CySA CompTIA CertLearn- Exam Study Guide –
Practice Questions & Verified Answers
Prepare for your exams with confidence using this comprehensive and well-organized study
guide. This resource is designed to help students understand key concepts, strengthen their
knowledge, and improve exam performance through carefully structured practice questions
and detailed explanations.
The document includes exam-style questions that closely reflect the format and difficulty of
real assessments, helping students become familiar with the types of questions they may
encounter. Each question is accompanied by accurate answers and clear explanations,
allowing you to fully understand the reasoning behind the correct responses.
What This Study Guide Offers
✔ Practice questions based on important and commonly tested topics
✔ Verified answers with clear, easy-to-follow explanations
✔ Well-structured formatting for efficient studying and revision
✔ Coverage of key course concepts and learning objectives
✔ A reliable resource for strengthening understanding and exam readiness
Why This Resource Is Useful
This study guide is designed to support students who want to review effectively, identify
knowledge gaps, and improve their test-taking skills. By practicing with exam-style questions
and reviewing detailed explanations, students can reinforce their understanding and build
confidence before their exams.
Ideal For
• Final exam preparation
• Midterm review
• Regular revision sessions
• Improving understanding of difficult topics
• Enhancing overall academic performance
,Whether you are studying weeks in advance or reviewing shortly before an exam, this guide
provides structured practice and clear explanations to help you prepare effectively and
perform at your best.
A valuable study resource for students who want to prepare smarter and succeed in their
exams.
D
Implementing strict controls on account creation and privilege assignment ensures that only
authorized personnel can create new accounts and that the privileges assigned to these
accounts are reviewed and approved by the security team, thereby preventing the
introduction of new accounts with unauthorized privileges.
Despite preventing unauthorized access to existing accounts, strong passwords and password
policies do not prevent the introduction of new accounts with unauthorized privileges.
Blocking access to the organization's network from external sources does not prevent the
introduction of new accounts with unauthorized privileges.
Implementing a firewall to help monitor network traffic and identify suspicious activity does
not prevent the introduction of new accounts with unauthorized privileges.
A security analyst discovers that unauthorized privileges have been granted to a new account
that was created with high-level access, which was not authorized by the security team. Which
of the following is the most effective way to prevent the introduction of new accounts with
unauthorized privileges in an organization's environment?
A.Implement a firewall to monitor all incoming and outgoing network traffic to identify
suspicious activity
B.Block access to the organization's network from external sources to prevent attacks and data
breaches
C.Use strong passwords and enforce password policies to prevent unauthorized access to user
accounts
D.Implement strict controls on account creation and privilege assignment
B
People implement operational controls, such as policies, procedures, and training programs.
For example, conducting background checks on new employees is an example of an
operational control in cybersecurity since it screens potential hires for past criminal activity,
reducing insider threats.
Implementing cryptographic algorithms to secure sensitive data is the method for encryption,
,which is a technical control.
Technical controls, such as firewalls and intrusion detection systems, prevent unauthorized
access to computer networks.
Ensuring accurate time synchronization is the aim of configuring network devices to
synchronize time using NTP, which is a technical control.
A recently hired risk manager is taking over the organization's operational control
responsibilities. Which control responsibility would the risk manager assume in a cybersecurity
environment?
A.Encryption of sensitive data during storage and transmission
B.Implementation of firewalls and intrusion detection systems
C.Configuring network devices to synchronize time using Network Time Protocol (NTP)
D.Conducting background checks on new employees
B
Zed Attack Proxy (ZAP) is a widely-used open-source web application scanner capable of
automatically identifying vulnerabilities in web applications. In addition, it generates a
comprehensive report of all detected vulnerabilities.
Although ZAP is an effective tool for pinpointing vulnerabilities in web applications, it cannot
automatically fix them. An administrator must carry out vulnerability remediation manually.
An administrator can employ ZAP on web applications developed in a variety of programming
languages, not just Java.
Similarly, an administrator can utilize ZAP on web applications created in numerous
programming languages, not only .NET.
A web application developer wants to test the security of an application before deploying it to
production. Which of the following is a feature of Zed Attack Proxy (ZAP) that would influence
the web application developer's decision?
A.ZAP can automatically fix any vulnerabilities found in the application.
B.ZAP can automatically generate a report of all vulnerabilities found in the application.
C.Only web applications developed using Java can use ZAP.
D.Only web applications developed using .NET can use ZAP.
D
The MITRE ATT&CK framework provides access to a database of known tactics, techniques,
and procedures (TTPs) used by different threat actor groups. This allows the administrator to
compare the TTPs used by different threat groups.
While the cyber kill chain is a methodology that outlines the stages of a typical cyberattack, it
does not provide access to TTPs used by threat actor groups.
The diamond model of intrusion analysis is a methodology that helps to identify the various
, stages of an intrusion, not for providing TTPs used by threat actor groups.
The Open Source Security Testing Methodology Manual (OSSTMM) is a methodology for
performing security testing and does not provide access to the database listed in this
scenario.
An organization has tasked a network administrator with analyzing a recent cyberattack on the
system. They want to understand the attack methodology used by the attackers. Which
framework can the administrator use to access a database of known tactics, techniques, and
procedures (TTPs) used by different threat actor groups?
A.Cyber kill chain
B.Diamond model of intrusion analysis
C.Open Source Security Testing Methodology Manual (OSSTMM)
D.MITRE ATT&CK
B
Using tamper-evident bags with antistatic shielding will minimize the risk of data damage or
corruption due to electrostatic discharge. A chain of custody form should document where,
when, and who collected the evidence, who subsequently handled it, and its storage location.
Using permanent markers and plastic bags for labeling and storing electronic media is not
appropriate, nor is duct tape an acceptable sealing method for evidence bags.
Storing electronic media in cardboard boxes and using masking tape is unsuitable, and a
locked cabinet might not adequately protect against theft or tampering.
Labeling and storing electronic media with ballpoint pens and manila envelopes are
inappropriate, and staples are not a proper sealing method for evidence bags.
During an investigation into a cybersecurity incident, what steps should the organization take to
ensure that host devices and media taken from the crime scene are properly labeled, bagged,
and sealed?
A.Label the devices and media with a permanent marker, place them in a plastic bag, and seal
them with duct tape
B.Label the devices and media with tamper-evident, antistatic shielding bags, and record
evidence collection details on a chain of custody form
C.Place the devices and media in a cardboard box, seal it with masking tape, and store it in a
locked cabinet
D.Label the devices and media with a ballpoint pen, place them in a manila envelope, and seal
them with staples
C
A buffer overflow attack attempts to write more data to a program's buffer (temporary
storage area in memory) than it can hold, so the program executes malicious code in adjacent
Practice Questions & Verified Answers
Prepare for your exams with confidence using this comprehensive and well-organized study
guide. This resource is designed to help students understand key concepts, strengthen their
knowledge, and improve exam performance through carefully structured practice questions
and detailed explanations.
The document includes exam-style questions that closely reflect the format and difficulty of
real assessments, helping students become familiar with the types of questions they may
encounter. Each question is accompanied by accurate answers and clear explanations,
allowing you to fully understand the reasoning behind the correct responses.
What This Study Guide Offers
✔ Practice questions based on important and commonly tested topics
✔ Verified answers with clear, easy-to-follow explanations
✔ Well-structured formatting for efficient studying and revision
✔ Coverage of key course concepts and learning objectives
✔ A reliable resource for strengthening understanding and exam readiness
Why This Resource Is Useful
This study guide is designed to support students who want to review effectively, identify
knowledge gaps, and improve their test-taking skills. By practicing with exam-style questions
and reviewing detailed explanations, students can reinforce their understanding and build
confidence before their exams.
Ideal For
• Final exam preparation
• Midterm review
• Regular revision sessions
• Improving understanding of difficult topics
• Enhancing overall academic performance
,Whether you are studying weeks in advance or reviewing shortly before an exam, this guide
provides structured practice and clear explanations to help you prepare effectively and
perform at your best.
A valuable study resource for students who want to prepare smarter and succeed in their
exams.
D
Implementing strict controls on account creation and privilege assignment ensures that only
authorized personnel can create new accounts and that the privileges assigned to these
accounts are reviewed and approved by the security team, thereby preventing the
introduction of new accounts with unauthorized privileges.
Despite preventing unauthorized access to existing accounts, strong passwords and password
policies do not prevent the introduction of new accounts with unauthorized privileges.
Blocking access to the organization's network from external sources does not prevent the
introduction of new accounts with unauthorized privileges.
Implementing a firewall to help monitor network traffic and identify suspicious activity does
not prevent the introduction of new accounts with unauthorized privileges.
A security analyst discovers that unauthorized privileges have been granted to a new account
that was created with high-level access, which was not authorized by the security team. Which
of the following is the most effective way to prevent the introduction of new accounts with
unauthorized privileges in an organization's environment?
A.Implement a firewall to monitor all incoming and outgoing network traffic to identify
suspicious activity
B.Block access to the organization's network from external sources to prevent attacks and data
breaches
C.Use strong passwords and enforce password policies to prevent unauthorized access to user
accounts
D.Implement strict controls on account creation and privilege assignment
B
People implement operational controls, such as policies, procedures, and training programs.
For example, conducting background checks on new employees is an example of an
operational control in cybersecurity since it screens potential hires for past criminal activity,
reducing insider threats.
Implementing cryptographic algorithms to secure sensitive data is the method for encryption,
,which is a technical control.
Technical controls, such as firewalls and intrusion detection systems, prevent unauthorized
access to computer networks.
Ensuring accurate time synchronization is the aim of configuring network devices to
synchronize time using NTP, which is a technical control.
A recently hired risk manager is taking over the organization's operational control
responsibilities. Which control responsibility would the risk manager assume in a cybersecurity
environment?
A.Encryption of sensitive data during storage and transmission
B.Implementation of firewalls and intrusion detection systems
C.Configuring network devices to synchronize time using Network Time Protocol (NTP)
D.Conducting background checks on new employees
B
Zed Attack Proxy (ZAP) is a widely-used open-source web application scanner capable of
automatically identifying vulnerabilities in web applications. In addition, it generates a
comprehensive report of all detected vulnerabilities.
Although ZAP is an effective tool for pinpointing vulnerabilities in web applications, it cannot
automatically fix them. An administrator must carry out vulnerability remediation manually.
An administrator can employ ZAP on web applications developed in a variety of programming
languages, not just Java.
Similarly, an administrator can utilize ZAP on web applications created in numerous
programming languages, not only .NET.
A web application developer wants to test the security of an application before deploying it to
production. Which of the following is a feature of Zed Attack Proxy (ZAP) that would influence
the web application developer's decision?
A.ZAP can automatically fix any vulnerabilities found in the application.
B.ZAP can automatically generate a report of all vulnerabilities found in the application.
C.Only web applications developed using Java can use ZAP.
D.Only web applications developed using .NET can use ZAP.
D
The MITRE ATT&CK framework provides access to a database of known tactics, techniques,
and procedures (TTPs) used by different threat actor groups. This allows the administrator to
compare the TTPs used by different threat groups.
While the cyber kill chain is a methodology that outlines the stages of a typical cyberattack, it
does not provide access to TTPs used by threat actor groups.
The diamond model of intrusion analysis is a methodology that helps to identify the various
, stages of an intrusion, not for providing TTPs used by threat actor groups.
The Open Source Security Testing Methodology Manual (OSSTMM) is a methodology for
performing security testing and does not provide access to the database listed in this
scenario.
An organization has tasked a network administrator with analyzing a recent cyberattack on the
system. They want to understand the attack methodology used by the attackers. Which
framework can the administrator use to access a database of known tactics, techniques, and
procedures (TTPs) used by different threat actor groups?
A.Cyber kill chain
B.Diamond model of intrusion analysis
C.Open Source Security Testing Methodology Manual (OSSTMM)
D.MITRE ATT&CK
B
Using tamper-evident bags with antistatic shielding will minimize the risk of data damage or
corruption due to electrostatic discharge. A chain of custody form should document where,
when, and who collected the evidence, who subsequently handled it, and its storage location.
Using permanent markers and plastic bags for labeling and storing electronic media is not
appropriate, nor is duct tape an acceptable sealing method for evidence bags.
Storing electronic media in cardboard boxes and using masking tape is unsuitable, and a
locked cabinet might not adequately protect against theft or tampering.
Labeling and storing electronic media with ballpoint pens and manila envelopes are
inappropriate, and staples are not a proper sealing method for evidence bags.
During an investigation into a cybersecurity incident, what steps should the organization take to
ensure that host devices and media taken from the crime scene are properly labeled, bagged,
and sealed?
A.Label the devices and media with a permanent marker, place them in a plastic bag, and seal
them with duct tape
B.Label the devices and media with tamper-evident, antistatic shielding bags, and record
evidence collection details on a chain of custody form
C.Place the devices and media in a cardboard box, seal it with masking tape, and store it in a
locked cabinet
D.Label the devices and media with a ballpoint pen, place them in a manila envelope, and seal
them with staples
C
A buffer overflow attack attempts to write more data to a program's buffer (temporary
storage area in memory) than it can hold, so the program executes malicious code in adjacent
