[COMPTIA CYSA+ EXAM] – EXAM-STYLE QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED PASS |
2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE TEST
1. A security analyst is reviewing suspicious network traffic and discovers an
internal host is sending a high volume of outbound connection requests to
random destination IP addresses over port 4444. The internal host responds to
these connections by sending encoded data payloads. Which of the following
BEST describes this situation?
A. The host is participating in a reflection attack.
B. The host is functioning as a command-and-control beacon.
C. The host is exfiltrating data using a covert channel.
D. The host is infected with a worm that is scanning for vulnerabilities.
Correct Answer: B. The host is functioning as a command-and-control beacon.
Rationale: The internal host's behavior of initiating outbound connections to
random IPs on a non-standard port (4444) and sending encoded payloads is classic
C2 beaconing. It attempts to establish a communication channel with an external
controller. A reflection attack would involve a third-party server (A). A covert
channel usually hides data within legitimate protocols (C), and while a worm may
scan (D), the response with encoded payloads points toward active two-way
communication with an external threat actor.
2. A security analyst is investigating an alert triggered by an endpoint
detection and response (EDR) tool. The alert indicates that a critical business
application attempted to write an executable file to the Windows startup
,folder, which was then blocked by the EDR's policy. The application developer
states the application requires this action to update itself. Which of the
following should the analyst do NEXT?
A. Disable the EDR policy for the critical application to ensure it updates correctly.
B. Quarantine the endpoint immediately and initiate the incident response plan.
C. Submit an exception request through the organization's change management
process.
D. Manually move the executable to the startup folder to test functionality.
Correct Answer: C. Submit an exception request through the organization's
change management process.
Rationale: The appropriate next step is to use the formal exception process. This
allows for a risk-based decision where the update's necessity can be weighed
against the security risk. Disabling policy (A) is inappropriate without approval.
Quarantining the endpoint (B) is drastic for a known, developer-justified behavior.
Manually moving the file (D) bypasses the security control and is not a proper
procedure.
3. A security incident response team is investigating a ransomware attack. A
proprietary database server has been encrypted, and the attackers have left a
ransom note demanding payment in cryptocurrency. In accordance with the
incident response plan, which of the following is the FIRST priority?
A. Negotiating with the attackers to reduce the ransom amount.
B. Determining the root cause of the initial compromise.
,C. Restoring operations from known good backups.
D. Containing the incident to prevent further spread.
Correct Answer: D. Containing the incident to prevent further spread.
Rationale: Containment is the primary objective during the initial response to a
ransomware attack. It stops the threat from spreading to other critical systems.
While restoring from backups (C) is the next step in recovery and root cause
analysis (B) is vital for prevention, these occur after the immediate threat is
contained. Negotiating with attackers (A) is generally discouraged and is not a
response priority.
4. Which of the following is the PRIMARY advantage of implementing a
Security Information and Event Management (SIEM) system for log
aggregation and correlation?
A. It provides real-time prevention of known malware signatures.
B. It enables the detection of complex, multi-stage attacks by correlating events
across different systems.
C. It ensures data is encrypted in transit and at rest.
D. It automates the patching process for all operating systems.
Correct Answer: B. It enables the detection of complex, multi-stage attacks by
correlating events across different systems.
Rationale: A SIEM's core strength is its ability to correlate disparate log data from
various network devices, servers, and applications. This correlation uncovers attack
patterns that would be invisible when viewing logs in isolation. It is a detection, not
, a prevention, tool (A). While it may facilitate compliance, data encryption is not its
primary function (C), and it does not perform patching (D).
5. A vulnerability scan identifies that a Linux web server is running an outdated
version of OpenSSL, which is vulnerable to the Heartbleed bug. The
organization has no compensating controls in place. Which of the following is
the MOST effective action to remediate this vulnerability?
A. Upgrade the web server's operating system to a newer version.
B. Apply the vendor-provided security patch for the OpenSSL library.
C. Implement an application-layer firewall to inspect SSL/TLS traffic.
D. Disable SSL/TLS on the web server and implement SSH-only access.
Correct Answer: B. Apply the vendor-provided security patch for the OpenSSL
library.
Rationale: The definitive fix for the Heartbleed vulnerability is to upgrade OpenSSL
to a patched version. Patching directly addresses the flaw in the software.
Upgrading the OS (A) might be a strategy but is less targeted than patching the
specific vulnerable library. A WAF (C) might mitigate the risk of exploitation but
does not fix the underlying vulnerability in the service. Disabling SSL/TLS (D) would
render the web server useless for its primary purpose.
6. An organization is developing a new software application and is defining its
security requirements. They want to ensure that a user is only granted the
AND WELL DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED PASS |
2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE TEST
1. A security analyst is reviewing suspicious network traffic and discovers an
internal host is sending a high volume of outbound connection requests to
random destination IP addresses over port 4444. The internal host responds to
these connections by sending encoded data payloads. Which of the following
BEST describes this situation?
A. The host is participating in a reflection attack.
B. The host is functioning as a command-and-control beacon.
C. The host is exfiltrating data using a covert channel.
D. The host is infected with a worm that is scanning for vulnerabilities.
Correct Answer: B. The host is functioning as a command-and-control beacon.
Rationale: The internal host's behavior of initiating outbound connections to
random IPs on a non-standard port (4444) and sending encoded payloads is classic
C2 beaconing. It attempts to establish a communication channel with an external
controller. A reflection attack would involve a third-party server (A). A covert
channel usually hides data within legitimate protocols (C), and while a worm may
scan (D), the response with encoded payloads points toward active two-way
communication with an external threat actor.
2. A security analyst is investigating an alert triggered by an endpoint
detection and response (EDR) tool. The alert indicates that a critical business
application attempted to write an executable file to the Windows startup
,folder, which was then blocked by the EDR's policy. The application developer
states the application requires this action to update itself. Which of the
following should the analyst do NEXT?
A. Disable the EDR policy for the critical application to ensure it updates correctly.
B. Quarantine the endpoint immediately and initiate the incident response plan.
C. Submit an exception request through the organization's change management
process.
D. Manually move the executable to the startup folder to test functionality.
Correct Answer: C. Submit an exception request through the organization's
change management process.
Rationale: The appropriate next step is to use the formal exception process. This
allows for a risk-based decision where the update's necessity can be weighed
against the security risk. Disabling policy (A) is inappropriate without approval.
Quarantining the endpoint (B) is drastic for a known, developer-justified behavior.
Manually moving the file (D) bypasses the security control and is not a proper
procedure.
3. A security incident response team is investigating a ransomware attack. A
proprietary database server has been encrypted, and the attackers have left a
ransom note demanding payment in cryptocurrency. In accordance with the
incident response plan, which of the following is the FIRST priority?
A. Negotiating with the attackers to reduce the ransom amount.
B. Determining the root cause of the initial compromise.
,C. Restoring operations from known good backups.
D. Containing the incident to prevent further spread.
Correct Answer: D. Containing the incident to prevent further spread.
Rationale: Containment is the primary objective during the initial response to a
ransomware attack. It stops the threat from spreading to other critical systems.
While restoring from backups (C) is the next step in recovery and root cause
analysis (B) is vital for prevention, these occur after the immediate threat is
contained. Negotiating with attackers (A) is generally discouraged and is not a
response priority.
4. Which of the following is the PRIMARY advantage of implementing a
Security Information and Event Management (SIEM) system for log
aggregation and correlation?
A. It provides real-time prevention of known malware signatures.
B. It enables the detection of complex, multi-stage attacks by correlating events
across different systems.
C. It ensures data is encrypted in transit and at rest.
D. It automates the patching process for all operating systems.
Correct Answer: B. It enables the detection of complex, multi-stage attacks by
correlating events across different systems.
Rationale: A SIEM's core strength is its ability to correlate disparate log data from
various network devices, servers, and applications. This correlation uncovers attack
patterns that would be invisible when viewing logs in isolation. It is a detection, not
, a prevention, tool (A). While it may facilitate compliance, data encryption is not its
primary function (C), and it does not perform patching (D).
5. A vulnerability scan identifies that a Linux web server is running an outdated
version of OpenSSL, which is vulnerable to the Heartbleed bug. The
organization has no compensating controls in place. Which of the following is
the MOST effective action to remediate this vulnerability?
A. Upgrade the web server's operating system to a newer version.
B. Apply the vendor-provided security patch for the OpenSSL library.
C. Implement an application-layer firewall to inspect SSL/TLS traffic.
D. Disable SSL/TLS on the web server and implement SSH-only access.
Correct Answer: B. Apply the vendor-provided security patch for the OpenSSL
library.
Rationale: The definitive fix for the Heartbleed vulnerability is to upgrade OpenSSL
to a patched version. Patching directly addresses the flaw in the software.
Upgrading the OS (A) might be a strategy but is less targeted than patching the
specific vulnerable library. A WAF (C) might mitigate the risk of exploitation but
does not fix the underlying vulnerability in the service. Disabling SSL/TLS (D) would
render the web server useless for its primary purpose.
6. An organization is developing a new software application and is defining its
security requirements. They want to ensure that a user is only granted the
