CompTIA CySA+ CS0-003 Exam 2026: Professional Certification
Practice Test — Security Operations, Vulnerability Management,
Incident Response & Reporting — 190 Multiple-Choice Questions
with Answers & Detailed Rationales
Section 1: Security Operations (Questions 1–63)
Question 1
A SOC analyst notices that a workstation is generating outbound traffic to multiple unknown
external IP addresses on port 4444 during non-business hours. The traffic volume is low but
consistent. Which of the following best describes this activity?
A. Scheduled Windows updates
B. Command-and-control communication
C. Video streaming service
D. Automated cloud backup
Correct Answer: B
Explanation: Outbound traffic on non-standard ports during off-hours indicates command-
and-control (C2) communication. Malware frequently uses custom ports to evade detection
and maintain persistent access.
Question 2
Which of the following best describes the primary function of a Security Information and
Event Management (SIEM) system?
A. Blocking malicious network traffic at the perimeter
,B. Aggregating and correlating log data from multiple sources
C. Encrypting endpoint hard drives
D. Managing user authentication credentials
Correct Answer: B
Explanation: SIEM systems collect, normalize, and correlate log data from across the
enterprise to detect security incidents and support investigations. They are analytical
platforms, not blocking tools.
Question 3
A threat hunter is investigating a hypothesis that attackers may be using encoded PowerShell
commands after phishing. Which data source is most directly relevant?
A. Firewall deny logs
B. Endpoint process telemetry
C. DNS query logs
D. Physical access control logs
Correct Answer: B
Explanation: Endpoint process telemetry captures command-line arguments, parent
processes, and execution context. This directly reveals encoded PowerShell activity, including
flags like -enc or -EncodedCommand.
Question 4
An analyst receives an alert indicating multiple failed login attempts followed by a successful
login from a geographically distant location. What concept does this scenario illustrate?
A. Password spraying
,B. Impossible travel
C. Credential stuffing
D. Brute force attack
Correct Answer: B
Explanation: Impossible travel occurs when authentication events from geographically
distant locations occur within a timeframe that makes physical travel impossible. This
strongly suggests credential compromise.
Question 5
Which of the following describes the primary difference between threat hunting and
traditional security monitoring?
A. Threat hunting is automated while monitoring is manual
B. Threat hunting is proactive and hypothesis-driven while monitoring is reactive to alerts
C. Threat hunting only uses open-source intelligence
D. Threat hunting replaces the need for a SIEM
Correct Answer: B
Explanation: Threat hunting proactively searches for adversary activity based on hypotheses,
while traditional monitoring reacts to alerts generated by security tools. Both are
complementary SOC functions.
Question 6
A security analyst is reviewing a packet capture and observes a SYN packet sent to every port
on a target host sequentially. Which technique is being used?
A. UDP scan
, B. TCP SYN scan
C. ICMP sweep
D. XMAS scan
Correct Answer: B
Explanation: A TCP SYN scan sends SYN packets to ports and analyzes responses to
determine open ports. Sequential port probing is characteristic of this reconnaissance
technique, commonly performed with Nmap.
Question 7
What is the primary purpose of an Endpoint Detection and Response (EDR) tool?
A. To scan for open network ports
B. To continuously monitor endpoint activity and enable rapid response
C. To encrypt endpoint hard drives
D. To manage firewall rules centrally
Correct Answer: B
Explanation: EDR tools continuously record endpoint system activity and provide security
teams with visibility and response capabilities for advanced threats that evade traditional
antivirus.
Question 8
Which of the following best describes User and Entity Behavior Analytics (UEBA)?
A. A method for encrypting user data at rest
B. Using machine learning to detect anomalous behavior patterns
Practice Test — Security Operations, Vulnerability Management,
Incident Response & Reporting — 190 Multiple-Choice Questions
with Answers & Detailed Rationales
Section 1: Security Operations (Questions 1–63)
Question 1
A SOC analyst notices that a workstation is generating outbound traffic to multiple unknown
external IP addresses on port 4444 during non-business hours. The traffic volume is low but
consistent. Which of the following best describes this activity?
A. Scheduled Windows updates
B. Command-and-control communication
C. Video streaming service
D. Automated cloud backup
Correct Answer: B
Explanation: Outbound traffic on non-standard ports during off-hours indicates command-
and-control (C2) communication. Malware frequently uses custom ports to evade detection
and maintain persistent access.
Question 2
Which of the following best describes the primary function of a Security Information and
Event Management (SIEM) system?
A. Blocking malicious network traffic at the perimeter
,B. Aggregating and correlating log data from multiple sources
C. Encrypting endpoint hard drives
D. Managing user authentication credentials
Correct Answer: B
Explanation: SIEM systems collect, normalize, and correlate log data from across the
enterprise to detect security incidents and support investigations. They are analytical
platforms, not blocking tools.
Question 3
A threat hunter is investigating a hypothesis that attackers may be using encoded PowerShell
commands after phishing. Which data source is most directly relevant?
A. Firewall deny logs
B. Endpoint process telemetry
C. DNS query logs
D. Physical access control logs
Correct Answer: B
Explanation: Endpoint process telemetry captures command-line arguments, parent
processes, and execution context. This directly reveals encoded PowerShell activity, including
flags like -enc or -EncodedCommand.
Question 4
An analyst receives an alert indicating multiple failed login attempts followed by a successful
login from a geographically distant location. What concept does this scenario illustrate?
A. Password spraying
,B. Impossible travel
C. Credential stuffing
D. Brute force attack
Correct Answer: B
Explanation: Impossible travel occurs when authentication events from geographically
distant locations occur within a timeframe that makes physical travel impossible. This
strongly suggests credential compromise.
Question 5
Which of the following describes the primary difference between threat hunting and
traditional security monitoring?
A. Threat hunting is automated while monitoring is manual
B. Threat hunting is proactive and hypothesis-driven while monitoring is reactive to alerts
C. Threat hunting only uses open-source intelligence
D. Threat hunting replaces the need for a SIEM
Correct Answer: B
Explanation: Threat hunting proactively searches for adversary activity based on hypotheses,
while traditional monitoring reacts to alerts generated by security tools. Both are
complementary SOC functions.
Question 6
A security analyst is reviewing a packet capture and observes a SYN packet sent to every port
on a target host sequentially. Which technique is being used?
A. UDP scan
, B. TCP SYN scan
C. ICMP sweep
D. XMAS scan
Correct Answer: B
Explanation: A TCP SYN scan sends SYN packets to ports and analyzes responses to
determine open ports. Sequential port probing is characteristic of this reconnaissance
technique, commonly performed with Nmap.
Question 7
What is the primary purpose of an Endpoint Detection and Response (EDR) tool?
A. To scan for open network ports
B. To continuously monitor endpoint activity and enable rapid response
C. To encrypt endpoint hard drives
D. To manage firewall rules centrally
Correct Answer: B
Explanation: EDR tools continuously record endpoint system activity and provide security
teams with visibility and response capabilities for advanced threats that evade traditional
antivirus.
Question 8
Which of the following best describes User and Entity Behavior Analytics (UEBA)?
A. A method for encrypting user data at rest
B. Using machine learning to detect anomalous behavior patterns
