CompTIA CySA+ (CS0-002) Exam Simulator #1

An organization is reviewing its data types and is trying to determine which type of data should be classified as Restricted. Which of the following data types should be classified as Restricted?

A company wants to establish a data classification policy. Which of the following data types should be classified as Confidential?

An organization is developing a data retention policy for its customer database. Which of the following is the BEST approach for determining the retention period for this data?

An organization is conducting a review of its data retention policy. Which of the following is the primary reason for establishing a retention policy?

What is the purpose of establishing ownership of data in an organization?

In a company, who is responsible for ensuring the ownership of data and the protection of sensitive information?

A company has classified its data into three categories: public, confidential, and highly confidential. Which of the following is an appropriate non-technical control that can be implemented for the confidential data category?

A company handles sensitive data related to its clients and has recently experienced data breaches. To address this issue, the company has decided to classify its data. What is the primary goal of data classification?

A company has recently implemented a new security system that monitors employee internet activity to prevent data breaches. Some employees are concerned that this system may violate their privacy rights. What should the company do to address these concerns?

A company is facing a security breach that could potentially compromise sensitive customer information. The incident response team has suggested implementing a security measure that involves collecting additional personal data from customers to identify potential fraudulent activity. However, the legal team is concerned about violating privacy laws. What should the company do in this situation?

A company has suffered a cyber attack and has identified that sensitive customer data has been breached. The company decides to contact law enforcement to assist with the investigation. Which of the following is a reason why involving law enforcement in the incident response process is important?

During an incident response, a company is working to coordinate its response efforts across multiple internal teams and departments, as well as external entities. Which of the following is the most important reason for coordinating response efforts across internal and external entities?

In the event of a security incident, a company decides to activate its incident response plan. The plan includes coordinating with external entities such as law enforcement and regulatory bodies. What is the primary reason for including external entities in the incident response plan?

A company has suffered a data breach that has received significant media attention. The incident response team is coordinating with various entities to manage the situation. Which of the following is the primary reason for coordinating with the public relations (PR) department?

A security incident has occurred in an organization, and the incident response team needs to coordinate with human resources to investigate the incident. Which of the following is the most important reason for involving human resources in the incident response process?

An organization has experienced a security incident, and the incident response team needs to coordinate with the human resources department to investigate the incident. What is the primary reason for involving human resources in the incident response process?

During a routine security audit, an organization discovers that an attacker gained unauthorized access to their network and exfiltrated sensitive data. The incident response team is notified and begins to investigate the incident. They identify that the attacker was able to exploit a vulnerability in a third-party software used by the organization. The incident response team determines that they need to involve legal counsel to evaluate potential liability and regulatory requirements. Which of the following is the primary reason for involving legal counsel in this incident response process?

A small business experiences a cyber attack and must notify its customers of a potential data breach. As part of the communication plan, which of the following is important to consider when drafting the notification?

A company is hit by a ransomware attack, and the incident response team is activated. As part of the communication plan, the team needs to report to the company’s executives and board members. Which of the following should be included in the report?

A company’s incident response team is handling a critical security breach. During the investigation, it is discovered that the attackers gained access to sensitive information, including employee personal information. What is the importance of using a secure method of communication during the incident response?

A company is required to report any data breaches that involve sensitive customer information to regulatory authorities. What action should the incident response team take to ensure compliance with regulatory/legislative requirements as part of the communication plan?

A security incident has occurred in an organization, and the incident response team is working to resolve the issue. During the investigation, it is found that the incident is limited to a specific group of employees who had access to a particular system. What should be the FIRST step taken by the incident response team with respect to the communication plan in this scenario?

In an organization, a security incident has occurred that involves a data breach that contains personally identifiable information (PII) of customers. The organization is subject to regulatory requirements that mandate the disclosure of such incidents. What should be the FIRST step taken by the incident response team with respect to the communication plan in this scenario?

During an incident response process, why is it important to limit communication to trusted parties only?

In the event of a cyberattack, which of the following is the BEST communication plan to minimize the risk of further damage?

You are a security analyst for a large retail company, and you have been tasked with analyzing the event logs for the company’s point-of-sale (POS) system. After reviewing the logs, you notice several failed login attempts and a sudden spike in sales at an unusual time. What type of attack may be occurring based on this data analysis?

A security analyst is reviewing a packet capture to investigate a potential malware infection. They notice that some of the traffic is using an unusual protocol that they do not recognize. Which of the following steps should the analyst take to investigate the protocol?

A security analyst is investigating a network incident where a large volume of network traffic is generated by a single IP address. The analyst needs to determine the type of traffic and the associated ports. Which of the following techniques will the analyst use to analyze the network traffic?

A security analyst is investigating a network incident where an unknown device is communicating with an external IP address. The analyst needs to identify the source IP address, destination IP address, port number, and protocol. Which of the following techniques will the analyst use to analyze the network traffic?

A security team is investigating an incident in which an employee’s workstation was compromised with malware. During analysis, the team discovers that the malware was downloaded from a particular domain name. Which of the following steps should the team take to help prevent future incidents?

A security analyst is tasked with monitoring the network traffic of an organization. During analysis, the analyst notices a large number of DNS requests being made to a suspicious URL. Which of the following actions should the analyst take FIRST to further investigate this activity?

A security analyst is tasked with analyzing endpoint user behavior to identify any suspicious activity. Which of the following UEBA techniques would be MOST useful in this scenario?

A company has noticed an unusual spike in outbound network traffic from a user’s endpoint. The IT security team suspects that the user’s computer may be compromised with a rootkit malware that has evaded traditional antivirus software. As part of the investigation, the team analyzes the system and application behavior to determine any exploit techniques used by the malware. Which of the following data points should they look for to identify exploit techniques?

A security analyst is analyzing endpoint data and notices a suspicious process attempting to execute a buffer overflow attack. The analyst suspects that the process may be trying to exploit a vulnerability in the system. Which of the following exploit techniques is the process MOST likely attempting to use?

A company has implemented a security monitoring solution that collects endpoint data from across the organization’s network. The system generates alerts for anomalous behavior that deviates from a baseline of known-good behavior. An alert is generated for a user who is attempting to access files outside their normal working hours. Which of the following actions should be taken in response to the alert?

A security analyst is tasked with monitoring an organization’s endpoints for any suspicious activity. The analyst notices that a system is exhibiting unusual behavior, and upon further investigation, determines that it is the result of a newly installed software. Which of the following techniques can the analyst use to identify known-good behavior of the new software?

A security analyst is analyzing a memory dump from an endpoint that was compromised in a recent cyber attack. The analyst suspects that the attacker may have loaded malicious code into memory. Which of the following memory analysis techniques would be the MOST appropriate to determine if this is the case?

A security analyst has discovered a new type of malware on an endpoint. After performing some initial analysis, the analyst has decided to perform reverse engineering on the malware to gather additional information. Which of the following is a potential benefit of reverse engineering in this scenario?

You are a security analyst for a financial institution and are analyzing log data to identify any trends or anomalies that could indicate a security breach. After analyzing the logs, you notice a sudden increase in outbound network traffic from a specific workstation. What type of analysis are you performing?

A security analyst is analyzing a log file and notices an unusual pattern of failed login attempts to an employee’s account. Upon further investigation, the analyst discovers that the employee’s credentials have been compromised. Which of the following BEST describes the analysis technique used in this scenario?

A company is implementing a new SaaS application that will be used by all employees. The IT team is concerned about the potential security risks of employees using weak passwords or sharing their credentials with others. What is the BEST solution to mitigate these risks?

A company wants to implement stronger security measures to protect its sensitive data. The IT team has suggested implementing multifactor authentication (MFA) for all employees accessing company systems remotely. Which of the following is the BEST reason to implement MFA in this scenario?

A company has adopted a container orchestration tool for its application infrastructure. The security team is concerned about the risk of unauthorized access to sensitive data stored in the containers. Which of the following security controls should be implemented to mitigate this risk?

A company is planning to migrate its existing applications to a containerized environment to improve scalability and deployment speed. Which of the following security controls should be implemented to mitigate the risk of container breakout attacks?

A company has recently adopted a serverless architecture for its applications. The company wants to ensure that it has visibility and control over its cloud resources. Which of the following tools can help achieve this goal?

A company has decided to move its IT infrastructure to a virtual private cloud (VPC) to reduce costs and improve flexibility. As a security analyst, which of the following is the BEST control to implement to secure the VPC?

A company wants to implement a new network architecture that allows for greater agility and scalability, while also providing more robust security measures. The IT team has proposed a software-defined networking (SDN) solution. Which of the following is a security benefit of SDN?

In order to secure its network, a company has decided to implement a jumpbox. Which of the following is a benefit of using a jumpbox for segmentation?

A company wants to ensure the security of its network infrastructure. The company has multiple offices, and each office is connected to the internet through a dedicated leased line. The company’s IT team wants to implement security controls to protect against unauthorized access, network attacks, and other threats. Which of the following is the BEST solution to implement for physical network security?

A company has a large number of virtual machines running on a single physical server. They are concerned about security risks associated with having all of the virtual machines on the same network segment. Which of the following solutions would be the BEST to implement for this scenario?

A company wants to improve the security of its cloud-based infrastructure. They currently have multiple departments that use the same cloud environment, and they want to make sure that each department can only access the resources that they are authorized to use. Which of the following solutions would be the BEST to implement for this scenario?

A company wants to limit the impact of a security breach in the event that an attacker gains access to their network. Which of the following physical segmentation techniques would be the MOST appropriate?

In a large data center, a security administrator wants to reduce the risk of unauthorized access to sensitive data by implementing physical segmentation. Which of the following would be the most effective solution?

A small business is concerned about the risk of asset theft and wants to implement a security solution that can help identify stolen assets. Which security solution would be MOST effective for this purpose?

A company is considering moving its IT infrastructure to the cloud to improve flexibility and scalability. Which of the following security solutions should they consider to address the risks of cloud infrastructure management compared to on-premises?

A security analyst has received an alert that a user account has been compromised and the attacker is attempting to escalate privileges on the network. What stage of the Kill chain is this activity associated with?

A security analyst has identified an intrusion in the organization’s network. The analyst wants to understand the attacker’s tactics, techniques, and procedures (TTPs) to improve their defense strategy. Which attack framework should the analyst use to analyze the intrusion and identify the TTPs?

In a recent security incident, your organization detected a suspicious process running on several endpoints. To determine if this is an actual threat, you decide to use MITRE ATT&CK to research potential attack techniques. Which MITRE ATT&CK tactic should you focus on to gain insight into how the threat actor might have gained a foothold in your environment?

A government agency is looking to improve its threat intelligence capabilities. Which of the following would be the best way to leverage an information-sharing and analysis community (ISAC)?

A small financial services firm is considering joining an information-sharing and analysis organization (ISAO) for the first time. The CEO is hesitant because of concerns about sharing sensitive information with other organizations. Which of the following is a key benefit of ISAO membership that could address these concerns?

A healthcare organization is considering joining an information-sharing and analysis community (ISAC) for the healthcare industry. Which of the following is a potential benefit of participating in an ISAC?

A group of attackers has compromised the email accounts of several prominent politicians and released sensitive information to the public. The attackers claim to be motivated by a desire to expose corruption and promote transparency in government. Which type of threat actor is this an example of?

A government agency has identified a sophisticated cyber attack that is targeting a specific department. The attackers have used custom malware and techniques that are consistent with previous attacks attributed to a particular country. Which type of threat actor is this an example of?

A security team has discovered that an attacker has been infiltrating the network for several months, conducting reconnaissance, and exfiltrating sensitive data. Which type of threat is this an example of?

A security team has identified a new vulnerability in a critical system that is being actively exploited by attackers. The vulnerability was previously unknown and there is no known patch or workaround. Which type of threat is this an example of?

A security team is analyzing a new threat that has been discovered on the network. The team has identified that the threat is using a known exploit to gain access to the network. Which type of threat is this an example of?

A security analyst is investigating a cyber attack on a company’s network. The analyst needs to gather intelligence about the indicators of compromise used in the attack. Which structured format for sharing information about indicators of compromise and malware behavior uses a simple XML schema and is compatible with other cybersecurity tools?

A security team is investigating a data breach that occurred on the company’s network. The team needs to gather intelligence about the malware that was used in the attack. Which threat intelligence source should the team use to obtain TAXII-formatted intelligence about the malware?

A security team is trying to share information about a new type of malware with other organizations in their industry. The team wants to use a standardized format to share the information. Which threat intelligence sharing format should the team use?

A security analyst is investigating a series of attacks that appear to be targeting the company’s financial systems. The analyst needs to gather intelligence about the threat actors and their capabilities. Which intelligence source should the analyst use to obtain information with a high confidence level?

A security analyst is investigating a series of phishing attacks targeting the company’s employees. The analyst needs to gather intelligence about the tactics and the threat actors behind the attacks. Which intelligence source should the analyst use to obtain relevant information about the attacks?

A security analyst is investigating a cyber attack that took place on the company’s network over the weekend. The analyst needs to gather intelligence about the attack and the threat actors behind it. Which intelligence source should the analyst use to obtain timely information about the attack?

A security analyst is investigating a series of cyber attacks targeting the company’s email servers. The analyst needs to gather intelligence about the attack tactics and the threat actors behind the attacks. Which open-source intelligence (OSINT) source can the analyst use to obtain this information?

A penetration tester is analyzing the output from a web server’s access logs and notices that there is a high volume of requests for a specific URL that does not exist. What could this indicate?

You are a penetration tester planning a project for a client. You need to select a framework for the project. Which of the following frameworks provides guidance for a comprehensive penetration testing process and is designed to be flexible and customizable to meet the needs of the tester and client?

You are a penetration tester hired to perform a penetration test on an organization’s network. You have identified the target assets and set the boundaries of the testing. However, as you progress through the testing, you notice that new assets and systems keep getting added, which results in a lack of focus on the original objectives. What is this called?

A company is considering outsourcing some of its IT operations to a third-party provider. The provider has offered a master service agreement (MSA) for the company to review. Which of the following best describes the purpose of an MSA in this context?

Which of the following types of disaster recovery sites enables a company to quickly resume normal business operations in the event of a disaster?

Your company has just suffered a natural disaster and you need to ensure that business operations can continue without interruption. Which of the following would you rely on to accomplish this task?

Which of the following resources can help you identify web application vulnerabilities and ensure the security of your web application?

You have been tasked with implementing a solution to detect and gather information on unauthorized access attempts on the company’s network. Which of the following techniques would you implement to meet this requirement in the most cost-effective manner?

An organization has recently been the victim of a cyber attack where an attacker was able to compromise a software vendor’s update server and distribute malware through software updates. As the IT security administrator for the organization, you have been tasked with identifying the type of attack that occurred. Which of the following types of attacks BEST describes the scenario described above?

Which of the following solutions enables your application to communicate with an external service by utilizing straightforward commands, thereby eliminating the need for complex processes to be developed in-house?

A large retail company is looking to move its customer data to a cloud-based storage solution for better scalability and cost-effectiveness. They are concerned about the security of their customer data in the cloud. Which of the following solutions would be most appropriate for this company to ensure the security of its customer data in the cloud?

Which of the following solutions would you implement to enhance the security of your company’s local area network (LAN) while ensuring that external-facing servers such as the web server, mail server, and FTP server remain accessible from the internet, while the rest of the internal LAN remains protected?

As a penetration tester, you have been hired to test the security of a company’s web application. Which of the following should be established before you begin the testing?

Which of the following cybersecurity testing exercise teams is known for its ability to perform both offensive and defensive tactics?

What type of attack involves an individual utilizing a compromised user account to gain unauthorized access to elevated privileges on a network?

Which of the following injection attacks enables an attacker to disrupt the queries that an application conducts with its database?

A company provides cloud-based storage solutions to its clients. The company wants to ensure that its clients receive the level of service they expect and are paying for. Which of the following agreements would be the MOST appropriate to establish the company’s commitment to its clients regarding the quality of service they receive?

In order to ensure comprehensive security monitoring and analysis of all network activities within your organization, you have been tasked with implementing a solution that centralizes the recording of events. Which of the following security measures would you implement to fulfill this requirement?

In the context of vulnerability management, which of the following is an example of a true negative?

A vulnerability scanning tool has identified a potential vulnerability in a server that hosts a critical application. The IT team responsible for managing the server has conducted a thorough investigation and determined that the identified vulnerability does not exist on the server. Which of the following best describes this situation?

You are conducting a vulnerability scan of your organization’s network and come across a potential vulnerability in a web application that could lead to unauthorized access. You decide to investigate the issue further and perform a manual penetration test, which confirms the presence of the vulnerability. What type of result is this considered?

A security analyst is tasked with identifying vulnerabilities in a company’s network infrastructure. Which of the following activities involves mapping/enumeration to discover vulnerable systems?

Which of the following is a disadvantage of active scanning for vulnerability identification?

In which of the following scenarios is passive scanning preferred over active scanning for vulnerability identification?

In a large organization, the security operations center (SOC) team is responsible for monitoring the network and detecting potential threats. A security analyst has identified a suspicious IP address that is attempting to connect to a database server. The analyst uses threat intelligence to further investigate this IP address and discovers that it has been linked to several successful attacks against financial institutions in the past. What is the next step the analyst SHOULD take to support the detection and monitoring function?

A company has implemented a vulnerability management program and is using threat intelligence to identify potential threats. Which of the following is an example of utilizing threat intelligence to support vulnerability management?

Which of the following is an example of threat intelligence that can be used in incident response?