COMPTIA CYSA+ CS0-003 CERTIFICATION
EXAM WITH QUESTIONS AND VERIFIED
ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
Question 1
A security analyst is reviewing an alert indicating that a workstation has
generated an unusually large number of outbound DNS queries to
randomly generated subdomains of the same domain. The queries occur
at regular intervals and contain encoded-looking strings. No legitimate
application on the workstation is known to use this domain. Which
activity is MOST likely occurring?
A. DNS cache poisoning
B. DNS tunneling
C. ARP spoofing
D. DHCP starvation
Answer: B. DNS tunneling
Rationale: DNS tunneling can encode data inside DNS queries or
responses and is commonly used for command-and-control
communication or data exfiltration. High-frequency queries
containing randomized or encoded subdomains and periodic
communication are strong indicators. DNS cache poisoning instead
manipulates DNS responses, while ARP spoofing targets local Layer 2
address resolution.
Question 2
1
,A SOC analyst receives an alert from an EDR platform showing that
winword.exe spawned powershell.exe, which then executed an encoded
command that downloaded a file from an external IP address. What
should the analyst classify this activity as?
A. Normal application behavior
B. Potential malicious execution chain
C. DNS poisoning
D. Credential expiration
Answer: B. Potential malicious execution chain
Rationale: Microsoft Word spawning PowerShell followed by encoded
command execution and an external download is a suspicious process
chain. This pattern is frequently associated with malicious documents,
script-based execution, and initial compromise. The analyst should
investigate the parent-child process relationship, command line,
downloaded artifact, network destination, and user context.
Question 3
An organization wants to detect malicious activity by comparing
observed endpoint behavior against known indicators such as SHA-256
hashes, malicious IP addresses, domains, and file names. Which
detection approach is being used?
A. Signature-based detection
B. Behavioral baselining
C. Heuristic anomaly detection
D. User behavior analytics
Answer: A. Signature-based detection
Rationale: Signature-based detection compares observed artifacts or
activity against known malicious patterns or indicators. Hashes, IP
addresses, domains, and known file signatures are common examples.
2
,Behavioral and anomaly-based approaches instead identify deviations
from expected activity or suspicious characteristics without necessarily
requiring a previously known indicator.
Question 4
During threat hunting, an analyst discovers that a workstation
communicates with an external IP every 15 minutes, even when the user
is logged off. Which artifact would be MOST useful for determining
whether a persistence mechanism is responsible?
A. Browser bookmarks
B. Scheduled tasks
C. Screen resolution
D. Printer configuration
Answer: B. Scheduled tasks
Rationale: Scheduled tasks can execute programs automatically
according to a defined schedule and are therefore a common
persistence mechanism. A recurring connection every 15 minutes
should prompt examination of scheduled tasks, services, startup
entries, WMI persistence, registry mechanisms, and other automated
execution mechanisms.
Question 5
A company discovers that an attacker has obtained valid employee
credentials and is accessing internal systems without deploying malware.
Which type of attack is MOST consistent with this scenario?
A. Living-off-the-land activity
B. Credential-based attack
3
, C. Buffer overflow
D. Denial-of-service attack
Answer: B. Credential-based attack
Rationale: The defining characteristic is unauthorized use of
legitimate credentials. Attackers frequently use stolen passwords,
tokens, session cookies, or other authentication material to access
systems while attempting to blend into legitimate activity. This can
make detection more difficult because authentication itself may appear
legitimate.
Question 6
A security analyst receives the following Windows event information:
Event ID 4624
Successful logon
Logon Type 10
Source IP belongs to an external network
What does the event MOST likely represent?
A. Interactive local console logon
B. Remote interactive logon
C. Service startup
D. Account creation
Answer: B. Remote interactive logon
Rationale: Windows Event ID 4624 indicates a successful logon.
Logon Type 10 corresponds to a RemoteInteractive logon, commonly
associated with Remote Desktop Protocol (RDP). An externally
sourced Type 10 logon should be investigated carefully because
4
EXAM WITH QUESTIONS AND VERIFIED
ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
Question 1
A security analyst is reviewing an alert indicating that a workstation has
generated an unusually large number of outbound DNS queries to
randomly generated subdomains of the same domain. The queries occur
at regular intervals and contain encoded-looking strings. No legitimate
application on the workstation is known to use this domain. Which
activity is MOST likely occurring?
A. DNS cache poisoning
B. DNS tunneling
C. ARP spoofing
D. DHCP starvation
Answer: B. DNS tunneling
Rationale: DNS tunneling can encode data inside DNS queries or
responses and is commonly used for command-and-control
communication or data exfiltration. High-frequency queries
containing randomized or encoded subdomains and periodic
communication are strong indicators. DNS cache poisoning instead
manipulates DNS responses, while ARP spoofing targets local Layer 2
address resolution.
Question 2
1
,A SOC analyst receives an alert from an EDR platform showing that
winword.exe spawned powershell.exe, which then executed an encoded
command that downloaded a file from an external IP address. What
should the analyst classify this activity as?
A. Normal application behavior
B. Potential malicious execution chain
C. DNS poisoning
D. Credential expiration
Answer: B. Potential malicious execution chain
Rationale: Microsoft Word spawning PowerShell followed by encoded
command execution and an external download is a suspicious process
chain. This pattern is frequently associated with malicious documents,
script-based execution, and initial compromise. The analyst should
investigate the parent-child process relationship, command line,
downloaded artifact, network destination, and user context.
Question 3
An organization wants to detect malicious activity by comparing
observed endpoint behavior against known indicators such as SHA-256
hashes, malicious IP addresses, domains, and file names. Which
detection approach is being used?
A. Signature-based detection
B. Behavioral baselining
C. Heuristic anomaly detection
D. User behavior analytics
Answer: A. Signature-based detection
Rationale: Signature-based detection compares observed artifacts or
activity against known malicious patterns or indicators. Hashes, IP
addresses, domains, and known file signatures are common examples.
2
,Behavioral and anomaly-based approaches instead identify deviations
from expected activity or suspicious characteristics without necessarily
requiring a previously known indicator.
Question 4
During threat hunting, an analyst discovers that a workstation
communicates with an external IP every 15 minutes, even when the user
is logged off. Which artifact would be MOST useful for determining
whether a persistence mechanism is responsible?
A. Browser bookmarks
B. Scheduled tasks
C. Screen resolution
D. Printer configuration
Answer: B. Scheduled tasks
Rationale: Scheduled tasks can execute programs automatically
according to a defined schedule and are therefore a common
persistence mechanism. A recurring connection every 15 minutes
should prompt examination of scheduled tasks, services, startup
entries, WMI persistence, registry mechanisms, and other automated
execution mechanisms.
Question 5
A company discovers that an attacker has obtained valid employee
credentials and is accessing internal systems without deploying malware.
Which type of attack is MOST consistent with this scenario?
A. Living-off-the-land activity
B. Credential-based attack
3
, C. Buffer overflow
D. Denial-of-service attack
Answer: B. Credential-based attack
Rationale: The defining characteristic is unauthorized use of
legitimate credentials. Attackers frequently use stolen passwords,
tokens, session cookies, or other authentication material to access
systems while attempting to blend into legitimate activity. This can
make detection more difficult because authentication itself may appear
legitimate.
Question 6
A security analyst receives the following Windows event information:
Event ID 4624
Successful logon
Logon Type 10
Source IP belongs to an external network
What does the event MOST likely represent?
A. Interactive local console logon
B. Remote interactive logon
C. Service startup
D. Account creation
Answer: B. Remote interactive logon
Rationale: Windows Event ID 4624 indicates a successful logon.
Logon Type 10 corresponds to a RemoteInteractive logon, commonly
associated with Remote Desktop Protocol (RDP). An externally
sourced Type 10 logon should be investigated carefully because
4
