CompTIA CySA+ Certification Exam 2026 Latest
Comprehensive Study Guide with Practice Questions,
Cybersecurity Analyst Review, Verified Answers,
Success Preparation Workbook
EXAM OVERVIEW
The CompTIA Cybersecurity Analyst (CySA+) certification requires passing
the CS0-003 exam. The exam consists of a maximum of 85 questions (multiple-
choice and performance-based) with a 165-minute time limit. The passing score
is 750 on a scale of 100–900.
CS0-003 Domains & Weights:
Domain Weight
1.0 Security Operations 33%
2.0 Vulnerability Management 30%
3.0 Incident Response and Management 20%
4.0 Reporting and Communication 17%
Recommended Experience: Network+ and Security+ or equivalent knowledge,
with a minimum of 4 years of hands-on experience as an incident response analyst,
SOC analyst, or equivalent.
DOMAIN 1.0: SECURITY OPERATIONS (33%)
Question 1
A security analyst is reviewing SIEM logs and notices an unusual pattern: a single
,internal workstation is generating outbound traffic to multiple unknown external IP
addresses on port 4444 during non-business hours. The traffic volume is low but
consistent. Which of the following is the MOST likely explanation?
A. The workstation is performing routine Windows updates
B. The workstation is infected with malware using a custom C2 channel
C. The user is streaming video content
D. The workstation is performing a legitimate backup
Answer: B. The workstation is infected with malware using a custom C2
channel
Rationale: Outbound traffic on non-standard ports (4444) to unknown external IPs
during off-hours is a strong indicator of command-and-control (C2)
communication. Malware frequently uses custom ports to evade detection.
Windows updates (A) use standard ports and Microsoft-owned IPs. Video
streaming (C) would show high volume on standard ports. Backups (D) would
typically use known ports and destinations.
Question 2
A SOC analyst is investigating a potential security incident. The analyst needs to
capture network traffic for forensic analysis without alerting the attacker. Which
tool and technique should be used?
A. Nmap with aggressive scanning
B. Wireshark in promiscuous mode on a SPAN port
C. Netstat to view active connections
D. Ping sweep to identify active hosts
Answer: B. Wireshark in promiscuous mode on a SPAN port
Rationale: Wireshark in promiscuous mode on a SPAN (Switched Port Analyzer)
port allows passive traffic capture without generating detectable traffic. Nmap
aggressive scanning (A) generates traffic that could alert attackers. Netstat (C) only
shows local connections, not full packet capture. Ping sweeps (D) generate
detectable traffic.
,Question 3
A security analyst is reviewing logs from a web application firewall (WAF) and
sees multiple requests containing ../../etc/passwd in the URL parameters. Which
type of attack is being attempted?
A. SQL injection
B. Cross-site scripting (XSS)
C. Directory traversal
D. Command injection
Answer: C. Directory traversal
Rationale: The ../ pattern in URL parameters indicates a directory traversal (path
traversal) attack attempting to access files outside the web root directory. SQL
injection (A) would contain SQL syntax like ' OR '1'='1. XSS (B) would contain
script tags. Command injection (D) would contain system commands.
Question 4
An organization is implementing a threat hunting program. Which of the following
is the PRIMARY difference between threat hunting and traditional security
monitoring?
A. Threat hunting is automated while monitoring is manual
B. Threat hunting is proactive hypothesis-driven investigation while monitoring is
reactive alert response
C. Threat hunting only uses open-source intelligence
D. Threat hunting replaces the need for SIEM
Answer: B. Threat hunting is proactive hypothesis-driven investigation while
monitoring is reactive alert response
Rationale: Threat hunting is a proactive process where analysts actively search for
threats based on hypotheses, whereas traditional monitoring reacts to alerts
generated by security tools. Both can use automation (A). Threat hunting uses
multiple intelligence sources (C) and complements rather than replaces SIEM (D).
Question 5
A security analyst is analyzing a suspicious email. The email claims to be from the
, CEO and urgently requests a wire transfer. The sender's display name matches the
CEO, but the actual email address is . This is an
example of which type of attack?
A. Phishing
B. Spear phishing
C. Business Email Compromise (BEC)
D. SMiShing
Answer: C. Business Email Compromise (BEC)
Rationale: BEC is a sophisticated phishing variant where attackers impersonate
executives to trick employees into performing financial transactions or revealing
sensitive information. The display name spoofing and urgent request for a wire
transfer are classic BEC indicators. General phishing (A) is broader. Spear
phishing (B) targets specific individuals but not necessarily for financial fraud.
SMiShing (D) uses SMS.
Question 6
A SOC analyst is tuning a SIEM to reduce false positives. Which of the following
actions would be MOST effective?
A. Increase the retention period for all logs
B. Implement correlation rules that require multiple indicators before generating an
alert
C. Disable all low-severity alerts
D. Increase the polling interval for log collection
Answer: B. Implement correlation rules that require multiple indicators
before generating an alert
Rationale: Correlation rules that combine multiple indicators reduce false
positives by requiring a pattern of suspicious activity before alerting. Increasing
retention (A) doesn't reduce false positives. Disabling alerts (C) risks missing real
threats. Increasing polling intervals (D) may delay detection but doesn't improve
accuracy.
Comprehensive Study Guide with Practice Questions,
Cybersecurity Analyst Review, Verified Answers,
Success Preparation Workbook
EXAM OVERVIEW
The CompTIA Cybersecurity Analyst (CySA+) certification requires passing
the CS0-003 exam. The exam consists of a maximum of 85 questions (multiple-
choice and performance-based) with a 165-minute time limit. The passing score
is 750 on a scale of 100–900.
CS0-003 Domains & Weights:
Domain Weight
1.0 Security Operations 33%
2.0 Vulnerability Management 30%
3.0 Incident Response and Management 20%
4.0 Reporting and Communication 17%
Recommended Experience: Network+ and Security+ or equivalent knowledge,
with a minimum of 4 years of hands-on experience as an incident response analyst,
SOC analyst, or equivalent.
DOMAIN 1.0: SECURITY OPERATIONS (33%)
Question 1
A security analyst is reviewing SIEM logs and notices an unusual pattern: a single
,internal workstation is generating outbound traffic to multiple unknown external IP
addresses on port 4444 during non-business hours. The traffic volume is low but
consistent. Which of the following is the MOST likely explanation?
A. The workstation is performing routine Windows updates
B. The workstation is infected with malware using a custom C2 channel
C. The user is streaming video content
D. The workstation is performing a legitimate backup
Answer: B. The workstation is infected with malware using a custom C2
channel
Rationale: Outbound traffic on non-standard ports (4444) to unknown external IPs
during off-hours is a strong indicator of command-and-control (C2)
communication. Malware frequently uses custom ports to evade detection.
Windows updates (A) use standard ports and Microsoft-owned IPs. Video
streaming (C) would show high volume on standard ports. Backups (D) would
typically use known ports and destinations.
Question 2
A SOC analyst is investigating a potential security incident. The analyst needs to
capture network traffic for forensic analysis without alerting the attacker. Which
tool and technique should be used?
A. Nmap with aggressive scanning
B. Wireshark in promiscuous mode on a SPAN port
C. Netstat to view active connections
D. Ping sweep to identify active hosts
Answer: B. Wireshark in promiscuous mode on a SPAN port
Rationale: Wireshark in promiscuous mode on a SPAN (Switched Port Analyzer)
port allows passive traffic capture without generating detectable traffic. Nmap
aggressive scanning (A) generates traffic that could alert attackers. Netstat (C) only
shows local connections, not full packet capture. Ping sweeps (D) generate
detectable traffic.
,Question 3
A security analyst is reviewing logs from a web application firewall (WAF) and
sees multiple requests containing ../../etc/passwd in the URL parameters. Which
type of attack is being attempted?
A. SQL injection
B. Cross-site scripting (XSS)
C. Directory traversal
D. Command injection
Answer: C. Directory traversal
Rationale: The ../ pattern in URL parameters indicates a directory traversal (path
traversal) attack attempting to access files outside the web root directory. SQL
injection (A) would contain SQL syntax like ' OR '1'='1. XSS (B) would contain
script tags. Command injection (D) would contain system commands.
Question 4
An organization is implementing a threat hunting program. Which of the following
is the PRIMARY difference between threat hunting and traditional security
monitoring?
A. Threat hunting is automated while monitoring is manual
B. Threat hunting is proactive hypothesis-driven investigation while monitoring is
reactive alert response
C. Threat hunting only uses open-source intelligence
D. Threat hunting replaces the need for SIEM
Answer: B. Threat hunting is proactive hypothesis-driven investigation while
monitoring is reactive alert response
Rationale: Threat hunting is a proactive process where analysts actively search for
threats based on hypotheses, whereas traditional monitoring reacts to alerts
generated by security tools. Both can use automation (A). Threat hunting uses
multiple intelligence sources (C) and complements rather than replaces SIEM (D).
Question 5
A security analyst is analyzing a suspicious email. The email claims to be from the
, CEO and urgently requests a wire transfer. The sender's display name matches the
CEO, but the actual email address is . This is an
example of which type of attack?
A. Phishing
B. Spear phishing
C. Business Email Compromise (BEC)
D. SMiShing
Answer: C. Business Email Compromise (BEC)
Rationale: BEC is a sophisticated phishing variant where attackers impersonate
executives to trick employees into performing financial transactions or revealing
sensitive information. The display name spoofing and urgent request for a wire
transfer are classic BEC indicators. General phishing (A) is broader. Spear
phishing (B) targets specific individuals but not necessarily for financial fraud.
SMiShing (D) uses SMS.
Question 6
A SOC analyst is tuning a SIEM to reduce false positives. Which of the following
actions would be MOST effective?
A. Increase the retention period for all logs
B. Implement correlation rules that require multiple indicators before generating an
alert
C. Disable all low-severity alerts
D. Increase the polling interval for log collection
Answer: B. Implement correlation rules that require multiple indicators
before generating an alert
Rationale: Correlation rules that combine multiple indicators reduce false
positives by requiring a pattern of suspicious activity before alerting. Increasing
retention (A) doesn't reduce false positives. Disabling alerts (C) risks missing real
threats. Increasing polling intervals (D) may delay detection but doesn't improve
accuracy.
