COMPTIA CYSA+ CERTIFICATION FINAL
PAPER 2026 SOLVED QUESTIONS AND
ACCURATE ANSWERS GRADED A+
● nmap -sT. Answer: TCP connect scan used by Nmap when raw socket
privileges are not available.
● TCP ACK scan. Answer: A scan type used to probe and map firewall
rules.
● Command and Control (MITRE ATT&CK). Answer: Stage where
compromised systems communicate with an attacker-controlled server to
receive instructions.
● Exploitation (Cyber Kill Chain). Answer: Phase where an attacker
takes advantage of a vulnerability after delivery to execute malicious
code.
● Suspicious Netstat Entry: 192.168.1.4:53 -> 91.198.117.247:443
CLOSE_WAIT. Answer: Indicates abnormal DNS-to-HTTPS
communication that may signal malicious activity.
, ● Suspicious Netstat Entry: 0.0.0.0:53 LISTENING. Answer: Indicates
the system is listening on DNS port on all interfaces, which may be
suspicious on a workstation.
● Suspicious Netstat Entry: 192.168.1.4:53 -> 208.71.44.30:80
ESTABLISHED. Answer: DNS port communicating over HTTP
suggests suspicious or malicious traffic.
● Golden Ticket Attack. Answer: Attack that forges Kerberos Ticket
Granting Tickets (TGTs) to gain domain administrator access in Active
Directory.
● Forensic Imaging Failure Cause. Answer: Destination drive contains
bad sectors causing dd imaging to fail.
● ICS Network Security Controls. Answer: Segmentation and disabling
unused services are effective protections for embedded ICS devices.
● OWASP Testing Guide. Answer: A comprehensive framework for
assessing web application security.
● Compensating Controls. Answer: Security measures implemented to
reduce risk when a vulnerability cannot immediately be fixed.
PAPER 2026 SOLVED QUESTIONS AND
ACCURATE ANSWERS GRADED A+
● nmap -sT. Answer: TCP connect scan used by Nmap when raw socket
privileges are not available.
● TCP ACK scan. Answer: A scan type used to probe and map firewall
rules.
● Command and Control (MITRE ATT&CK). Answer: Stage where
compromised systems communicate with an attacker-controlled server to
receive instructions.
● Exploitation (Cyber Kill Chain). Answer: Phase where an attacker
takes advantage of a vulnerability after delivery to execute malicious
code.
● Suspicious Netstat Entry: 192.168.1.4:53 -> 91.198.117.247:443
CLOSE_WAIT. Answer: Indicates abnormal DNS-to-HTTPS
communication that may signal malicious activity.
, ● Suspicious Netstat Entry: 0.0.0.0:53 LISTENING. Answer: Indicates
the system is listening on DNS port on all interfaces, which may be
suspicious on a workstation.
● Suspicious Netstat Entry: 192.168.1.4:53 -> 208.71.44.30:80
ESTABLISHED. Answer: DNS port communicating over HTTP
suggests suspicious or malicious traffic.
● Golden Ticket Attack. Answer: Attack that forges Kerberos Ticket
Granting Tickets (TGTs) to gain domain administrator access in Active
Directory.
● Forensic Imaging Failure Cause. Answer: Destination drive contains
bad sectors causing dd imaging to fail.
● ICS Network Security Controls. Answer: Segmentation and disabling
unused services are effective protections for embedded ICS devices.
● OWASP Testing Guide. Answer: A comprehensive framework for
assessing web application security.
● Compensating Controls. Answer: Security measures implemented to
reduce risk when a vulnerability cannot immediately be fixed.
