COMPTIA CYSA+ (CS0-003) STUDY GUIDE | LATEST
UPDATE 2026/2027 | ACTUAL EXAM | PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination has been meticulously developed for
candidates preparing for the CompTIA Cybersecurity Analyst (CySA+) CS0-003
certification, the globally recognized intermediate-level credential validating
applied threat detection, analysis, and response skills. This 100-question
assessment mirrors the depth and rigor of the actual certification examination,
covering the latest 2026/2027 exam objectives including incident detection and
response, vulnerability management, security operations and monitoring, threat
intelligence, digital forensics, log analysis, and governance, risk, and compliance.
Each question has been crafted by cybersecurity subject matter experts to
challenge your analytical reasoning, reinforce hands-on defensive techniques, and
test your ability to interpret data from diverse security tools including SIEM
platforms, EDR solutions, vulnerability scanners, and packet analyzers. This study
resource serves as an essential tool for aspiring security analysts seeking to
validate their intermediate cybersecurity competency, identify knowledge gaps,
and build confidence before sitting for the official CompTIA CySA+ certification
examination.
Table of Contents:
1.0 Security Operations
2.0 Vulnerability Management
3.0 Incident Response and Management
4.0 Reporting and Communication
5.0 Threat Intelligence and Threat Hunting
,Question 1: A security analyst is reviewing an endpoint detection and response
(EDR) alert indicating that powershell.exe executed from a Microsoft Word
process with the command -WindowStyle Hidden -EncodedCommand <base64>.
The base64-decoded payload reveals an attempt to download and execute a script
from a known malicious domain. Mapping this to the MITRE ATT&CK
framework, which tactic and technique combination BEST describes this behavior?
A) Execution (T1204.002 - User Execution: Malicious File)
B) Defense Evasion (T1027 - Obfuscated Files or Information) and Execution
(T1059.001 - Command and Scripting Interpreter: PowerShell)
C) Credential Access (T1003.001 - OS Credential Dumping: LSASS Memory)
D) Persistence (T1547.001 - Boot or Logon Autostart Execution: Registry Run
Keys)
Correct Answer: B
The use of base64 encoding with the -EncodedCommand parameter is a specific
obfuscation technique mapped to T1027, while the parent-child process
relationship (Word spawning PowerShell) and the script execution via Invoke-
Expression or similar falls under T1059.001. The combination reflects the
adversary's effort to evade detection while achieving code execution.
Question 2: During a proactive threat-hunting exercise, an analyst queries the
SIEM for unusual Windows service creations. The query returns an entry showing
a new service named SysHelper with the binary path set to %COMSPEC% /c start
/min "" cmd.exe /c rundll32.exe javascript:"\..\mshtml,RunHTMLApplication
";new ActiveXObject('WScript.Shell').Run('C:\Windows\Temp\payload.exe')".
What persistence mechanism is being established?
A) Windows Management Instrumentation (WMI) Event Subscription
B) Scheduled Task with COM handler hijacking
C) A malicious Windows service leveraging the Alternate Data Streams technique
D) A malicious service abusing COM scriptlets and rundll32.exe to proxy
execution and bypass application allow listing
Correct Answer: D
The service executes rundll32.exe with a JavaScript call to mshtml.dll, which in
turn instantiates a WScript.Shell object to execute the actual payload. This
technique is known as a "Squiblytwo" variant, using trusted signed binaries
(LOLBins) to proxy malicious execution. This bypasses application allowlisting
,that might only check the service binary path for cmd.exe or rundll32.exe (which
are trusted).
Question 3: A vulnerability scan report indicates that a web application server is
susceptible to CVE-2021-44228 (Log4Shell). The server is running a Java
application behind a reverse proxy. The scan evidence shows an HTTP 200 OK
response with an X-Triggered-By header containing the scanner's callback hash
when a JNDI lookup string was sent in the User-Agent header. The organization's
WAF logs show the attack payload was not blocked. Which compensating control
is MOST effective if the application cannot be immediately patched?
A) Blocking all inbound ICMP and DNS traffic at the network firewall
B) Setting the system property log4j2.formatMsgNoLookups to true or setting the
environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS=true on the
application server JVM
C) Disabling the HTTP POST method on the reverse proxy
D) Rotating the server's TLS certificates
Correct Answer: B
The specific mitigation for Log4Shell is disabling message lookup substitution in
Log4j2. Setting the log4j2.formatMsgNoLookups property to true (for Log4j 2.10.0
and later) prevents the JNDI lookup from occurring when a malicious string is
logged. Blocking outbound LDAP/DNS via firewall (not inbound as in A) is a
network mitigation but the application-level change is more targeted.
Question 4: An analyst is performing packet analysis on a PCAP file provided by
a user reporting that their browser session was hijacked on a public Wi-Fi network.
The analyst filters for ARP packets and identifies a high volume of unsolicited
ARP replies with the source MAC address 00:11:22:33:44:55 claiming to be the IP
address 192.168.1.1 (the default gateway). The legitimate gateway MAC
is AA:BB:CC:DD:EE:FF. What specific type of attack has occurred?
A) DNS cache poisoning
B) ARP cache poisoning via gratuitous ARP, enabling man-in-the-middle (MITM)
traffic interception
C) DHCP starvation followed by rogue DHCP server
D) MAC flooding to overflow the CAM table
Correct Answer: B
Unsolicited gratuitous ARP replies sent to the victim mapping the attacker's MAC
address to the gateway's IP address overwrite the victim's ARP cache. This allows
, the attacker to receive traffic intended for the gateway, facilitating session
hijacking. DNS poisoning (A) targets domain resolution; DHCP attacks (C) target
IP assignment.
Question 5: A SOC analyst receives an alert for an internal host communicating
with a known command-and-control (C2) IP address on TCP port 443. The SIEM
log shows the connection is initiated by the svchost.exe process with PID 1028.
The analyst knows legitimate svchost.exe processes can make outbound HTTPS
connections. Which additional telemetry point would MOST strongly confirm this
is malicious C2 traffic?
A) The process parent PID is services.exe, which is normal for svchost.exe
B) The binary path for the process is C:\Windows\System32\svchost.exe and its
SHA256 hash matches the known-good hash
C) A concurrent process spawned by svchost.exe is cmd.exe, and the destination IP
resolves to a domain with a very recent registration date and no associated benign
reputation
D) The connection uses TLS 1.3 with a valid certificate issued by a public CA
Correct Answer: C
While the binary and parent PID may be normal, the behavioral indicator
of svchost.exe spawning a child process like cmd.exe is highly anomalous and
strong evidence of process injection or hollowing. Combined with the domain's
young age and low reputation, this is a high-fidelity indicator of compromise,
distinguishing it from legitimate svchost.exe activity.
Question 6: A vulnerability management team is triaging scan results. They
identify a vulnerability with a CVSS v3.1 base score of 9.8 on an internet-facing
web application. The vulnerability is an unauthenticated remote code execution
(RCE). The asset's exposure is confirmed. According to standard vulnerability
prioritization frameworks, what is the immediate recommended remediation
timeline?
A) Remediate within 30 days during the next patch cycle
B) Remediate within 14 days due to the high severity
C) Initiate emergency change management and remediate within 24 to 48 hours
D) Accept the risk and add a note to the risk register
Correct Answer: C
A CVSS 9.8 (Critical) unauthenticated RCE on an internet-facing asset represents
an imminent threat of compromise. Security policies and frameworks (e.g., NIST,
UPDATE 2026/2027 | ACTUAL EXAM | PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination has been meticulously developed for
candidates preparing for the CompTIA Cybersecurity Analyst (CySA+) CS0-003
certification, the globally recognized intermediate-level credential validating
applied threat detection, analysis, and response skills. This 100-question
assessment mirrors the depth and rigor of the actual certification examination,
covering the latest 2026/2027 exam objectives including incident detection and
response, vulnerability management, security operations and monitoring, threat
intelligence, digital forensics, log analysis, and governance, risk, and compliance.
Each question has been crafted by cybersecurity subject matter experts to
challenge your analytical reasoning, reinforce hands-on defensive techniques, and
test your ability to interpret data from diverse security tools including SIEM
platforms, EDR solutions, vulnerability scanners, and packet analyzers. This study
resource serves as an essential tool for aspiring security analysts seeking to
validate their intermediate cybersecurity competency, identify knowledge gaps,
and build confidence before sitting for the official CompTIA CySA+ certification
examination.
Table of Contents:
1.0 Security Operations
2.0 Vulnerability Management
3.0 Incident Response and Management
4.0 Reporting and Communication
5.0 Threat Intelligence and Threat Hunting
,Question 1: A security analyst is reviewing an endpoint detection and response
(EDR) alert indicating that powershell.exe executed from a Microsoft Word
process with the command -WindowStyle Hidden -EncodedCommand <base64>.
The base64-decoded payload reveals an attempt to download and execute a script
from a known malicious domain. Mapping this to the MITRE ATT&CK
framework, which tactic and technique combination BEST describes this behavior?
A) Execution (T1204.002 - User Execution: Malicious File)
B) Defense Evasion (T1027 - Obfuscated Files or Information) and Execution
(T1059.001 - Command and Scripting Interpreter: PowerShell)
C) Credential Access (T1003.001 - OS Credential Dumping: LSASS Memory)
D) Persistence (T1547.001 - Boot or Logon Autostart Execution: Registry Run
Keys)
Correct Answer: B
The use of base64 encoding with the -EncodedCommand parameter is a specific
obfuscation technique mapped to T1027, while the parent-child process
relationship (Word spawning PowerShell) and the script execution via Invoke-
Expression or similar falls under T1059.001. The combination reflects the
adversary's effort to evade detection while achieving code execution.
Question 2: During a proactive threat-hunting exercise, an analyst queries the
SIEM for unusual Windows service creations. The query returns an entry showing
a new service named SysHelper with the binary path set to %COMSPEC% /c start
/min "" cmd.exe /c rundll32.exe javascript:"\..\mshtml,RunHTMLApplication
";new ActiveXObject('WScript.Shell').Run('C:\Windows\Temp\payload.exe')".
What persistence mechanism is being established?
A) Windows Management Instrumentation (WMI) Event Subscription
B) Scheduled Task with COM handler hijacking
C) A malicious Windows service leveraging the Alternate Data Streams technique
D) A malicious service abusing COM scriptlets and rundll32.exe to proxy
execution and bypass application allow listing
Correct Answer: D
The service executes rundll32.exe with a JavaScript call to mshtml.dll, which in
turn instantiates a WScript.Shell object to execute the actual payload. This
technique is known as a "Squiblytwo" variant, using trusted signed binaries
(LOLBins) to proxy malicious execution. This bypasses application allowlisting
,that might only check the service binary path for cmd.exe or rundll32.exe (which
are trusted).
Question 3: A vulnerability scan report indicates that a web application server is
susceptible to CVE-2021-44228 (Log4Shell). The server is running a Java
application behind a reverse proxy. The scan evidence shows an HTTP 200 OK
response with an X-Triggered-By header containing the scanner's callback hash
when a JNDI lookup string was sent in the User-Agent header. The organization's
WAF logs show the attack payload was not blocked. Which compensating control
is MOST effective if the application cannot be immediately patched?
A) Blocking all inbound ICMP and DNS traffic at the network firewall
B) Setting the system property log4j2.formatMsgNoLookups to true or setting the
environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS=true on the
application server JVM
C) Disabling the HTTP POST method on the reverse proxy
D) Rotating the server's TLS certificates
Correct Answer: B
The specific mitigation for Log4Shell is disabling message lookup substitution in
Log4j2. Setting the log4j2.formatMsgNoLookups property to true (for Log4j 2.10.0
and later) prevents the JNDI lookup from occurring when a malicious string is
logged. Blocking outbound LDAP/DNS via firewall (not inbound as in A) is a
network mitigation but the application-level change is more targeted.
Question 4: An analyst is performing packet analysis on a PCAP file provided by
a user reporting that their browser session was hijacked on a public Wi-Fi network.
The analyst filters for ARP packets and identifies a high volume of unsolicited
ARP replies with the source MAC address 00:11:22:33:44:55 claiming to be the IP
address 192.168.1.1 (the default gateway). The legitimate gateway MAC
is AA:BB:CC:DD:EE:FF. What specific type of attack has occurred?
A) DNS cache poisoning
B) ARP cache poisoning via gratuitous ARP, enabling man-in-the-middle (MITM)
traffic interception
C) DHCP starvation followed by rogue DHCP server
D) MAC flooding to overflow the CAM table
Correct Answer: B
Unsolicited gratuitous ARP replies sent to the victim mapping the attacker's MAC
address to the gateway's IP address overwrite the victim's ARP cache. This allows
, the attacker to receive traffic intended for the gateway, facilitating session
hijacking. DNS poisoning (A) targets domain resolution; DHCP attacks (C) target
IP assignment.
Question 5: A SOC analyst receives an alert for an internal host communicating
with a known command-and-control (C2) IP address on TCP port 443. The SIEM
log shows the connection is initiated by the svchost.exe process with PID 1028.
The analyst knows legitimate svchost.exe processes can make outbound HTTPS
connections. Which additional telemetry point would MOST strongly confirm this
is malicious C2 traffic?
A) The process parent PID is services.exe, which is normal for svchost.exe
B) The binary path for the process is C:\Windows\System32\svchost.exe and its
SHA256 hash matches the known-good hash
C) A concurrent process spawned by svchost.exe is cmd.exe, and the destination IP
resolves to a domain with a very recent registration date and no associated benign
reputation
D) The connection uses TLS 1.3 with a valid certificate issued by a public CA
Correct Answer: C
While the binary and parent PID may be normal, the behavioral indicator
of svchost.exe spawning a child process like cmd.exe is highly anomalous and
strong evidence of process injection or hollowing. Combined with the domain's
young age and low reputation, this is a high-fidelity indicator of compromise,
distinguishing it from legitimate svchost.exe activity.
Question 6: A vulnerability management team is triaging scan results. They
identify a vulnerability with a CVSS v3.1 base score of 9.8 on an internet-facing
web application. The vulnerability is an unauthenticated remote code execution
(RCE). The asset's exposure is confirmed. According to standard vulnerability
prioritization frameworks, what is the immediate recommended remediation
timeline?
A) Remediate within 30 days during the next patch cycle
B) Remediate within 14 days due to the high severity
C) Initiate emergency change management and remediate within 24 to 48 hours
D) Accept the risk and add a note to the risk register
Correct Answer: C
A CVSS 9.8 (Critical) unauthenticated RCE on an internet-facing asset represents
an imminent threat of compromise. Security policies and frameworks (e.g., NIST,
