WGU D483 Security Operations / D483
CompTIA CySA+ OBEJECTIVE ASSESSMENT
ACTUAL EXAM PREP 2025/2026 QUESTIONS BANK
AND CORRECT DETAILED ANSWERS WITH
RATIONALES || 100% GUARANTEED PASS
<RECENT VERSION>
1. Threat Modeling - ANSWER ✔ designed to identify the principal risks and
tactics, techniques and procedures (TTPs) that a system may be subject to by
evaluating the system both from an attacker's point of view and from the
defender's point of view.
2. Technical Controls - ANSWER ✔ The control is implemented as a system
(hardware, software, or firmware). For example, firewalls, antivirus
software, and OS access control models.
3. Operational Controls - ANSWER ✔ The control is implemented primarily
by people rather than systems. For example, security guards and training
programs.
4. Managerial Controls - ANSWER ✔ The control gives oversight of the
information system. Examples could include risk identification or a tool
allowing the evaluation and selection of other security controls.
5. Preventative Control - ANSWER ✔ The control acts to eliminate or reduce
the likelihood that an attack can succeed. Operates before an attack can take
place.
6. Detective Control - ANSWER ✔ The control may not prevent or deter
access, but it will identify and record any attempted or successful intrusion.
Operates during the progress of an attack.
,7. Corrective Control - ANSWER ✔ The control acts to eliminate or reduce the
impact of an intrusion event. Used after an attack. A good example is a
backup system that can restore data that was damaged during an intrusion.
8. Compensating Control - ANSWER ✔ The control serves as a substitute for a
principal control, as recommended by a security standard, and affords the
same (or better) level of protection but uses a different methodology or
technology.
9. Responsive Control - ANSWER ✔ These controls serve to direct corrective
actions enacted after an incident has been confirmed. Might include several
very well-defined actions to be taken by an analyst after identifying a
specific issue. These actions are often documented in a playbook.
10.Attack Surface - ANSWER ✔ describes all potential pathways a threat actor
could use to gain unauthorized access or control.
11.Metasploit - ANSWER ✔ A platform for launching modularized attacks
against known software vulnerabilities.
12.Match hosting models: On-premises, IaaS, PaaS, SaaS. - ANSWER ✔ On-
prem = full control, IaaS = infra only, PaaS = dev platform, SaaS = complete
apps.
13.Match virtualization types: Hypervisor vs Container. - ANSWER ✔
Hypervisor = full OS VMs, Container = lightweight app isolation.
14.Match control principles: Segmentation vs Microsegmentation. - ANSWER
✔ Segmentation = subnet isolation, Microsegmentation = workload
isolation.
15.Match availability solutions: Load balancing, Clustering, RAID. - ANSWER
✔ LB = traffic spread, Clustering = multiple servers, RAID = disk
redundancy.
16.Match backup types: Full, Differential, Incremental. - ANSWER ✔ Full =
all data, Differential = since last full, Incremental = since last backup.
,17.Match backup strategy: Hot, Warm, Cold site. - ANSWER ✔ Hot = ready
instantly, Warm = partial setup, Cold = empty shell.
18.Match resilience terms: RTO vs RPO. - ANSWER ✔ RTO = downtime
allowed, RPO = data loss allowed.
19.Match industrial systems: ICS vs SCADA. - ANSWER ✔ ICS = controls
processes, SCADA = remote monitoring/control.
20.Match IoT risks: Weak auth, Insecure comms, No patching. - ANSWER ✔
All apply.
21.Match data labels: Public, Confidential, Secret. - ANSWER ✔ Public = free
use, Confidential = limited, Secret = highly restricted.
22.Prowler - ANSWER ✔ an open-source security tool that helps organizations
evaluate their Amazon Web Services (AWS) infrastructure and ensure it
adheres to industry best practices and compliance standards.
23.Arachni - ANSWER ✔ an open-source, feature-rich, modular web
application security testing framework. The team can use it to identify
security vulnerabilities in web applications and provide support for
automated testing.
24.Nikto - ANSWER ✔ a web server scanner that the security analyst can use
to specifically identify vulnerabilities in web servers. It can quickly scan
multiple web servers and provide comprehensive information on any
detected vulnerabilities.
25.A security analyst is developing a python script to analyze regular text from
log files. The script will identify potential security incidents and generate
alerts for further investigation. Which of the following best describes the
security concept the analyst needs to implement in the python script to detect
obfuscated text? (Select the two best options.)
A.Code signature verification
B.Regular expression
C.String manipulation
D.Header inspection - ANSWER ✔ B.Regular expression
, C.String manipulation
26.A cybersecurity team performs a security assessment of a large company's
network infrastructure. The team decides to use a passive discovery
approach to identify systems, services, and protocols in use on the network.
Which of the following methods of passive discovery would be the most
effective for the team to use, and how does it work?
A.Performing a network vulnerability scan to identify open ports and
services running on the network
B.Using a port scanner to identify systems and services that respond to
network requests
C.Inspecting network traffic using a packet sniffer to identify protocols in
use and traffic patterns
D.Performing an active scan of the network to identify hosts and services -
ANSWER ✔ C.Inspecting network traffic using a packet sniffer to identify
protocols in use and traffic patterns
27.An airline company has implemented a new security system to monitor its
online booking system for suspicious activity, such as multiple failed login
attempts or a large number of bookings made quickly. The system uses
webhooks to trigger automated responses, such as blocking an IP address or
alerting the security team. How can an airline company use webhooks to
enhance the security of its online booking system?
A.Webhooks allow users to send messages manually to applications for
booking flights and checking flight status.
B.Webhooks allow users to send messages manually to applications to
redeem frequent flyer miles or access airport lounge services.
C.Webhooks automate messages an airline company uses to monitor
suspicious activity.
D.Webhooks automate messages an airline company uses to track flight
schedules and notify customers of changes or delays. - ANSWER ✔
C.Webhooks automate messages an airline company uses to monitor
suspicious activity.
28.An organization has tasked an IT team with implementing vulnerability
scanning methods and concepts. They are considering different industry
frameworks to use. Which of the following is a not-for-profit organization
that focuses on web application security?
A.FIPS
CompTIA CySA+ OBEJECTIVE ASSESSMENT
ACTUAL EXAM PREP 2025/2026 QUESTIONS BANK
AND CORRECT DETAILED ANSWERS WITH
RATIONALES || 100% GUARANTEED PASS
<RECENT VERSION>
1. Threat Modeling - ANSWER ✔ designed to identify the principal risks and
tactics, techniques and procedures (TTPs) that a system may be subject to by
evaluating the system both from an attacker's point of view and from the
defender's point of view.
2. Technical Controls - ANSWER ✔ The control is implemented as a system
(hardware, software, or firmware). For example, firewalls, antivirus
software, and OS access control models.
3. Operational Controls - ANSWER ✔ The control is implemented primarily
by people rather than systems. For example, security guards and training
programs.
4. Managerial Controls - ANSWER ✔ The control gives oversight of the
information system. Examples could include risk identification or a tool
allowing the evaluation and selection of other security controls.
5. Preventative Control - ANSWER ✔ The control acts to eliminate or reduce
the likelihood that an attack can succeed. Operates before an attack can take
place.
6. Detective Control - ANSWER ✔ The control may not prevent or deter
access, but it will identify and record any attempted or successful intrusion.
Operates during the progress of an attack.
,7. Corrective Control - ANSWER ✔ The control acts to eliminate or reduce the
impact of an intrusion event. Used after an attack. A good example is a
backup system that can restore data that was damaged during an intrusion.
8. Compensating Control - ANSWER ✔ The control serves as a substitute for a
principal control, as recommended by a security standard, and affords the
same (or better) level of protection but uses a different methodology or
technology.
9. Responsive Control - ANSWER ✔ These controls serve to direct corrective
actions enacted after an incident has been confirmed. Might include several
very well-defined actions to be taken by an analyst after identifying a
specific issue. These actions are often documented in a playbook.
10.Attack Surface - ANSWER ✔ describes all potential pathways a threat actor
could use to gain unauthorized access or control.
11.Metasploit - ANSWER ✔ A platform for launching modularized attacks
against known software vulnerabilities.
12.Match hosting models: On-premises, IaaS, PaaS, SaaS. - ANSWER ✔ On-
prem = full control, IaaS = infra only, PaaS = dev platform, SaaS = complete
apps.
13.Match virtualization types: Hypervisor vs Container. - ANSWER ✔
Hypervisor = full OS VMs, Container = lightweight app isolation.
14.Match control principles: Segmentation vs Microsegmentation. - ANSWER
✔ Segmentation = subnet isolation, Microsegmentation = workload
isolation.
15.Match availability solutions: Load balancing, Clustering, RAID. - ANSWER
✔ LB = traffic spread, Clustering = multiple servers, RAID = disk
redundancy.
16.Match backup types: Full, Differential, Incremental. - ANSWER ✔ Full =
all data, Differential = since last full, Incremental = since last backup.
,17.Match backup strategy: Hot, Warm, Cold site. - ANSWER ✔ Hot = ready
instantly, Warm = partial setup, Cold = empty shell.
18.Match resilience terms: RTO vs RPO. - ANSWER ✔ RTO = downtime
allowed, RPO = data loss allowed.
19.Match industrial systems: ICS vs SCADA. - ANSWER ✔ ICS = controls
processes, SCADA = remote monitoring/control.
20.Match IoT risks: Weak auth, Insecure comms, No patching. - ANSWER ✔
All apply.
21.Match data labels: Public, Confidential, Secret. - ANSWER ✔ Public = free
use, Confidential = limited, Secret = highly restricted.
22.Prowler - ANSWER ✔ an open-source security tool that helps organizations
evaluate their Amazon Web Services (AWS) infrastructure and ensure it
adheres to industry best practices and compliance standards.
23.Arachni - ANSWER ✔ an open-source, feature-rich, modular web
application security testing framework. The team can use it to identify
security vulnerabilities in web applications and provide support for
automated testing.
24.Nikto - ANSWER ✔ a web server scanner that the security analyst can use
to specifically identify vulnerabilities in web servers. It can quickly scan
multiple web servers and provide comprehensive information on any
detected vulnerabilities.
25.A security analyst is developing a python script to analyze regular text from
log files. The script will identify potential security incidents and generate
alerts for further investigation. Which of the following best describes the
security concept the analyst needs to implement in the python script to detect
obfuscated text? (Select the two best options.)
A.Code signature verification
B.Regular expression
C.String manipulation
D.Header inspection - ANSWER ✔ B.Regular expression
, C.String manipulation
26.A cybersecurity team performs a security assessment of a large company's
network infrastructure. The team decides to use a passive discovery
approach to identify systems, services, and protocols in use on the network.
Which of the following methods of passive discovery would be the most
effective for the team to use, and how does it work?
A.Performing a network vulnerability scan to identify open ports and
services running on the network
B.Using a port scanner to identify systems and services that respond to
network requests
C.Inspecting network traffic using a packet sniffer to identify protocols in
use and traffic patterns
D.Performing an active scan of the network to identify hosts and services -
ANSWER ✔ C.Inspecting network traffic using a packet sniffer to identify
protocols in use and traffic patterns
27.An airline company has implemented a new security system to monitor its
online booking system for suspicious activity, such as multiple failed login
attempts or a large number of bookings made quickly. The system uses
webhooks to trigger automated responses, such as blocking an IP address or
alerting the security team. How can an airline company use webhooks to
enhance the security of its online booking system?
A.Webhooks allow users to send messages manually to applications for
booking flights and checking flight status.
B.Webhooks allow users to send messages manually to applications to
redeem frequent flyer miles or access airport lounge services.
C.Webhooks automate messages an airline company uses to monitor
suspicious activity.
D.Webhooks automate messages an airline company uses to track flight
schedules and notify customers of changes or delays. - ANSWER ✔
C.Webhooks automate messages an airline company uses to monitor
suspicious activity.
28.An organization has tasked an IT team with implementing vulnerability
scanning methods and concepts. They are considering different industry
frameworks to use. Which of the following is a not-for-profit organization
that focuses on web application security?
A.FIPS
