CompTIA CS0-003 Exam Practice Questions to Pass CompTIA CySA+ Exam

Question 1

Which of the following is the best framework for assessing how attackers use techniques over an infrastructure to exploit a target's information assets?

AStructured Threat Information Expression

BOWASP Testing Guide

COpen Source Security Testing Methodology Manual

DDiamond Model of Intrusion Analysis

Answer : D

The Diamond Model of Intrusion Analysis focuses on understanding the relationships between the adversary, their capabilities, infrastructure, and victim. It provides a structured approach to examining how attackers exploit information assets. According to CompTIA CySA+, this model is valuable for detailing attack patterns and understanding the infrastructure attackers use. The other options, like Structured Threat Information Expression (A) and OWASP Testing Guide (B), address threat data sharing and web application testing, respectively, while the Open Source Security Testing Methodology Manual (OSSTMM) (C) covers general security testing procedures.

Question 2

Which of the following can be used to learn more about TTPs used by cybercriminals?

AZenMAP

BMITRE ATT&CK

CNational Institute of Standards and Technology

DtheHarvester

Answer : B

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. It can help security professionals understand, detect, and mitigate cyber threats by providing a comprehensive framework of TTPs.

Question 3

A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?

AExternal

BAgent-based

CNon-credentialed

DCredentialed

Answer : B

Agent-based vulnerability scanning is a method that involves installing software agents on the target systems or networks that can perform local scans and report the results to a central server or console. Agent-based vulnerability scanning can reduce network traffic, as the scans are performed locally and only the results are transmitted over the network. Agent-based vulnerability scanning can also provide more accurate and up-to-date results, as the agents can scan continuously or on-demand, regardless of the system or network status or location.

Question 4

An organization wants to establish a disaster recovery plan for critical applications that are hosted on premises. Which of the following is the first step to prepare for supporting this new requirement?

AChoose a vendor to utilize for the disaster recovery location.

BEstablish prioritization of continuity from data and business owners.

CNegotiate vendor agreements to support disaster recovery capabilities.

DAdvise the leadership team that a geographical area for recovery must be defined.

Answer : B

Comprehensive and Detailed Explanation From Exact Extract:

The first step in building a disaster recovery plan (DRP) for critical on-prem applications is to determine what is actually ''critical'' to the business, how long the organization can tolerate those applications being down, and therefore what restoration order (prioritization) is required. That prioritization must come from business/data owners and stakeholders, because they understand operational dependencies, business impact, and acceptable downtime.

This is essentially the start of a Business Impact Analysis (BIA) and related continuity prioritization work, which precedes choices like vendors, contracts, or site geography. You don't select a DR site/vendor or negotiate agreements until you know which systems must be restored first and what recovery objectives you must meet.

Supporting exact extracts:

The All-in-One CS0-003 guide explains that the foundation is identifying critical systems and determining tolerable outage time (used to prioritize restoration):

Exact extract (All-in-One Exam Guide): ''The key is to determine which of the organization's critical systems are needed for survival and then estimate the outage time that can be tolerated by the organization...''

It then connects those determinations directly to prioritization:

Exact extract (All-in-One Exam Guide): ''These estimates will help you determine how to prioritize response team efforts to restore these assets.''

The Secbay Press CS0-003 guide lays out the early BIA/risk identification steps in order, starting with identifying what's critical before recovery priorities:

Exact extract (Secbay Press): ''1. Identify critical processes and resources

2. Identify outage impacts and estimate downtime

3. Identify resource requirements

4. Identify recovery priorities''

Why the other options are not the first step:

A / C (vendor selection / vendor agreements): those come after requirements are defined (RTO/MTD, criticality, order of restoration).

D (define geographic area): location considerations are important, but they are driven by requirements and constraints discovered during BIA/continuity prioritization (what needs to be recovered, how fast, and with what dependencies).

Reference (CompTIA CySA+ CS0-003 documents / study guides used):

Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): determine critical systems and tolerable outage time; used to prioritize restoration

Question 5

Which of the following is often used to keep the number of alerts to a manageable level when establishing a process to track and analyze violations?

ALog retention

BLog rotation

CMaximum log size

DThreshold value

Answer : D

A threshold value is a parameter that defines the minimum or maximum level of a metric or event that triggers an alert. For example, a threshold value can be set to alert when the number of failed login attempts exceeds 10 in an hour, or when the CPU usage drops below 20% for more than 15 minutes. By setting a threshold value, the process can filter out irrelevant or insignificant alerts and focus on the ones that indicate a potential problem or anomaly.A threshold value can help to reduce the noise and false positives in the alert system, and improve the efficiency and accuracy of the analysis12

Question 6

A security analyst is assessing the security of a cloud environment. The following output is generated when the assessment runs:

Authentication error

Instance not found on preset location

Which of the following should the analyst use to fix the issue?

Arun module_name and exec <module_name>

B--session <session_name> and --module-args=''

Cset_regions <region1> and set_key

D--whoami and --data <service_name>

Answer : C

Comprehensive and Detailed Explanation From Exact Extract:

The error messages point to two core issues common in cloud assessments:

Authentication error credentials/API access not correctly configured (keys/tokens/CLI auth).

Instance not found on preset location the tool is looking in the wrong region/location (cloud resources are region-scoped).

Cloud infrastructure assessment tools typically require API-based access and allow configuration to include/exclude regions. The All-in-One guide explains that cloud tools like Scout Suite and Prowler work via cloud APIs and require configuration to enable programmatic access, and Prowler specifically can include/exclude regions:

Exact extract (All-in-One Exam Guide): Scout Suite ''works by managing the interactions with cloud assets via the platform API...''

Exact extract (All-in-One Exam Guide): ''Prowler offers a fair amount of configuration to allow the tool programmatic access via the Amazon API...''

Exact extract (All-in-One Exam Guide): Prowler ''provides the option to... include or exclude certain AWS services or regions...''

These extracts support why the fix is to set the correct region and ensure valid authentication/keys, which maps directly to Option C (set_regions ... and set_key).

Why the other options don't match the errors:

A / B look like generic module/session execution flags (more like exploitation frameworks), not ''fix authentication + wrong region.''

D (--whoami, --data) is identity/data querying; it doesn't correct credential setup or region selection.

Reference (CompTIA CySA+ CS0-003 documents / study guides used):

Question 7

A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

AScan the employee's computer with virus and malware tools.

BReview the actions taken by the employee and the email related to the event

CContact human resources and recommend the termination of the employee.

DAssign security awareness training to the employee involved in the incident.

Answer : B

In case of a phishing attack, it's crucial to review what actions were taken by the employee and analyze the phishing email to understand its nature and impact.Reference:CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 6, page 246;CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 6, page 255.

CompTIA Cybersecurity Analyst (CySA+) Exam CS0-003 Practice Questions