COMPTIA CYSA+ CS0-003 CERTIFICATION
EXAM WITH QUESTIONS AND VERIFIED
ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A security analyst notices that a workstation is making repeated
outbound connections to an unfamiliar IP address over TCP port
443 every five minutes. The connections continue even when the user
is not actively using the workstation. Firewall logs show successful
outbound sessions, while the endpoint has recently exhibited high
CPU utilization. Which activity should the analyst perform FIRST?
A. Immediately reimage the workstation
B. Block all HTTPS traffic at the firewall
C. Investigate the destination IP, process initiating the connections, and
associated endpoint telemetry
D. Disable the organization's DNS servers
Answer: C. Investigate the destination IP, process initiating the
connections, and associated endpoint telemetry
Rationale: The recurring outbound HTTPS connections could
indicate command-and-control activity, malware beaconing, or a
legitimate application. The analyst should first correlate network and
endpoint evidence to determine what process is responsible and
whether the destination is malicious. Reimaging immediately could
destroy valuable forensic evidence, while blocking all HTTPS traffic
would create excessive operational impact.
1
,2. A SOC analyst receives an alert indicating that a user's account
successfully authenticated from Nairobi at 09:15 and from New
York at 09:22. The organization's identity provider confirms that
both logins used valid credentials. Which detection technique would
BEST identify this situation?
A. Impossible-travel analysis
B. File-integrity monitoring
C. Port scanning
D. Vulnerability scanning
Answer: A. Impossible-travel analysis
Rationale: Impossible-travel detection compares authentication events
and geographic locations to identify logins that could not realistically
have occurred within the elapsed time. The events could indicate
credential theft, session hijacking, VPN usage, or inaccurate
geolocation and should therefore be investigated rather than
automatically treated as confirmed compromise.
3. A company wants to identify vulnerabilities in internet-facing
servers without actively exploiting them. Which activity BEST meets
this requirement?
A. Penetration testing
B. Vulnerability scanning
C. Exploit development
D. Red-team operations
Answer: B. Vulnerability scanning
Rationale: Vulnerability scanning identifies known weaknesses,
missing patches, insecure configurations, and exposed services
without necessarily exploiting them. Penetration testing goes further
by attempting to validate exploitability, while red-team operations
2
,simulate adversarial objectives and may include exploitation and
lateral movement.
4. A vulnerability scanner reports that a web server is vulnerable to
a particular CVE. The security team wants to determine whether
the vulnerability can actually be exploited in the organization's
environment. Which activity should be performed?
A. Asset inventory
B. Vulnerability prioritization
C. Penetration testing
D. Log normalization
Answer: C. Penetration testing
Rationale: Vulnerability scanning identifies potential vulnerabilities,
but penetration testing attempts to validate whether vulnerabilities are
exploitable under defined rules of engagement. This distinction helps
reduce false positives and provides stronger evidence of actual security
exposure.
5. During an investigation, an analyst sees the following sequence:
powershell.exe → encoded command → download from external IP →
execution in memory
Which attack technique is MOST likely represented?
A. Living-off-the-land activity
B. Physical tampering
C. Password spraying
D. ARP poisoning
Answer: A. Living-off-the-land activity
3
, Rationale: Living-off-the-land techniques abuse legitimate tools
already present on the system, such as PowerShell, to perform
malicious activities. Attackers frequently use PowerShell for
downloading payloads, executing commands, bypassing controls, and
maintaining access while reducing the need to introduce obvious
malicious binaries.
6. A SIEM receives millions of events each day from firewalls,
endpoints, DNS servers, authentication systems, and cloud services.
Which SIEM capability allows events from these different sources to
be interpreted consistently?
A. Data normalization
B. Data destruction
C. Disk encryption
D. Network segmentation
Answer: A. Data normalization
Rationale: Data normalization converts information from different
sources into consistent fields and formats. This allows analysts and
detection rules to correlate events even when different systems use
different terminology, timestamps, field names, or log structures.
7. A security analyst creates the following detection logic:
IF multiple failed logins occur for many different usernames from the
same source IP within a short period THEN generate an alert.
What attack is this rule primarily designed to detect?
A. Credential stuffing
B. Password spraying
4
EXAM WITH QUESTIONS AND VERIFIED
ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A security analyst notices that a workstation is making repeated
outbound connections to an unfamiliar IP address over TCP port
443 every five minutes. The connections continue even when the user
is not actively using the workstation. Firewall logs show successful
outbound sessions, while the endpoint has recently exhibited high
CPU utilization. Which activity should the analyst perform FIRST?
A. Immediately reimage the workstation
B. Block all HTTPS traffic at the firewall
C. Investigate the destination IP, process initiating the connections, and
associated endpoint telemetry
D. Disable the organization's DNS servers
Answer: C. Investigate the destination IP, process initiating the
connections, and associated endpoint telemetry
Rationale: The recurring outbound HTTPS connections could
indicate command-and-control activity, malware beaconing, or a
legitimate application. The analyst should first correlate network and
endpoint evidence to determine what process is responsible and
whether the destination is malicious. Reimaging immediately could
destroy valuable forensic evidence, while blocking all HTTPS traffic
would create excessive operational impact.
1
,2. A SOC analyst receives an alert indicating that a user's account
successfully authenticated from Nairobi at 09:15 and from New
York at 09:22. The organization's identity provider confirms that
both logins used valid credentials. Which detection technique would
BEST identify this situation?
A. Impossible-travel analysis
B. File-integrity monitoring
C. Port scanning
D. Vulnerability scanning
Answer: A. Impossible-travel analysis
Rationale: Impossible-travel detection compares authentication events
and geographic locations to identify logins that could not realistically
have occurred within the elapsed time. The events could indicate
credential theft, session hijacking, VPN usage, or inaccurate
geolocation and should therefore be investigated rather than
automatically treated as confirmed compromise.
3. A company wants to identify vulnerabilities in internet-facing
servers without actively exploiting them. Which activity BEST meets
this requirement?
A. Penetration testing
B. Vulnerability scanning
C. Exploit development
D. Red-team operations
Answer: B. Vulnerability scanning
Rationale: Vulnerability scanning identifies known weaknesses,
missing patches, insecure configurations, and exposed services
without necessarily exploiting them. Penetration testing goes further
by attempting to validate exploitability, while red-team operations
2
,simulate adversarial objectives and may include exploitation and
lateral movement.
4. A vulnerability scanner reports that a web server is vulnerable to
a particular CVE. The security team wants to determine whether
the vulnerability can actually be exploited in the organization's
environment. Which activity should be performed?
A. Asset inventory
B. Vulnerability prioritization
C. Penetration testing
D. Log normalization
Answer: C. Penetration testing
Rationale: Vulnerability scanning identifies potential vulnerabilities,
but penetration testing attempts to validate whether vulnerabilities are
exploitable under defined rules of engagement. This distinction helps
reduce false positives and provides stronger evidence of actual security
exposure.
5. During an investigation, an analyst sees the following sequence:
powershell.exe → encoded command → download from external IP →
execution in memory
Which attack technique is MOST likely represented?
A. Living-off-the-land activity
B. Physical tampering
C. Password spraying
D. ARP poisoning
Answer: A. Living-off-the-land activity
3
, Rationale: Living-off-the-land techniques abuse legitimate tools
already present on the system, such as PowerShell, to perform
malicious activities. Attackers frequently use PowerShell for
downloading payloads, executing commands, bypassing controls, and
maintaining access while reducing the need to introduce obvious
malicious binaries.
6. A SIEM receives millions of events each day from firewalls,
endpoints, DNS servers, authentication systems, and cloud services.
Which SIEM capability allows events from these different sources to
be interpreted consistently?
A. Data normalization
B. Data destruction
C. Disk encryption
D. Network segmentation
Answer: A. Data normalization
Rationale: Data normalization converts information from different
sources into consistent fields and formats. This allows analysts and
detection rules to correlate events even when different systems use
different terminology, timestamps, field names, or log structures.
7. A security analyst creates the following detection logic:
IF multiple failed logins occur for many different usernames from the
same source IP within a short period THEN generate an alert.
What attack is this rule primarily designed to detect?
A. Credential stuffing
B. Password spraying
4
