Maryland Cybersecurity Analyst
Certification Exam Practice Questions
And Correct Answers (Verified Answers)
Plus Rationale 2026 Q&A| Instant
Download Pdf
1. During a security operations center (SOC) shift, a cybersecurity analyst
notices repeated failed login attempts against multiple privileged
accounts originating from several geographic regions within a short
period. Which action should be performed FIRST to determine
whether the activity represents a coordinated credential-stuffing
attack?
A. Immediately rebuild all affected servers
B. Analyze authentication logs, source IP patterns, and account activity
correlations
C. Disable every user account in the organization
D. Remove all internet connectivity permanently
B. Analyze authentication logs, source IP patterns, and account activity
correlations
Rationale: Effective cybersecurity analysis begins with evidence collection
and correlation. Reviewing authentication logs and identifying patterns
helps determine whether the activity represents a coordinated attack
before containment measures are implemented.
, 2. Which cybersecurity principle ensures that information is accessible to
authorized users whenever needed for legitimate business
operations?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
C. Availability
Rationale: Availability is one component of the CIA triad and focuses on
ensuring systems, services, and data remain accessible to authorized users
when required.
3. A vulnerability scan identifies a critical remote code execution flaw on
an externally facing web server. What factor should most influence
remediation prioritization?
A. Color of the server chassis
B. Physical location of the analyst's desk
C. Likelihood of exploitation and business impact
D. Number of users in the cafeteria
C. Likelihood of exploitation and business impact
Rationale: Vulnerability prioritization should consider exploitability, threat
exposure, and potential organizational impact rather than irrelevant
operational factors.
4. Which type of malware is specifically designed to appear legitimate
while secretly performing malicious actions?
A. Trojan horse
B. Worm
C. Logic bomb
D. Rootkit
,A. Trojan horse
Rationale: A Trojan horse disguises itself as legitimate software to deceive
users into executing malicious code.
5. An analyst reviewing network traffic notices large volumes of
outbound encrypted data leaving a database server during
nonbusiness hours. What is the most likely security concern?
A. Data exfiltration
B. Patch deployment
C. System hardening
D. Asset inventory management
A. Data exfiltration
Rationale: Unusual outbound transfers, particularly involving sensitive
systems and off-hours activity, commonly indicate potential data theft or
exfiltration attempts.
6. Which framework provides a structured process for identifying,
protecting, detecting, responding to, and recovering from
cybersecurity incidents?
A. OSI Model
B. NIST Cybersecurity Framework
C. TCP/IP Suite
D. Agile Manifesto
B. NIST Cybersecurity Framework
Rationale: The NIST Cybersecurity Framework organizes cybersecurity
activities into core functions that guide risk management and security
program development.
7. What is the primary purpose of threat intelligence within a
cybersecurity program?
, A. Eliminating all cyber risks permanently
B. Providing actionable information about potential threats and adversaries
C. Replacing firewalls and intrusion detection systems
D. Increasing internet bandwidth
B. Providing actionable information about potential threats and
adversaries
Rationale: Threat intelligence helps organizations understand emerging
threats, attacker tactics, and indicators of compromise to improve
defensive capabilities.
8. A cybersecurity analyst discovers a system communicating with a
known command-and-control server. What phase of the cyber kill
chain is most directly indicated?
A. Reconnaissance
B. Weaponization
C. Command and Control
D. Delivery
C. Command and Control
Rationale: Communication with a command-and-control infrastructure
indicates attackers have established a channel to manage compromised
systems.
9. Which security control category includes policies, procedures, training,
and governance requirements?
A. Administrative controls
B. Physical controls
C. Technical controls
D. Environmental controls
A. Administrative controls
Certification Exam Practice Questions
And Correct Answers (Verified Answers)
Plus Rationale 2026 Q&A| Instant
Download Pdf
1. During a security operations center (SOC) shift, a cybersecurity analyst
notices repeated failed login attempts against multiple privileged
accounts originating from several geographic regions within a short
period. Which action should be performed FIRST to determine
whether the activity represents a coordinated credential-stuffing
attack?
A. Immediately rebuild all affected servers
B. Analyze authentication logs, source IP patterns, and account activity
correlations
C. Disable every user account in the organization
D. Remove all internet connectivity permanently
B. Analyze authentication logs, source IP patterns, and account activity
correlations
Rationale: Effective cybersecurity analysis begins with evidence collection
and correlation. Reviewing authentication logs and identifying patterns
helps determine whether the activity represents a coordinated attack
before containment measures are implemented.
, 2. Which cybersecurity principle ensures that information is accessible to
authorized users whenever needed for legitimate business
operations?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
C. Availability
Rationale: Availability is one component of the CIA triad and focuses on
ensuring systems, services, and data remain accessible to authorized users
when required.
3. A vulnerability scan identifies a critical remote code execution flaw on
an externally facing web server. What factor should most influence
remediation prioritization?
A. Color of the server chassis
B. Physical location of the analyst's desk
C. Likelihood of exploitation and business impact
D. Number of users in the cafeteria
C. Likelihood of exploitation and business impact
Rationale: Vulnerability prioritization should consider exploitability, threat
exposure, and potential organizational impact rather than irrelevant
operational factors.
4. Which type of malware is specifically designed to appear legitimate
while secretly performing malicious actions?
A. Trojan horse
B. Worm
C. Logic bomb
D. Rootkit
,A. Trojan horse
Rationale: A Trojan horse disguises itself as legitimate software to deceive
users into executing malicious code.
5. An analyst reviewing network traffic notices large volumes of
outbound encrypted data leaving a database server during
nonbusiness hours. What is the most likely security concern?
A. Data exfiltration
B. Patch deployment
C. System hardening
D. Asset inventory management
A. Data exfiltration
Rationale: Unusual outbound transfers, particularly involving sensitive
systems and off-hours activity, commonly indicate potential data theft or
exfiltration attempts.
6. Which framework provides a structured process for identifying,
protecting, detecting, responding to, and recovering from
cybersecurity incidents?
A. OSI Model
B. NIST Cybersecurity Framework
C. TCP/IP Suite
D. Agile Manifesto
B. NIST Cybersecurity Framework
Rationale: The NIST Cybersecurity Framework organizes cybersecurity
activities into core functions that guide risk management and security
program development.
7. What is the primary purpose of threat intelligence within a
cybersecurity program?
, A. Eliminating all cyber risks permanently
B. Providing actionable information about potential threats and adversaries
C. Replacing firewalls and intrusion detection systems
D. Increasing internet bandwidth
B. Providing actionable information about potential threats and
adversaries
Rationale: Threat intelligence helps organizations understand emerging
threats, attacker tactics, and indicators of compromise to improve
defensive capabilities.
8. A cybersecurity analyst discovers a system communicating with a
known command-and-control server. What phase of the cyber kill
chain is most directly indicated?
A. Reconnaissance
B. Weaponization
C. Command and Control
D. Delivery
C. Command and Control
Rationale: Communication with a command-and-control infrastructure
indicates attackers have established a channel to manage compromised
systems.
9. Which security control category includes policies, procedures, training,
and governance requirements?
A. Administrative controls
B. Physical controls
C. Technical controls
D. Environmental controls
A. Administrative controls
