PRO-CYSA

الاختبار النهائي — CompTIA CySA+ — محلّل الأمن السيبراني (CS0-003)، تحضير الامتحان

أجب عن الأسئلة الـ45. تحتاج إلى 80% أو أكثر للنجاح. يمكنك إعادة المحاولة كلما أردت.

هذا الاختبار النهائي متاح بـالإنجليزية.

السؤال 1Which CySA+ CS0-003 domain carries the largest exam weighting?Reporting & CommunicationIncident Response & ManagementSecurity OperationsGovernance & Compliance

السؤال 2Vulnerability Management accounts for roughly what share of the CS0-003 exam?5%55%30%80%

السؤال 3Which type of indicator is the MOST durable and costly for an attacker to change?Tactics, techniques and procedures (TTPs)A source IP addressA file hashA domain name

السؤال 4What is the PRIMARY purpose of the MITRE ATT&CK framework for an analyst?To price cyber-insurance policiesTo map adversary tactics and techniques and find detection gapsTo certify auditorsTo replace the SIEM

السؤال 5Why is NTP time synchronisation important across log sources?It encrypts the logsIt compresses log storageIt blocks malwareIt produces a reliable, correlated timeline for investigation

السؤال 6A host makes a connection of identical size to the same external server every 60 seconds. This pattern most strongly suggests:Normal web browsingC2 beaconingDNS cachingA printer driver update

السؤال 7What does CVSS primarily express?The severity of a vulnerabilityThe attacker's identityThe patch release dateThe financial loss of a breach

السؤال 8Which factor, beyond CVSS, is MOST important when prioritising a vulnerability for remediation?The vendor's stock priceThe colour of the scanner dashboardThe asset's criticality and exposureThe alphabetical order of the CVE

السؤال 9A scanner reports a flaw that does not actually exist on the target. This is a:False negativeTrue positiveFalse positiveTrue negative

السؤال 10What does a CWE identifier describe?A specific software product versionA single unique vulnerability instanceAn encryption algorithmA class of software weakness

السؤال 11In the NIST incident-response lifecycle, which phase comes FIRST?ContainmentRecoveryPreparationEradication

السؤال 12Why should evidence be collected following the order of volatility?Because volatile data such as RAM is lost when power is removedTo speed up the scannerBecause disk data changes every secondTo save disk space

السؤال 13What does chain of custody primarily ensure?That backups are encryptedThat evidence handling is documented and defensibleThat firewalls are patchedThat users change passwords

السؤال 14A credentialed vulnerability scan differs from a non-credentialed scan in that it:Requires no configurationRuns faster but sees nothingOnly scans the network perimeterAuthenticates to the host and sees far more detail

السؤال 15Which model relates adversary, capability, infrastructure and victim?The waterfall modelThe OSI modelThe CIA triadThe Diamond Model

السؤال 16Static malware analysis is BEST described as:Interviewing the attackerDetonating the file in a sandboxInspecting the file without executing itReformatting the disk

السؤال 17Why might a sandbox report a malicious file as clean?The malware detected the sandbox and stayed dormantThe file was deletedThe CPU was too fastSandboxes never make mistakes

السؤال 18What primarily distinguishes threat hunting from automated alerting?It is reactive and waits for alertsIt is a proactive, hypothesis-driven searchIt requires no dataIt only runs once a year by law

السؤال 19Email authentication mechanisms SPF, DKIM and DMARC primarily help an analyst to:Speed up deliveryCompress attachmentsEncrypt the mailboxValidate sender legitimacy and spot spoofing

السؤال 20A 'living off the land' attack is characterised by:Installing obvious custom malwareUsing legitimate built-in tools such as PowerShell maliciouslyOnly physical accessSending postal mail

السؤال 21What is the purpose of a compensating control?To replace the security teamTo reduce risk when the primary fix cannot be applied immediatelyTo delete logsTo increase CVSS scores

السؤال 22Which risk response formally acknowledges residual risk without further action?Risk remediationRisk transferRisk avoidanceRisk acceptance

السؤال 23A SOAR platform mainly adds which capability to a SIEM?Physical badge accessOrchestration and automated response playbooksSalary payrollEmail marketing

السؤال 24Which metric measures how long an attacker remains undetected in an environment?Dwell timeUptimeBandwidthPatch level

السؤال 25When writing a report for executives, an analyst should emphasise:Raw packet capturesBusiness risk, impact and the decision requiredFull hex dumpsScanner version numbers

السؤال 26The OWASP Top 10 is a catalogue of:The ten fastest CPUsEncryption keysApproved firewallsCommon web-application security risks

السؤال 27Restoring a system from a backup taken AFTER the compromise is dangerous because:Backups are always corruptIt can re-install the attacker's footholdIt uses too much storageIt violates NTP

السؤال 28NetFlow data is best described as:Connection metadata for large-scale traffic analysisAntivirus signaturesUser passwordsFull packet payloads

السؤال 29Which CVSS base metric reflects whether user interaction is needed to exploit a flaw?ScopeAttack VectorPrivileges RequiredUser Interaction

السؤال 30An ISAC primarily provides:Sector-specific threat-intelligence sharingCloud storageDiscount hardwarePayroll services

السؤال 31Which is a strong sign of DNS being abused as a covert channel?Normal short A-record lookupsUnusually long or high-volume DNS queries carrying encoded dataCached responsesA single PTR lookup

السؤال 32Why validate vulnerability findings before escalating them?To slow down the teamTo remove false positives and protect the team's credibilityTo increase the CVE countTo avoid patching anything

السؤال 33A write blocker is used in forensics to:Speed up imagingEncrypt the networkPrevent any modification of the source evidence driveCompress logs

السؤال 34The Cyber Kill Chain models an intrusion primarily as:A single instant eventA random set of unrelated alertsA sequence of progressive attacker stagesA budgeting process

السؤال 35Which scan timing concern is MOST valid for fragile production systems?Aggressive scanning during business hours can disrupt themScans always improve performanceScanning is illegal during the dayScanners cannot reach production

السؤال 36UEBA primarily detects threats by:Patching softwareBlocking all trafficFlagging deviations from a behavioural baselineEncrypting drives

السؤال 37Which is the BEST first containment action for a single compromised workstation that you still want to investigate?Network-isolate the host while preserving its stateIgnore it until the weekly reviewPower it off instantlyImmediately wipe and reimage it

السؤال 38Why is asset inventory foundational to vulnerability management?It lowers CVSS scores automaticallyIt replaces the firewallYou cannot scan or protect assets you do not know existIt is required by NTP

السؤال 39A performance-based question (PBQ) on the CySA+ exam typically requires you to:Recite a definitionDraw a logoWrite an essay about historyApply skills to a realistic scenario or simulation

السؤال 40Tactical threat intelligence is MOST useful for:Long-term budgetingBoard-level strategy decisionsImmediate detection and blocking of current indicatorsHiring decisions

السؤال 41Which artefact best reveals a 'living off the land' technique on an endpoint?Process lineage and command-line argumentsThe monitor brightnessThe keyboard layoutThe desktop wallpaper

السؤال 42Mean Time To Respond (MTTR) measures:The number of firewallsThe number of employeesDisk capacityThe average time to contain or resolve an incident

السؤال 43A misconfigured public cloud storage bucket is dangerous mainly because it:Can expose sensitive data to anyone on the internetSlows the networkIncreases CPU usageBreaks NTP

السؤال 44The CVSS Environmental metric group exists to:Tailor the score to the organisation's specific contextTrack the weatherSet the patch priceName the malware

السؤال 45The single most important determinant of incident-response success is usually:The number of alerts generatedThe brand of antivirusThe colour of the dashboardThe quality of preparation done beforehand

الاختبار النهائي — CompTIA CySA+ — محلّل الأمن السيبراني (CS0-003)، تحضير الامتحان

هل دفعت بالفعل؟