1
CompTIA CySA+ (CS0-003)
Practice Exam — Version 2.0
Comprehensive 150-Question
Practice Test with Answers and
Rationales a well detailed one
written and graded
A+ upgraded
, 2
Exam Domain Weighting (CS0-003):
• Security Operations — 33% (50 questions)
• Vulnerability Management — 30% (45 questions)
• Incident Response and Management — 20% (30 questions)
• Reporting and Communication — 17% (25 questions)
Exam Details: Maximum 85 questions (mix of multiple-choice and performance-based) | 165
minutes | Passing score: 750/900
DOMAIN 1: SECURITY OPERATIONS (33%)
System and Network Architecture & Log Ingestion
1. A security analyst is reviewing AWS CloudTrail logs and notices multiple AssumeRole API
calls from an IP address that is not associated with any known corporate office. The calls are
occurring at 2:00 AM local time. Which of the following is the MOST appropriate next step?
A. Immediately revoke all IAM roles in the AWS account
B. Validate whether the API calls are associated with a legitimate automated process or
scheduled task
C. Block the IP address at the network perimeter
D. Notify AWS Support of a potential compromise
-” detailed answer 100 % correct :-”B
Rationale: Before taking any containment action, the analyst should validate whether the API
calls are legitimate—they could be from an automated CI/CD pipeline, a scheduled Lambda
function, or a third-party integration. Revoking all roles (A) would cause widespread disruption.
Blocking the IP (C) may not address the root cause if the calls are from a compromised
credential. AWS Support (D) is not the appropriate first step.
2. An analyst is investigating a potential compromise and needs to determine which processes
were running on a Windows system at the time of the incident. The system is still powered
on. Which of the following actions should the analyst perform FIRST?
, 3
A. Shut down the system to preserve the hard drive
B. Capture a memory image using a forensic tool
C. Run an antivirus scan
D. Review the Windows Event Logs
-” detailed answer 100 % correct :-”B
Rationale: Memory (RAM) contains volatile data about running processes, network
connections, and potentially malicious code. Capturing a memory image preserves this volatile
evidence before any other actions that might alter it. Shutting down (A) would destroy volatile
memory. Antivirus scans (C) and event log reviews (D) may alter evidence or should be
performed after memory acquisition.
3. Which of the following log sources would be MOST useful for identifying unauthorized S3
bucket permissions changes in an AWS environment?
A. VPC Flow Logs
B. AWS CloudTrail
C. AWS CloudWatch Logs
D. AWS Config
-” detailed answer 100 % correct :-”B
Rationale: AWS CloudTrail records all API calls made in an AWS account,
including PutBucketPolicy, PutBucketAcl, and other S3 permission changes. VPC Flow Logs (A)
capture network traffic, not API calls. CloudWatch Logs (C) store application and system logs.
AWS Config (D) tracks configuration changes but CloudTrail is the primary source for API-level
auditing.
4. A SOC analyst receives an alert from the SIEM indicating "Potential data exfiltration via DNS
tunneling." Which of the following characteristics in DNS logs would BEST support this
finding?
A. DNS queries to well-known domains with short TTL values
B. DNS queries with unusually long subdomain names containing encoded data
C. DNS queries with high response times
D. DNS queries from a single internal IP to multiple external DNS servers
-” detailed answer 100 % correct :-”B
, 4
Rationale: DNS tunneling encodes data within DNS query names, resulting in unusually long
subdomains that appear random or contain encoded characters. Short TTL values (A) are not
specific to tunneling. High response times (C) could indicate many issues. Multiple DNS servers
(D) is normal behavior.
5. An organization has implemented a Zero Trust architecture. Which of the following BEST
describes how this impacts security operations monitoring?
A. All traffic is trusted by default, reducing the need for monitoring
B. Every access request must be authenticated, authorized, and continuously validated,
requiring more granular monitoring
C. Zero Trust eliminates the need for a SIEM
D. Zero Trust applies only to remote workers
-” detailed answer 100 % correct :-”B
Rationale: Zero Trust requires continuous verification of every access request, which increases
the need for granular monitoring, logging, and analytics. Traffic is not trusted by default (A).
SIEMs remain essential (C). Zero Trust applies to all users and devices, not just remote workers
(D).
6. An analyst is reviewing Zeek (formerly Bro) logs and sees the following
entry: 192.168.1.100 → 10.0.0.50 on port 445 with a high volume of packets. This traffic
pattern is MOST likely indicative of:
A. A legitimate file transfer
B. Lateral movement using SMB
C. A DNS query
D. A web application request
-” detailed answer 100 % correct :-”B
Rationale: Port 445 is used for SMB (Server Message Block), which is commonly used for lateral
movement within a network. The internal-to-internal traffic pattern suggests a system
(192.168.1.100) connecting to another internal system (10.0.0.50). File transfers (A) are possible
but less suspicious. DNS uses port 53 (C). Web traffic uses ports 80/443 (D).
CompTIA CySA+ (CS0-003)
Practice Exam — Version 2.0
Comprehensive 150-Question
Practice Test with Answers and
Rationales a well detailed one
written and graded
A+ upgraded
, 2
Exam Domain Weighting (CS0-003):
• Security Operations — 33% (50 questions)
• Vulnerability Management — 30% (45 questions)
• Incident Response and Management — 20% (30 questions)
• Reporting and Communication — 17% (25 questions)
Exam Details: Maximum 85 questions (mix of multiple-choice and performance-based) | 165
minutes | Passing score: 750/900
DOMAIN 1: SECURITY OPERATIONS (33%)
System and Network Architecture & Log Ingestion
1. A security analyst is reviewing AWS CloudTrail logs and notices multiple AssumeRole API
calls from an IP address that is not associated with any known corporate office. The calls are
occurring at 2:00 AM local time. Which of the following is the MOST appropriate next step?
A. Immediately revoke all IAM roles in the AWS account
B. Validate whether the API calls are associated with a legitimate automated process or
scheduled task
C. Block the IP address at the network perimeter
D. Notify AWS Support of a potential compromise
-” detailed answer 100 % correct :-”B
Rationale: Before taking any containment action, the analyst should validate whether the API
calls are legitimate—they could be from an automated CI/CD pipeline, a scheduled Lambda
function, or a third-party integration. Revoking all roles (A) would cause widespread disruption.
Blocking the IP (C) may not address the root cause if the calls are from a compromised
credential. AWS Support (D) is not the appropriate first step.
2. An analyst is investigating a potential compromise and needs to determine which processes
were running on a Windows system at the time of the incident. The system is still powered
on. Which of the following actions should the analyst perform FIRST?
, 3
A. Shut down the system to preserve the hard drive
B. Capture a memory image using a forensic tool
C. Run an antivirus scan
D. Review the Windows Event Logs
-” detailed answer 100 % correct :-”B
Rationale: Memory (RAM) contains volatile data about running processes, network
connections, and potentially malicious code. Capturing a memory image preserves this volatile
evidence before any other actions that might alter it. Shutting down (A) would destroy volatile
memory. Antivirus scans (C) and event log reviews (D) may alter evidence or should be
performed after memory acquisition.
3. Which of the following log sources would be MOST useful for identifying unauthorized S3
bucket permissions changes in an AWS environment?
A. VPC Flow Logs
B. AWS CloudTrail
C. AWS CloudWatch Logs
D. AWS Config
-” detailed answer 100 % correct :-”B
Rationale: AWS CloudTrail records all API calls made in an AWS account,
including PutBucketPolicy, PutBucketAcl, and other S3 permission changes. VPC Flow Logs (A)
capture network traffic, not API calls. CloudWatch Logs (C) store application and system logs.
AWS Config (D) tracks configuration changes but CloudTrail is the primary source for API-level
auditing.
4. A SOC analyst receives an alert from the SIEM indicating "Potential data exfiltration via DNS
tunneling." Which of the following characteristics in DNS logs would BEST support this
finding?
A. DNS queries to well-known domains with short TTL values
B. DNS queries with unusually long subdomain names containing encoded data
C. DNS queries with high response times
D. DNS queries from a single internal IP to multiple external DNS servers
-” detailed answer 100 % correct :-”B
, 4
Rationale: DNS tunneling encodes data within DNS query names, resulting in unusually long
subdomains that appear random or contain encoded characters. Short TTL values (A) are not
specific to tunneling. High response times (C) could indicate many issues. Multiple DNS servers
(D) is normal behavior.
5. An organization has implemented a Zero Trust architecture. Which of the following BEST
describes how this impacts security operations monitoring?
A. All traffic is trusted by default, reducing the need for monitoring
B. Every access request must be authenticated, authorized, and continuously validated,
requiring more granular monitoring
C. Zero Trust eliminates the need for a SIEM
D. Zero Trust applies only to remote workers
-” detailed answer 100 % correct :-”B
Rationale: Zero Trust requires continuous verification of every access request, which increases
the need for granular monitoring, logging, and analytics. Traffic is not trusted by default (A).
SIEMs remain essential (C). Zero Trust applies to all users and devices, not just remote workers
(D).
6. An analyst is reviewing Zeek (formerly Bro) logs and sees the following
entry: 192.168.1.100 → 10.0.0.50 on port 445 with a high volume of packets. This traffic
pattern is MOST likely indicative of:
A. A legitimate file transfer
B. Lateral movement using SMB
C. A DNS query
D. A web application request
-” detailed answer 100 % correct :-”B
Rationale: Port 445 is used for SMB (Server Message Block), which is commonly used for lateral
movement within a network. The internal-to-internal traffic pattern suggests a system
(192.168.1.100) connecting to another internal system (10.0.0.50). File transfers (A) are possible
but less suspicious. DNS uses port 53 (C). Web traffic uses ports 80/443 (D).
