CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition
Real Exam Questions and Verified Answers (100% Correct | Multiple-Choice & Performance-Based | Graded
A+)
85 Questions | Security Operations 33% | Vulnerability Management 30% | Incident Response and Management 20% | Reporting and
Communication 17%
Section 1: Security Operations (33% of Exam) - Questions 1-28
Q1: A SOC analyst is onboarding new log sources into the organization's SIEM. The platform natively
ingests syslog and Windows Event Forwarding data, but a critical in-house business application only exposes
its audit records through a proprietary REST API. Which approach should the analyst use to bring this
application's events into the SIEM?
A. Enable syslog over UDP 514 on the application server and point it at the SIEM listener
B. Configure a dedicated API connector that queries the application's REST interface on a schedule and
normalizes events into the SIEM's common schema [CORRECT]
C. Export the application logs to CSV once per week and import the files manually into the SIEM
D. Configure the host firewall to mirror blocked-connection messages to the SIEM in place of application
audit logging
Correct Answer: B
Rationale: A proprietary REST-based source requires a purpose-built API connector or agent that retrieves events and
maps their fields to the SIEM's normalized schema, preserving timeliness and searchability. Option A fails because the
application does not natively emit syslog, and converting it is not possible by merely opening UDP 514. Option C
destroys the near-real-time detection value the SOC needs and introduces human error and gaps. Option D supplies only
a narrow slice of network events, not the application's own audit trail, so correlation use cases would be blind to user
activity inside the application.
Q2: During a quarterly access review, an analyst discovers that the service account used by the backup
application is a member of the local Administrators group and is permitted to log on interactively to any
server in the domain. Which remediation best applies the principle of least privilege while keeping the
backup function working?
A. Convert the account to a domain admin account so the backup software never fails due to permissions
B. Leave the membership unchanged but enable MFA on the account for all logon types
C. Remove interactive logon rights, restrict the account to the specific servers it services, and grant only the
file-system and VSS permissions the backup job requires [CORRECT]
D. Delete the account and re-run all backup jobs under each administrator's personal credentials
Correct Answer: C
Rationale: Least privilege for service accounts means scoping the account to exactly the systems and permissions its
function needs and eliminating interactive logon capability, which removes a common lateral-movement and
credential-dumping path. Option A increases privilege and directly contradicts the access review finding. Option B does
not reduce standing privilege, and MFA is generally ineffective for unattended service authentication anyway. Option D
ties automated services to human credentials, causing failures when staff change and destroying accountability for the
service identity.
1
,CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition
Q3: A healthcare organization must protect patient records that are stored in a database and that replicate
nightly to a disaster recovery site across a WAN link. Which combination of protections addresses data at
rest and data in transit for this scenario?
A. AES-256 encryption of the database storage volumes and TLS 1.3 for the replication connection
[CORRECT]
B. TLS 1.3 for the replication connection and SHA-256 hashing of every patient record
C. Disk compression with password protection on the archive files and IPSec only between the firewalls
D. AES-256 on the database volumes and disabled replication until an audit is completed
Correct Answer: A
Rationale: Confidentiality at rest is provided by strong symmetric encryption such as AES-256 on the storage volumes,
while confidentiality and integrity in transit are provided by a modern transport protocol such as TLS 1.3 on the
replication link. Option B confuses integrity hashing with confidentiality, since hashing does not encrypt anything.
Option C relies on reversible archive passwords and a tunnel that may not cover host-to-host traffic end to end, and
compression is not a security control. Option D protects the copies but destroys the availability and resiliency
requirement that replication exists to satisfy.
Q4: Performance-Based Question - Alert Triage: An analyst returns from a weekend and finds four SIEM
alerts in the queue: (1) three failed VPN logons for one user within ten minutes, (2) a production web server
with an established outbound TLS session to a known-bad IP in a country the company does not do business
with, refreshing every 60 seconds, (3) antivirus quarantining a worm dropped by a USB device on a single
workstation, and (4) one alert that a user opened the payroll file share at 6 a.m. Which alert should be
investigated and escalated FIRST?
A. The three failed VPN logons, because failed authentication always indicates a brute-force campaign
B. The payroll share access, because payroll data is the most sensitive information in the company
C. The quarantined USB worm, because malware automatically means the environment is compromised
D. The web server beaconing to the known-bad IP, because an established recurring outbound session to
malicious infrastructure indicates likely active command-and-control compromise of a production asset
[CORRECT]
Correct Answer: D
Rationale: Triage priority is driven by likelihood of active compromise and potential impact, and a periodic established
outbound session to known malicious infrastructure is the classic signature of command-and-control beaconing on a
production system, demanding immediate investigation. Option A is a low-volume authentication failure that usually
resolves as user error. Option B involves sensitive data but a single access by a legitimate account at an unusual hour is
far more often an explanation than an attack. Option C was already contained automatically by the antivirus, so its
residual risk is much lower than an uncontained beacon.
2
, CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition
Q5: A threat intelligence vendor delivers a report that profiles a specific financially motivated group,
detailing the infrastructure it currently operates, the malware families it deploys, and the playbook it has used
in recent campaigns against companies in the same industry as your organization. Which threat intelligence
classification best describes this product?
A. Strategic intelligence, because it concerns groups rather than individual hosts
B. Technical intelligence, because it lists malware families and hashes
C. Operational intelligence, because it describes the adversary's capabilities, infrastructure, and near-term
intent in enough detail to drive defensive action [CORRECT]
D. Attribution intelligence, because it names the group responsible
Correct Answer: C
Rationale: Operational intelligence sits between strategic and tactical: it captures who the adversary is, how they
operate, what infrastructure they use now, and what they intend, which is exactly the level of detail needed to tune
detections and prioritize hunting. Option A is wrong because strategic intelligence covers long-term trends, geopolitics,
and risk posture rather than campaign-level tradecraft. Option B confuses the report with tactical technical indicators
such as hashes and IPs, which are only one small element here. Option D is not a recognized CySA+ classification, and
naming a group alone does not make intelligence actionable.
Q6: An organization wants to exchange machine-readable threat indicators with its sector ISAC
automatically throughout the day instead of receiving weekly PDF bulletins. Which pairing of standards
should the analyst implement?
A. STIX for transporting collections of indicators and TAXII for structuring the indicator content
B. TAXII as the transport protocol for delivering content that is structured in STIX format [CORRECT]
C. CSV attachments over SMTP, because all members already support email
D. MITRE ATT&CK; for transport and the Cyber Kill Chain for indicator structure
Correct Answer: B
Rationale: TAXII is the application-layer transport protocol that defines how threat information is requested and
delivered between systems, while STIX is the JSON-based language that structures the indicators, observables, and
relationships being shared; the two are designed to work together. Option A reverses the roles of the two standards, a
very common exam trap. Option C forfeits automation, machine readability, and timeliness, which is precisely what the
requirement rules out. Option D is wrong because ATT&CK; and the Kill Chain are behavioral frameworks for
describing adversary activity, not transport or exchange formats.
Q7: At 03:10, NetFlow shows a single file server uploading sustained traffic at nearly 900 Mb/s to an
unfamiliar external address, an anomaly the baseline has never recorded. Powering the server off is not yet
authorized. Which action best balances investigation speed with evidence preservation?
A. Capture traffic to and from the server while correlating the flow records with firewall and EDR logs to
identify the destination, protocol, and process responsible [CORRECT]
B. Format the server's storage immediately to stop any exfiltration in progress
C. Disable the server's network interface and wait for the morning shift to decide next steps
D. Email the file server administrator and ask whether any large job was scheduled
Correct Answer: A
Rationale: The analyst needs to know what is leaving, how, and from which process before containment decisions are
made, and live capture plus log correlation delivers that picture while leaving the system running so volatile evidence is
not destroyed. Option B is catastrophic because formatting destroys all evidence and violates evidence-handling
discipline. Option C stops the bleeding but discloses nothing about the channel and lets the attacker know they were
detected, and it delays response unnecessarily. Option D alone wastes the critical early window; even if a scheduled job
explains the traffic, the analyst must verify it with the flow and capture data.
3
Real Exam Questions and Verified Answers (100% Correct | Multiple-Choice & Performance-Based | Graded
A+)
85 Questions | Security Operations 33% | Vulnerability Management 30% | Incident Response and Management 20% | Reporting and
Communication 17%
Section 1: Security Operations (33% of Exam) - Questions 1-28
Q1: A SOC analyst is onboarding new log sources into the organization's SIEM. The platform natively
ingests syslog and Windows Event Forwarding data, but a critical in-house business application only exposes
its audit records through a proprietary REST API. Which approach should the analyst use to bring this
application's events into the SIEM?
A. Enable syslog over UDP 514 on the application server and point it at the SIEM listener
B. Configure a dedicated API connector that queries the application's REST interface on a schedule and
normalizes events into the SIEM's common schema [CORRECT]
C. Export the application logs to CSV once per week and import the files manually into the SIEM
D. Configure the host firewall to mirror blocked-connection messages to the SIEM in place of application
audit logging
Correct Answer: B
Rationale: A proprietary REST-based source requires a purpose-built API connector or agent that retrieves events and
maps their fields to the SIEM's normalized schema, preserving timeliness and searchability. Option A fails because the
application does not natively emit syslog, and converting it is not possible by merely opening UDP 514. Option C
destroys the near-real-time detection value the SOC needs and introduces human error and gaps. Option D supplies only
a narrow slice of network events, not the application's own audit trail, so correlation use cases would be blind to user
activity inside the application.
Q2: During a quarterly access review, an analyst discovers that the service account used by the backup
application is a member of the local Administrators group and is permitted to log on interactively to any
server in the domain. Which remediation best applies the principle of least privilege while keeping the
backup function working?
A. Convert the account to a domain admin account so the backup software never fails due to permissions
B. Leave the membership unchanged but enable MFA on the account for all logon types
C. Remove interactive logon rights, restrict the account to the specific servers it services, and grant only the
file-system and VSS permissions the backup job requires [CORRECT]
D. Delete the account and re-run all backup jobs under each administrator's personal credentials
Correct Answer: C
Rationale: Least privilege for service accounts means scoping the account to exactly the systems and permissions its
function needs and eliminating interactive logon capability, which removes a common lateral-movement and
credential-dumping path. Option A increases privilege and directly contradicts the access review finding. Option B does
not reduce standing privilege, and MFA is generally ineffective for unattended service authentication anyway. Option D
ties automated services to human credentials, causing failures when staff change and destroying accountability for the
service identity.
1
,CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition
Q3: A healthcare organization must protect patient records that are stored in a database and that replicate
nightly to a disaster recovery site across a WAN link. Which combination of protections addresses data at
rest and data in transit for this scenario?
A. AES-256 encryption of the database storage volumes and TLS 1.3 for the replication connection
[CORRECT]
B. TLS 1.3 for the replication connection and SHA-256 hashing of every patient record
C. Disk compression with password protection on the archive files and IPSec only between the firewalls
D. AES-256 on the database volumes and disabled replication until an audit is completed
Correct Answer: A
Rationale: Confidentiality at rest is provided by strong symmetric encryption such as AES-256 on the storage volumes,
while confidentiality and integrity in transit are provided by a modern transport protocol such as TLS 1.3 on the
replication link. Option B confuses integrity hashing with confidentiality, since hashing does not encrypt anything.
Option C relies on reversible archive passwords and a tunnel that may not cover host-to-host traffic end to end, and
compression is not a security control. Option D protects the copies but destroys the availability and resiliency
requirement that replication exists to satisfy.
Q4: Performance-Based Question - Alert Triage: An analyst returns from a weekend and finds four SIEM
alerts in the queue: (1) three failed VPN logons for one user within ten minutes, (2) a production web server
with an established outbound TLS session to a known-bad IP in a country the company does not do business
with, refreshing every 60 seconds, (3) antivirus quarantining a worm dropped by a USB device on a single
workstation, and (4) one alert that a user opened the payroll file share at 6 a.m. Which alert should be
investigated and escalated FIRST?
A. The three failed VPN logons, because failed authentication always indicates a brute-force campaign
B. The payroll share access, because payroll data is the most sensitive information in the company
C. The quarantined USB worm, because malware automatically means the environment is compromised
D. The web server beaconing to the known-bad IP, because an established recurring outbound session to
malicious infrastructure indicates likely active command-and-control compromise of a production asset
[CORRECT]
Correct Answer: D
Rationale: Triage priority is driven by likelihood of active compromise and potential impact, and a periodic established
outbound session to known malicious infrastructure is the classic signature of command-and-control beaconing on a
production system, demanding immediate investigation. Option A is a low-volume authentication failure that usually
resolves as user error. Option B involves sensitive data but a single access by a legitimate account at an unusual hour is
far more often an explanation than an attack. Option C was already contained automatically by the antivirus, so its
residual risk is much lower than an uncontained beacon.
2
, CompTIA CySA+ (CS0-003) Exam | 2026/2027 Edition
Q5: A threat intelligence vendor delivers a report that profiles a specific financially motivated group,
detailing the infrastructure it currently operates, the malware families it deploys, and the playbook it has used
in recent campaigns against companies in the same industry as your organization. Which threat intelligence
classification best describes this product?
A. Strategic intelligence, because it concerns groups rather than individual hosts
B. Technical intelligence, because it lists malware families and hashes
C. Operational intelligence, because it describes the adversary's capabilities, infrastructure, and near-term
intent in enough detail to drive defensive action [CORRECT]
D. Attribution intelligence, because it names the group responsible
Correct Answer: C
Rationale: Operational intelligence sits between strategic and tactical: it captures who the adversary is, how they
operate, what infrastructure they use now, and what they intend, which is exactly the level of detail needed to tune
detections and prioritize hunting. Option A is wrong because strategic intelligence covers long-term trends, geopolitics,
and risk posture rather than campaign-level tradecraft. Option B confuses the report with tactical technical indicators
such as hashes and IPs, which are only one small element here. Option D is not a recognized CySA+ classification, and
naming a group alone does not make intelligence actionable.
Q6: An organization wants to exchange machine-readable threat indicators with its sector ISAC
automatically throughout the day instead of receiving weekly PDF bulletins. Which pairing of standards
should the analyst implement?
A. STIX for transporting collections of indicators and TAXII for structuring the indicator content
B. TAXII as the transport protocol for delivering content that is structured in STIX format [CORRECT]
C. CSV attachments over SMTP, because all members already support email
D. MITRE ATT&CK; for transport and the Cyber Kill Chain for indicator structure
Correct Answer: B
Rationale: TAXII is the application-layer transport protocol that defines how threat information is requested and
delivered between systems, while STIX is the JSON-based language that structures the indicators, observables, and
relationships being shared; the two are designed to work together. Option A reverses the roles of the two standards, a
very common exam trap. Option C forfeits automation, machine readability, and timeliness, which is precisely what the
requirement rules out. Option D is wrong because ATT&CK; and the Kill Chain are behavioral frameworks for
describing adversary activity, not transport or exchange formats.
Q7: At 03:10, NetFlow shows a single file server uploading sustained traffic at nearly 900 Mb/s to an
unfamiliar external address, an anomaly the baseline has never recorded. Powering the server off is not yet
authorized. Which action best balances investigation speed with evidence preservation?
A. Capture traffic to and from the server while correlating the flow records with firewall and EDR logs to
identify the destination, protocol, and process responsible [CORRECT]
B. Format the server's storage immediately to stop any exfiltration in progress
C. Disable the server's network interface and wait for the morning shift to decide next steps
D. Email the file server administrator and ask whether any large job was scheduled
Correct Answer: A
Rationale: The analyst needs to know what is leaving, how, and from which process before containment decisions are
made, and live capture plus log correlation delivers that picture while leaving the system running so volatile evidence is
not destroyed. Option B is catastrophic because formatting destroys all evidence and violates evidence-handling
discipline. Option C stops the bleeding but discloses nothing about the channel and lets the attacker know they were
detected, and it delays response unnecessarily. Option D alone wastes the critical early window; even if a scheduled job
explains the traffic, the analyst must verify it with the flow and capture data.
3
