D483- CySA Exam Questions and
Complete Solutions Graded A+
NAC (Network Access Control) - Answer: Prevents people from gaining access until they have
gone through a specific authentication method
IDOR (Insecure Direct Object Reference) - Answer: cybersecurity issue that occurs when web
app developers uses an identifier for direct access to an internal implementation.
Ex. Google.com/userID-999
Google.com/userID-873
Base 64 - Answer: Most common format attackers use to obfuscate their malicious code,
EX.273218e98bd81239
Cyber Kill Chain - Answer: A systematic outline of the steps of a cyberattack, introduced at
Lockheed Martin in 2011.
MITRE ATT&CK Framework - Answer: A knowledge base maintained by the MITRE Corporation
for listing and explaining specific adversary tactics, techniques, and common knowledge or
procedures (TTP).
Passive Scanning - Answer: Type of scanning describes indirect methods of assessment such as
inspecting flow of traffic and protocols.
ScoutSuite - Answer: A cloud security auditing tool that can work across commonly used cloud
environments.
, OWASP (Open Web Application Security Project) - Answer: Is an online community dedicated to
web application security. This community works to create freely-available articles,
methodologies, documentation, tools, and technologies that include web application flaws and
a way to address and correct them.
JSON - Answer: JSON is better than XML it is able to process large data sets.
OSSTMM (Open Source Security Testing Methodology Manual) - Answer: provides
comprehensive framework for testing the security of software systems. It includes identifying
system-assets, threat models, vulnerability assessment.
ZAP - Answer: widely used open source web application.
Diamond Model of Intrusion Analysis - Answer: A framework for analyzing cybersecurity
incidents and intrusions by exploring the relationships between four core features: adversary,
capability, infrastructure, and victim
Output encoding - Answer: primary defensive techniques against cross site scripting (XSS). By
ensuring that user input displayed on a web page is treated as data rather than executable code,
output encoding prevents the executions of malicious steps
Fuzzing - Answer: Injection of randomized data into a software program in an attempt to find
system failures, memory leaks, error handling issues, and improper input validation
Single Glass of Pane - Answer: A central point of access for all the information, tools, and
systems.
Data Enrichment - Answer: The process of incorporating new updates and information to an
organization's existing database to improve accuracy.
Complete Solutions Graded A+
NAC (Network Access Control) - Answer: Prevents people from gaining access until they have
gone through a specific authentication method
IDOR (Insecure Direct Object Reference) - Answer: cybersecurity issue that occurs when web
app developers uses an identifier for direct access to an internal implementation.
Ex. Google.com/userID-999
Google.com/userID-873
Base 64 - Answer: Most common format attackers use to obfuscate their malicious code,
EX.273218e98bd81239
Cyber Kill Chain - Answer: A systematic outline of the steps of a cyberattack, introduced at
Lockheed Martin in 2011.
MITRE ATT&CK Framework - Answer: A knowledge base maintained by the MITRE Corporation
for listing and explaining specific adversary tactics, techniques, and common knowledge or
procedures (TTP).
Passive Scanning - Answer: Type of scanning describes indirect methods of assessment such as
inspecting flow of traffic and protocols.
ScoutSuite - Answer: A cloud security auditing tool that can work across commonly used cloud
environments.
, OWASP (Open Web Application Security Project) - Answer: Is an online community dedicated to
web application security. This community works to create freely-available articles,
methodologies, documentation, tools, and technologies that include web application flaws and
a way to address and correct them.
JSON - Answer: JSON is better than XML it is able to process large data sets.
OSSTMM (Open Source Security Testing Methodology Manual) - Answer: provides
comprehensive framework for testing the security of software systems. It includes identifying
system-assets, threat models, vulnerability assessment.
ZAP - Answer: widely used open source web application.
Diamond Model of Intrusion Analysis - Answer: A framework for analyzing cybersecurity
incidents and intrusions by exploring the relationships between four core features: adversary,
capability, infrastructure, and victim
Output encoding - Answer: primary defensive techniques against cross site scripting (XSS). By
ensuring that user input displayed on a web page is treated as data rather than executable code,
output encoding prevents the executions of malicious steps
Fuzzing - Answer: Injection of randomized data into a software program in an attempt to find
system failures, memory leaks, error handling issues, and improper input validation
Single Glass of Pane - Answer: A central point of access for all the information, tools, and
systems.
Data Enrichment - Answer: The process of incorporating new updates and information to an
organization's existing database to improve accuracy.
