KENTUCKY CYBERSECURITY ANALYST CERTIFICATION EXAM PRACTICE TEST QUESTIONS
AND CORRECT ANSWERS (VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT
DOWNLOAD PDF.
Core Domains
- Network Security Monitoring
- Incident Response and Handling
- Vulnerability Management
- Threat Intelligence and Detection
- Compliance and Regulatory Frameworks
- Systems Security and Cryptography
- Identity and Access Management
Introduction
This practice test is designed to evaluate and enhance the critical knowledge and practical skills
required for the Kentucky Cybersecurity Analyst Certification. The assessment focuses on essential
security concepts, practical system defense methods, incident mitigation strategies, and state-
specific regulatory compliance mandates. Utilizing both theoretical multiple-choice inquiries and
deep scenario-based practical problems, this exam mirrors the real-world operational challenges
faced by security professionals. Candidates will demonstrate their analytical capacity, decision-
making competency under stress, and commitment to security ethics, ensuring they are fully
prepared to defend critical infrastructure and enterprise environments effectively.*
Section One: Questions 1–100
, An analyst notices a sharp increase in HTTP 404 errors originating from a single external IP address
directed at various random directories on a web server. Which of the following activities is most
likely occurring?
A. A distributed denial of service attack
B. Directory traversal scanning
C. A buffer overflow attempt
D. SQL injection probing
🟢 B. Directory traversal scanning
🔴 RATIONALE: Automated scanners send rapid requests to various directory paths to map a web
server's structure and locate unlinked or vulnerable files, which systematically generates a high volume of
HTTP 404 Not Found errors when paths do not exist.
A financial institution operating within Kentucky must comply with state-level data breach notification
statutes. Under current state regulations, what constitutes the primary trigger for notifying affected
residents after discovering a breach of unencrypted personal information?
A. The total quantity of records exfiltrated exceeding 500 individuals
B. A determination that misuse of the personal information has occurred or is reasonably likely to occur
C. The involvement of an offshore threat actor group
D. Any unauthorized access to the network infrastructure, regardless of data visibility
🟢 B. A determination that misuse of the personal information has occurred or is reasonably likely to
occur
🔴 RATIONALE: Kentucky Revised Statutes (KRS) require notification when a data breach involving
personal information occurs and there is a reasonable likelihood that the data will be misused to cause
material harm or identity theft to residents.
During an active incident investigation, an analyst discovers that a threat actor used a compromised
administrative account to change domain-level Group Policy Objects (GPOs). What is the most
immediate security risk associated with this action?
,A. Disruption of local routing tables on boundary firewalls
B. Unauthorized deployment of malware across all domain-joined endpoints
C. Exhaustion of storage capacity on the primary domain controller
D. Interception of physical layer wireless transmissions
🟢 B. Unauthorized deployment of malware across all domain-joined endpoints
🔴 RATIONALE: Active Directory Group Policy Objects control the configuration settings and software
deployment for all joined systems; a malicious modification allows attackers to push scripts, execute
arbitrary code, or disable security tools enterprise-wide.
An organization implements an asymmetric cryptographic solution to sign internal software updates
securely. Which key must the organization use to create the digital signature, and which key must
the client systems use to verify it?
A. The public key signs the updates; the public key verifies the updates.
B. The public key signs the updates; the private key verifies the updates.
C. The private key signs the updates; the public key verifies the updates.
D. The private key signs the updates; the private key verifies the updates.
🟢 C. The private key signs the updates; the public key verifies the updates.
🔴 RATIONALE: Digital signatures provide non-repudiation and integrity by utilizing the sender's private
key to sign the data, while any recipient can verify the signature using the corresponding publicly
distributed key.
A security analyst reviews a packet capture and observes an external host sending TCP packets to
a public server with the SYN, FIN, and RST flags set simultaneously. How should a properly
configured stateful firewall handle this traffic?
A. Forward the packets to the internal intrusion detection system for deep inspection
B. Drop the packets immediately as an invalid TCP flag combination
C. Reply with a SYN-ACK packet to establish a testing connection
D. Log the connection as a standard web browsing initialization sequence
, 🟢 B. Drop the packets immediately as an invalid TCP flag combination
🔴 RATIONALE: TCP flag combinations such as SYN-FIN or SYN-RST violate RFC specifications and
represent anomalous traffic commonly used by scanners to bypass simple filters or map OS fingerprints;
stateful firewalls drop these outright.
A junior analyst discovers a spreadsheet containing corporate payroll records exposed on an
internal open share. Instead of reporting it through the standard chain of command, the analyst
downloads the file and shares it with a peer to prove the lack of security. Which ethical tenet was
violated?
A. Due diligence regarding software licensing
B. Professional boundaries and adherence to established incident reporting procedures
C. Maintaining availability of critical network assets
D. Preventing cross-site scripting vulnerabilities
🟢 B. Professional boundaries and adherence to established incident reporting procedures
🔴 RATIONALE: Security professionals must handle discovered vulnerabilities and exposed sensitive
data through formalized corporate reporting channels; unauthorized downloading and dissemination of
data compromises confidentiality and breaches professional ethics.
An administrator wants to protect authentication tokens sent via a web browser from being
accessed by malicious client-side scripts. Which of the following cookie attributes is most effective
for this specific purpose?
A. Secure
B. SameSite
C. HttpOnly
D. Max-Age
🟢 C. HttpOnly
🔴 RATIONALE: The HttpOnly flag prevents client-side scripts, such as JavaScript, from accessing the
cookie via the document.cookie property, directly mitigating risks associated with Cross-Site Scripting
(XSS) token theft.
AND CORRECT ANSWERS (VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT
DOWNLOAD PDF.
Core Domains
- Network Security Monitoring
- Incident Response and Handling
- Vulnerability Management
- Threat Intelligence and Detection
- Compliance and Regulatory Frameworks
- Systems Security and Cryptography
- Identity and Access Management
Introduction
This practice test is designed to evaluate and enhance the critical knowledge and practical skills
required for the Kentucky Cybersecurity Analyst Certification. The assessment focuses on essential
security concepts, practical system defense methods, incident mitigation strategies, and state-
specific regulatory compliance mandates. Utilizing both theoretical multiple-choice inquiries and
deep scenario-based practical problems, this exam mirrors the real-world operational challenges
faced by security professionals. Candidates will demonstrate their analytical capacity, decision-
making competency under stress, and commitment to security ethics, ensuring they are fully
prepared to defend critical infrastructure and enterprise environments effectively.*
Section One: Questions 1–100
, An analyst notices a sharp increase in HTTP 404 errors originating from a single external IP address
directed at various random directories on a web server. Which of the following activities is most
likely occurring?
A. A distributed denial of service attack
B. Directory traversal scanning
C. A buffer overflow attempt
D. SQL injection probing
🟢 B. Directory traversal scanning
🔴 RATIONALE: Automated scanners send rapid requests to various directory paths to map a web
server's structure and locate unlinked or vulnerable files, which systematically generates a high volume of
HTTP 404 Not Found errors when paths do not exist.
A financial institution operating within Kentucky must comply with state-level data breach notification
statutes. Under current state regulations, what constitutes the primary trigger for notifying affected
residents after discovering a breach of unencrypted personal information?
A. The total quantity of records exfiltrated exceeding 500 individuals
B. A determination that misuse of the personal information has occurred or is reasonably likely to occur
C. The involvement of an offshore threat actor group
D. Any unauthorized access to the network infrastructure, regardless of data visibility
🟢 B. A determination that misuse of the personal information has occurred or is reasonably likely to
occur
🔴 RATIONALE: Kentucky Revised Statutes (KRS) require notification when a data breach involving
personal information occurs and there is a reasonable likelihood that the data will be misused to cause
material harm or identity theft to residents.
During an active incident investigation, an analyst discovers that a threat actor used a compromised
administrative account to change domain-level Group Policy Objects (GPOs). What is the most
immediate security risk associated with this action?
,A. Disruption of local routing tables on boundary firewalls
B. Unauthorized deployment of malware across all domain-joined endpoints
C. Exhaustion of storage capacity on the primary domain controller
D. Interception of physical layer wireless transmissions
🟢 B. Unauthorized deployment of malware across all domain-joined endpoints
🔴 RATIONALE: Active Directory Group Policy Objects control the configuration settings and software
deployment for all joined systems; a malicious modification allows attackers to push scripts, execute
arbitrary code, or disable security tools enterprise-wide.
An organization implements an asymmetric cryptographic solution to sign internal software updates
securely. Which key must the organization use to create the digital signature, and which key must
the client systems use to verify it?
A. The public key signs the updates; the public key verifies the updates.
B. The public key signs the updates; the private key verifies the updates.
C. The private key signs the updates; the public key verifies the updates.
D. The private key signs the updates; the private key verifies the updates.
🟢 C. The private key signs the updates; the public key verifies the updates.
🔴 RATIONALE: Digital signatures provide non-repudiation and integrity by utilizing the sender's private
key to sign the data, while any recipient can verify the signature using the corresponding publicly
distributed key.
A security analyst reviews a packet capture and observes an external host sending TCP packets to
a public server with the SYN, FIN, and RST flags set simultaneously. How should a properly
configured stateful firewall handle this traffic?
A. Forward the packets to the internal intrusion detection system for deep inspection
B. Drop the packets immediately as an invalid TCP flag combination
C. Reply with a SYN-ACK packet to establish a testing connection
D. Log the connection as a standard web browsing initialization sequence
, 🟢 B. Drop the packets immediately as an invalid TCP flag combination
🔴 RATIONALE: TCP flag combinations such as SYN-FIN or SYN-RST violate RFC specifications and
represent anomalous traffic commonly used by scanners to bypass simple filters or map OS fingerprints;
stateful firewalls drop these outright.
A junior analyst discovers a spreadsheet containing corporate payroll records exposed on an
internal open share. Instead of reporting it through the standard chain of command, the analyst
downloads the file and shares it with a peer to prove the lack of security. Which ethical tenet was
violated?
A. Due diligence regarding software licensing
B. Professional boundaries and adherence to established incident reporting procedures
C. Maintaining availability of critical network assets
D. Preventing cross-site scripting vulnerabilities
🟢 B. Professional boundaries and adherence to established incident reporting procedures
🔴 RATIONALE: Security professionals must handle discovered vulnerabilities and exposed sensitive
data through formalized corporate reporting channels; unauthorized downloading and dissemination of
data compromises confidentiality and breaches professional ethics.
An administrator wants to protect authentication tokens sent via a web browser from being
accessed by malicious client-side scripts. Which of the following cookie attributes is most effective
for this specific purpose?
A. Secure
B. SameSite
C. HttpOnly
D. Max-Age
🟢 C. HttpOnly
🔴 RATIONALE: The HttpOnly flag prevents client-side scripts, such as JavaScript, from accessing the
cookie via the document.cookie property, directly mitigating risks associated with Cross-Site Scripting
(XSS) token theft.
