CompTIA
CySA+ (CS0-003)
Security Operations, Threat Intelligence, Vulnerability Management & Incident
Response
Exam: CS0-003
47 Questions & Verified Answers
CompTIA CySA+ CS0-003 - 47 Exam Questions
Questions cover all four CySA+ domains: Security Operations, Vulnerability Management, Incident
Response, and Reporting & Communication.
Q01. What is Threat Intelligence and what are its four types?
A. Antivirus database updates
B. Evidence-based knowledge about existing/emerging threats - Strategic (executive-level
trends), Tactical (TTPs for defenders), Operational (specific attack details), Technical (IOCs:
hashes, IPs, domains)
C. Penetration test results
D. Firewall log analysis
Answer: B. Evidence-based threat knowledge - Strategic, Tactical, Operational, Technical
Strategic: non-technical, for leadership - threat trends, geopolitical threats, industry risks.
Tactical: TTPs (Tactics, Techniques, Procedures) from MITRE ATT&CK - for security architects and
detection teams.
Operational: specifics of a planned or ongoing attack - for incident responders.
Technical: IoCs - IP addresses, domain names, file hashes, malware signatures - for SOC analysts.
Q02. What is the MITRE ATT&CK framework?
A. A compliance certification
B. A globally accessible knowledge base of adversary tactics, techniques, and sub-techniques
based on real-world observations - used for threat modeling, detection improvement, and
red/blue team exercises
C. A vulnerability scoring system
D. A penetration testing methodology
Answer: B. Knowledge base of real-world adversary TTPs for threat modeling, detection, and
red/blue teams
, 14 Tactic categories: Reconnaissance, Resource Development, Initial Access, Execution,
Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral
Movement, Collection, C2, Exfiltration, Impact.
Use cases: detection gap analysis ('what TTPs do we not detect?'), threat hunt hypotheses, red
team planning.
MITRE D3FEND: the defensive counterpart - maps defensive techniques to ATT&CK tactics.
Q03. What is a SIEM and what are its core functions?
A. Secure Internet and Email Management
B. Security Information and Event Management - aggregates and correlates log data from
multiple sources, provides real-time alerting, dashboards, and supports security investigation
and compliance reporting
C. System Integrity and Error Management
D. A firewall management system
Answer: B. Aggregates/correlates logs, real-time alerting, dashboards, investigation
support, compliance reporting
Log collection: from firewalls, EDR, IDS/IPS, servers, cloud, applications via agents, syslog, or
APIs.
Correlation rules: connect related events across sources - detect patterns invisible to individual
tools.
Examples: Splunk, Microsoft Sentinel, IBM QRadar, Elastic SIEM, Exabeam, LogRhythm.
Q04. What is the difference between IDS and IPS?
A. Identical - just different product names
B. IDS (Intrusion Detection System): monitors and ALERTS on suspicious traffic without
blocking; IPS (Intrusion Prevention System): monitors and BLOCKS malicious traffic inline in
real time
C. IPS is for hosts; IDS is for networks
D. IDS blocks; IPS monitors
Answer: B. IDS = passive monitor and alert (no blocking); IPS = active detect and block
inline
NIDS: network-based IDS. HIDS: host-based IDS (on the endpoint).
Detection methods: signature-based (known patterns), anomaly-based (deviation from baseline),
heuristic (behavioral analysis).
False positive management is critical - aggressive IPS tuning can block legitimate traffic.
Q05. What are the SOC tier levels and their responsibilities?
A. Junior, Senior, Manager
B. Tier 1 (Alert Analyst): initial triage and analysis; Tier 2 (Incident Responder): deep
investigation and containment; Tier 3 (Threat Hunter/SME): proactive hunting, malware
analysis, advanced forensics, and tool development
C. Helpdesk, Network, Security
D. Analyst, Engineer, Architect
Answer: B. T1 = triage; T2 = deep investigation/containment; T3 = proactive
hunting/malware/advanced forensics
, T1: review incoming alerts from SIEM, classify (true/false positive), escalate confirmed incidents to
T2.
T2: correlate with threat intel, determine full scope and impact, coordinate containment.
T3: write detection rules, reverse engineer malware, build security tools, lead threat hunting
initiatives.
SOAR automates T1 repetitive tasks - freeing analysts for higher-value work.
Q06. What are critical Windows Event IDs a SOC analyst must know?
A. Events 100-199 only
B. 4624 (successful logon), 4625 (failed logon), 4648 (logon with explicit credentials), 4688
(process creation with command line), 4720 (account created), 7045 (new service installed)
C. Only event 4624
D. Events are not important for SOC work
Answer: B. 4624 (logon), 4625 (failed logon), 4648 (explicit creds), 4688 (process creation),
4720 (account created), 7045 (new service)
4625: many in short time = brute force attack. Investigate source IP.
4648: logon with explicit credentials = Pass-the-Hash or lateral movement indicator.
4688 with command line logging: detect PowerShell downloads, malicious process chains.
7045: attackers install malicious services for persistence - monitor this event closely.
Q07. What is CVE/CVSS and why do they matter?
A. Company Vulnerability Exchange / Corporate Vulnerability Scoring Standard
B. CVE: Common Vulnerabilities and Exposures - unique IDs for known vulnerabilities; CVSS:
Common Vulnerability Scoring System - numeric 0-10 severity score based on exploitability
and impact
C. A government firewall rating
D. A network scanner format
Answer: B. CVE = unique IDs for known vulnerabilities; CVSS = 0-10 severity score based on
exploitability and impact
CVSS v3 severity: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9).
CVSS base score alone is insufficient for prioritization - context (exposure, exploitation in wild)
matters.
NVD (National Vulnerability Database): NIST's enriched CVE database with CVSS scores.
KEV (CISA Known Exploited Vulnerabilities): actively exploited CVEs - prioritize these for
immediate patching.
Q08. What is the difference between authenticated and unauthenticated vulnerability scanning?
A. Identical results
B. Unauthenticated: scans from an external attacker's perspective - detects open ports and
exposed services; Authenticated: uses system credentials for internal view - detects missing
patches, weak configs, and installed software vulnerabilities
C. Authenticated scans are always faster
D. Unauthenticated scans are more accurate
CySA+ (CS0-003)
Security Operations, Threat Intelligence, Vulnerability Management & Incident
Response
Exam: CS0-003
47 Questions & Verified Answers
CompTIA CySA+ CS0-003 - 47 Exam Questions
Questions cover all four CySA+ domains: Security Operations, Vulnerability Management, Incident
Response, and Reporting & Communication.
Q01. What is Threat Intelligence and what are its four types?
A. Antivirus database updates
B. Evidence-based knowledge about existing/emerging threats - Strategic (executive-level
trends), Tactical (TTPs for defenders), Operational (specific attack details), Technical (IOCs:
hashes, IPs, domains)
C. Penetration test results
D. Firewall log analysis
Answer: B. Evidence-based threat knowledge - Strategic, Tactical, Operational, Technical
Strategic: non-technical, for leadership - threat trends, geopolitical threats, industry risks.
Tactical: TTPs (Tactics, Techniques, Procedures) from MITRE ATT&CK - for security architects and
detection teams.
Operational: specifics of a planned or ongoing attack - for incident responders.
Technical: IoCs - IP addresses, domain names, file hashes, malware signatures - for SOC analysts.
Q02. What is the MITRE ATT&CK framework?
A. A compliance certification
B. A globally accessible knowledge base of adversary tactics, techniques, and sub-techniques
based on real-world observations - used for threat modeling, detection improvement, and
red/blue team exercises
C. A vulnerability scoring system
D. A penetration testing methodology
Answer: B. Knowledge base of real-world adversary TTPs for threat modeling, detection, and
red/blue teams
, 14 Tactic categories: Reconnaissance, Resource Development, Initial Access, Execution,
Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral
Movement, Collection, C2, Exfiltration, Impact.
Use cases: detection gap analysis ('what TTPs do we not detect?'), threat hunt hypotheses, red
team planning.
MITRE D3FEND: the defensive counterpart - maps defensive techniques to ATT&CK tactics.
Q03. What is a SIEM and what are its core functions?
A. Secure Internet and Email Management
B. Security Information and Event Management - aggregates and correlates log data from
multiple sources, provides real-time alerting, dashboards, and supports security investigation
and compliance reporting
C. System Integrity and Error Management
D. A firewall management system
Answer: B. Aggregates/correlates logs, real-time alerting, dashboards, investigation
support, compliance reporting
Log collection: from firewalls, EDR, IDS/IPS, servers, cloud, applications via agents, syslog, or
APIs.
Correlation rules: connect related events across sources - detect patterns invisible to individual
tools.
Examples: Splunk, Microsoft Sentinel, IBM QRadar, Elastic SIEM, Exabeam, LogRhythm.
Q04. What is the difference between IDS and IPS?
A. Identical - just different product names
B. IDS (Intrusion Detection System): monitors and ALERTS on suspicious traffic without
blocking; IPS (Intrusion Prevention System): monitors and BLOCKS malicious traffic inline in
real time
C. IPS is for hosts; IDS is for networks
D. IDS blocks; IPS monitors
Answer: B. IDS = passive monitor and alert (no blocking); IPS = active detect and block
inline
NIDS: network-based IDS. HIDS: host-based IDS (on the endpoint).
Detection methods: signature-based (known patterns), anomaly-based (deviation from baseline),
heuristic (behavioral analysis).
False positive management is critical - aggressive IPS tuning can block legitimate traffic.
Q05. What are the SOC tier levels and their responsibilities?
A. Junior, Senior, Manager
B. Tier 1 (Alert Analyst): initial triage and analysis; Tier 2 (Incident Responder): deep
investigation and containment; Tier 3 (Threat Hunter/SME): proactive hunting, malware
analysis, advanced forensics, and tool development
C. Helpdesk, Network, Security
D. Analyst, Engineer, Architect
Answer: B. T1 = triage; T2 = deep investigation/containment; T3 = proactive
hunting/malware/advanced forensics
, T1: review incoming alerts from SIEM, classify (true/false positive), escalate confirmed incidents to
T2.
T2: correlate with threat intel, determine full scope and impact, coordinate containment.
T3: write detection rules, reverse engineer malware, build security tools, lead threat hunting
initiatives.
SOAR automates T1 repetitive tasks - freeing analysts for higher-value work.
Q06. What are critical Windows Event IDs a SOC analyst must know?
A. Events 100-199 only
B. 4624 (successful logon), 4625 (failed logon), 4648 (logon with explicit credentials), 4688
(process creation with command line), 4720 (account created), 7045 (new service installed)
C. Only event 4624
D. Events are not important for SOC work
Answer: B. 4624 (logon), 4625 (failed logon), 4648 (explicit creds), 4688 (process creation),
4720 (account created), 7045 (new service)
4625: many in short time = brute force attack. Investigate source IP.
4648: logon with explicit credentials = Pass-the-Hash or lateral movement indicator.
4688 with command line logging: detect PowerShell downloads, malicious process chains.
7045: attackers install malicious services for persistence - monitor this event closely.
Q07. What is CVE/CVSS and why do they matter?
A. Company Vulnerability Exchange / Corporate Vulnerability Scoring Standard
B. CVE: Common Vulnerabilities and Exposures - unique IDs for known vulnerabilities; CVSS:
Common Vulnerability Scoring System - numeric 0-10 severity score based on exploitability
and impact
C. A government firewall rating
D. A network scanner format
Answer: B. CVE = unique IDs for known vulnerabilities; CVSS = 0-10 severity score based on
exploitability and impact
CVSS v3 severity: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), Low (0.1-3.9).
CVSS base score alone is insufficient for prioritization - context (exposure, exploitation in wild)
matters.
NVD (National Vulnerability Database): NIST's enriched CVE database with CVSS scores.
KEV (CISA Known Exploited Vulnerabilities): actively exploited CVEs - prioritize these for
immediate patching.
Q08. What is the difference between authenticated and unauthenticated vulnerability scanning?
A. Identical results
B. Unauthenticated: scans from an external attacker's perspective - detects open ports and
exposed services; Authenticated: uses system credentials for internal view - detects missing
patches, weak configs, and installed software vulnerabilities
C. Authenticated scans are always faster
D. Unauthenticated scans are more accurate
