PRO-CYSA

Test final — CompTIA CySA+ — Analyste en cybersécurité (CS0-003), prépa-examen

Répondez aux 45 questions. Il faut 80 % ou plus pour réussir. Vous pouvez réessayer autant de fois que vous le souhaitez.

Ce test final est disponible en anglais.

Suivre la formation →

Question 1Which CySA+ CS0-003 domain carries the largest exam weighting?Reporting & CommunicationIncident Response & ManagementSecurity OperationsGovernance & Compliance

Question 2Vulnerability Management accounts for roughly what share of the CS0-003 exam?5%55%30%80%

Question 3Which type of indicator is the MOST durable and costly for an attacker to change?Tactics, techniques and procedures (TTPs)A source IP addressA file hashA domain name

Question 4What is the PRIMARY purpose of the MITRE ATT&CK framework for an analyst?To price cyber-insurance policiesTo map adversary tactics and techniques and find detection gapsTo certify auditorsTo replace the SIEM

Question 5Why is NTP time synchronisation important across log sources?It encrypts the logsIt compresses log storageIt blocks malwareIt produces a reliable, correlated timeline for investigation

Question 6A host makes a connection of identical size to the same external server every 60 seconds. This pattern most strongly suggests:Normal web browsingC2 beaconingDNS cachingA printer driver update

Question 7What does CVSS primarily express?The severity of a vulnerabilityThe attacker's identityThe patch release dateThe financial loss of a breach

Question 8Which factor, beyond CVSS, is MOST important when prioritising a vulnerability for remediation?The vendor's stock priceThe colour of the scanner dashboardThe asset's criticality and exposureThe alphabetical order of the CVE

Question 9A scanner reports a flaw that does not actually exist on the target. This is a:False negativeTrue positiveFalse positiveTrue negative

Question 10What does a CWE identifier describe?A specific software product versionA single unique vulnerability instanceAn encryption algorithmA class of software weakness

Question 11In the NIST incident-response lifecycle, which phase comes FIRST?ContainmentRecoveryPreparationEradication

Question 12Why should evidence be collected following the order of volatility?Because volatile data such as RAM is lost when power is removedTo speed up the scannerBecause disk data changes every secondTo save disk space

Question 13What does chain of custody primarily ensure?That backups are encryptedThat evidence handling is documented and defensibleThat firewalls are patchedThat users change passwords

Question 14A credentialed vulnerability scan differs from a non-credentialed scan in that it:Requires no configurationRuns faster but sees nothingOnly scans the network perimeterAuthenticates to the host and sees far more detail

Question 15Which model relates adversary, capability, infrastructure and victim?The waterfall modelThe OSI modelThe CIA triadThe Diamond Model

Question 16Static malware analysis is BEST described as:Interviewing the attackerDetonating the file in a sandboxInspecting the file without executing itReformatting the disk

Question 17Why might a sandbox report a malicious file as clean?The malware detected the sandbox and stayed dormantThe file was deletedThe CPU was too fastSandboxes never make mistakes

Question 18What primarily distinguishes threat hunting from automated alerting?It is reactive and waits for alertsIt is a proactive, hypothesis-driven searchIt requires no dataIt only runs once a year by law

Question 19Email authentication mechanisms SPF, DKIM and DMARC primarily help an analyst to:Speed up deliveryCompress attachmentsEncrypt the mailboxValidate sender legitimacy and spot spoofing

Question 20A 'living off the land' attack is characterised by:Installing obvious custom malwareUsing legitimate built-in tools such as PowerShell maliciouslyOnly physical accessSending postal mail

Question 21What is the purpose of a compensating control?To replace the security teamTo reduce risk when the primary fix cannot be applied immediatelyTo delete logsTo increase CVSS scores

Question 22Which risk response formally acknowledges residual risk without further action?Risk remediationRisk transferRisk avoidanceRisk acceptance

Question 23A SOAR platform mainly adds which capability to a SIEM?Physical badge accessOrchestration and automated response playbooksSalary payrollEmail marketing

Question 24Which metric measures how long an attacker remains undetected in an environment?Dwell timeUptimeBandwidthPatch level

Question 25When writing a report for executives, an analyst should emphasise:Raw packet capturesBusiness risk, impact and the decision requiredFull hex dumpsScanner version numbers

Question 26The OWASP Top 10 is a catalogue of:The ten fastest CPUsEncryption keysApproved firewallsCommon web-application security risks

Question 27Restoring a system from a backup taken AFTER the compromise is dangerous because:Backups are always corruptIt can re-install the attacker's footholdIt uses too much storageIt violates NTP

Question 28NetFlow data is best described as:Connection metadata for large-scale traffic analysisAntivirus signaturesUser passwordsFull packet payloads

Question 29Which CVSS base metric reflects whether user interaction is needed to exploit a flaw?ScopeAttack VectorPrivileges RequiredUser Interaction

Question 30An ISAC primarily provides:Sector-specific threat-intelligence sharingCloud storageDiscount hardwarePayroll services

Question 31Which is a strong sign of DNS being abused as a covert channel?Normal short A-record lookupsUnusually long or high-volume DNS queries carrying encoded dataCached responsesA single PTR lookup

Question 32Why validate vulnerability findings before escalating them?To slow down the teamTo remove false positives and protect the team's credibilityTo increase the CVE countTo avoid patching anything

Question 33A write blocker is used in forensics to:Speed up imagingEncrypt the networkPrevent any modification of the source evidence driveCompress logs

Question 34The Cyber Kill Chain models an intrusion primarily as:A single instant eventA random set of unrelated alertsA sequence of progressive attacker stagesA budgeting process

Question 35Which scan timing concern is MOST valid for fragile production systems?Aggressive scanning during business hours can disrupt themScans always improve performanceScanning is illegal during the dayScanners cannot reach production

Question 36UEBA primarily detects threats by:Patching softwareBlocking all trafficFlagging deviations from a behavioural baselineEncrypting drives

Question 37Which is the BEST first containment action for a single compromised workstation that you still want to investigate?Network-isolate the host while preserving its stateIgnore it until the weekly reviewPower it off instantlyImmediately wipe and reimage it

Question 38Why is asset inventory foundational to vulnerability management?It lowers CVSS scores automaticallyIt replaces the firewallYou cannot scan or protect assets you do not know existIt is required by NTP

Question 39A performance-based question (PBQ) on the CySA+ exam typically requires you to:Recite a definitionDraw a logoWrite an essay about historyApply skills to a realistic scenario or simulation

Question 40Tactical threat intelligence is MOST useful for:Long-term budgetingBoard-level strategy decisionsImmediate detection and blocking of current indicatorsHiring decisions

Question 41Which artefact best reveals a 'living off the land' technique on an endpoint?Process lineage and command-line argumentsThe monitor brightnessThe keyboard layoutThe desktop wallpaper

Question 42Mean Time To Respond (MTTR) measures:The number of firewallsThe number of employeesDisk capacityThe average time to contain or resolve an incident

Question 43A misconfigured public cloud storage bucket is dangerous mainly because it:Can expose sensitive data to anyone on the internetSlows the networkIncreases CPU usageBreaks NTP

Question 44The CVSS Environmental metric group exists to:Tailor the score to the organisation's specific contextTrack the weatherSet the patch priceName the malware

Question 45The single most important determinant of incident-response success is usually:The number of alerts generatedThe brand of antivirusThe colour of the dashboardThe quality of preparation done beforehand

Test final — CompTIA CySA+ — Analyste en cybersécurité (CS0-003), prépa-examen

Déjà payé ?