions with verified answers and
detailed rationales covering Security Operations,
Vulnerability Management, Incident Response and
Management, and Reporting and Communication -
including 15 performance-based tasks, 15 priority-
setting scenarios, and 10 tool identification items.
Cybersecurity Analyst Certification Series
Aligned to CS0-003 Exam Objectives and DoD 8140 Approved Standards
2026/ 2027 ED I TI ON | VERI FI ED ANSWERS I NC L UD ED
,CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition - Practice Exam Questions and Verified Answers
CYBERSECURITY ANALYST | CERTIFICATION PRACTICE EXAMINATION
COMPTIA CYSA+ (CS0-003) EXAM
2026/2027 EDITION
PRACTICE EXAM QUESTIONS AND VERIFIED ANSWERS (MULTIPLE-CHOICE &
PERFORMANCE-BASED | COMPLETE ANSWER KEY & RATIONALES)
Aligned with CompTIA CySA+ CS0-003 Exam Objectives, Cybersecurity Analyst Job Roles, and DoD 8140 Approved
Standards (2026/2027 Edition).
85 Questions | Security Operations 33% | Vulnerability Management 30% | Incident Response and Management
20% | Reporting and Communication 17% | 15 Performance-Based | 15 Priority-Setting | 10 Tool Identification
Section 1: Security Operations
Questions 1-28 | SIEM operations, network analysis, threat intelligence, malicious activity indicators, threat hunting,
tools and techniques, process improvement, and applied frameworks | Exam weight 33%
Q1. A SOC analyst is prioritizing log sources for onboarding into a newly deployed SIEM. The
team wants the fastest improvement in detecting credential-based attacks such as brute force and
password spraying. Which log source should be onboarded first?
A. Printer and spooler service logs
B. Windows Security event logs containing logon events (4624/4625) [CORRECT]
C. Workstation CPU and memory performance counters
D. Wireless access point signal strength telemetry
Correct Answer: B
Rationale: Authentication event logs directly capture successful and failed logons, enabling the
correlation rules used against brute force and password spraying, which reflects CS0-003 objective 1.1 on
log ingestion and 1.3 on SIEM analysis. Printer logs, performance counters, and RF telemetry contribute
little direct evidence of credential abuse and are lower priority in an aggregation strategy.
Q2. A security operations center wants a SIEM correlation rule that fires when a password
spraying campaign is underway against the domain. Which logic best matches this attack
pattern?
A. Five hundred failed logons for a single account from one host
B. A successful privileged logon occurring outside business hours
C. Repeated outbound TLS connections to a known-bad IP address
D. Multiple failed logons across many distinct usernames from one source host within ten
minutes [CORRECT]
Independent practice material aligned to published exam objectives. Not affiliated with or endorsed by CompTIA, Inc. 1
,CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition - Practice Exam Questions and Verified Answers
Correct Answer: D
Rationale: Password spraying tries a small number of common passwords against many accounts, so the
signature is few failures per account spread across many usernames from a single source, consistent with
objective 1.2. Option A describes classic single-account brute force, while B and C indicate unrelated
behaviors such as off-hours administration and command and control.
Q3. During the Monday morning shift, an analyst faces four open alerts. Which alert should be
triaged first?
A. EDR alert showing PowerShell accessing lsass.exe memory on a domain
controller [CORRECT]
B. Antivirus quarantining an EICAR test file on a training workstation
C. One failed VPN logon for a single service account
D. The patch management server reporting that it is offline
Correct Answer: A
Rationale: Credential dumping from lsass.exe on a domain controller is a high-confidence indicator of
active privilege escalation and potential domain compromise, so it carries the highest impact and urgency
under objectives 1.2 and 3.2. The EICAR file is a harmless test artifact, a single failed logon is routine
noise, and the offline patch server is an operational issue rather than an active attack.
Q4. A SOC analyst needs a SIEM search that counts failed Windows logon events per user
account over the last 24 hours and returns only accounts with more than ten failures. Which
query is correct?
index=main sourcetype=win:security earliest=-24h
| search EventCode=4625
| stats count by user
| where count > 10
A. index=main EventCode=4624 | stats count by user
B. index=main sourcetype=win:security EventCode=4625 | top limit=20 user
C. index=main sourcetype=win:security EventCode=4625 | stats count by user | where
count > 10 [CORRECT]
D. index=main sourcetype=win:security EventCode=4625 | table user, EventCode
Correct Answer: C
Rationale: EventCode 4625 identifies failed logons, stats count by user aggregates per account, and the
where clause enforces the threshold, matching the requirement for objective 1.3 query writing. Option A
uses the successful logon code, B returns a popularity list without thresholding, and D lists raw rows
without aggregation.
Q5. A SOC manager asks for a dashboard that communicates detection performance to
executives each quarter. Which element fits an executive security operations dashboard best?
A. Full packet payloads exported from the IDS sensor
Independent practice material aligned to published exam objectives. Not affiliated with or endorsed by CompTIA, Inc. 2
, CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition - Practice Exam Questions and Verified Answers
B. Mean time to detect and mean time to respond, trended over 90 days [CORRECT]
C. The current contents of the firewall session table
D. A live feed of every SIEM alert ordered by arrival time
Correct Answer: B
Rationale: Executives need aggregated KPIs such as MTTD and MTTR trends to judge program
effectiveness over time, which aligns with SIEM dashboarding under objective 1.3 and reporting under
objective 4.1. Raw payloads, session tables, and unfiltered alert feeds are operational artifacts that
obscure rather than summarize performance.
Q6. A SIEM rule that alerts on outbound SSH from any production server generates 300
false-positive alerts per day from a documented administration jump host. Which tuning action
best preserves detection coverage while reducing noise?
A. Disable the rule until the alert volume decreases
B. Increase the rule severity to critical so it receives faster attention
C. Leave the rule unchanged and accept the alert volume
D. Scope the rule to suppress the documented jump host range while alerting on all other
sources [CORRECT]
Correct Answer: D
Rationale: Effective tuning applies environmental context such as asset ownership and documented
administrative workflows to suppress known-good behavior while retaining visibility everywhere else, per
objective 1.3 rule tuning. Disabling or ignoring the rule eliminates coverage, and raising severity only
amplifies analyst fatigue.
Q7. An analyst is reviewing a packet capture in Wireshark and needs a display filter that shows
only HTTP traffic exchanged with the web server at 10.2.2.15. Which filter should be used?
A. tcp.port eq 80 and host 10.2.2.15
B. ip.addr == 10.2.2.15 && http [CORRECT]
C. http.request contains 10.2.2.15
D. port 80 host 10.2.2.15
Correct Answer: B
Rationale: The display filter syntax combines ip.addr == 10.2.2.15 with the http protocol qualifier,
restricting the view to that host's HTTP traffic under objective 1.3 packet analysis. Options A and D mix
Berkeley Packet Filter capture syntax into the display filter bar, and C searches payload content for a text
string rather than filtering by endpoint.
Independent practice material aligned to published exam objectives. Not affiliated with or endorsed by CompTIA, Inc. 3
