CySA+ Practice Questions

An incident response memory capture of processes has happened. What next?

An admin installed a tool to troubleshoot issues, the tool causes major network problems. Best prevention?

Which of the following ports would you most likely need to close and/or block for best security practices?

An enterprise acquires a software company that lacks any security monitoring, what next/first?

Best way to avoid unauthorized firmware changes.

MFA is the best way or prevent credential stuffing attacks.

What is the best way to prevent impact from attacks that exfiltrate data to remote destinations?

A person's control over their personal information is most closely related to privacy versus security.

What type of control is used when you place ACL on a file or folder?

DLP is the best way to defend against sensitive data exfiltration.

You need the patch information for a server. Best way to gather it?

An expensive system cannot use updated OS. Best way to mitigate without replacing?

It is possible to configure NAC to only allow patched and antivirus guest connection devices for security?

Investing first in failover and redundant systems is the best way to reduce impact on availability.

Acceptance testing ensures an application meets the needs of a business

It is possible to perform an enterprise wide scan for sensitive data.

A Nessus scan will provide a list of hosts that match known high severity CVE database threat vulnerabilities

When email header actual address does not match the displayed from address, is this suspicious?

Keeping IoT device firmware updated is best by automating the detection and immediate deployment of update releases.

What solution would solve Group Policy updates issues and determining which policy might cause the issues?

Which is most secure state for server(s) not in use?

A timeline reconstruction will provide information about how and when a compromise took place on a server.

A technical control such as enhanced encryption functions would help mitigate privacy compliance

Incident response reveals memory contents that might be malicious. Next step?

After an incident has occurred, using the Diamond Model analysis will add the benefit of identifying:

A vulnerability involving vehicles would be associated with which attack vector?

Compared to SIEM, SOAR needs less human intervention.

Zero day threats are likely to use polymorphic code.

Mobile devices containing data can be safeguarded by using a mobile device wiping solution if lost or stolen.

Unsupervised algorithms produce more false positives than supervised algorithms.

Which is a difference between SOAR and SCAP?

Prevent by establishing ransomware awareness training and secure and verifiable backups.

A policy to disable unnecessary services is an example of reducing attack surface.

The best way to prevent ActiveX controls from running malicious code is to block them in web browser settings.

Which of these as standalone items are PII?

A security analyst reviews code for secure vulnerabilities. A static analysis is the best way to accomplish this.

A VM has been compromised. First steps in response?

Data sovereignty issues would MOST likely be impacted during

To survey an organization's sensitive data, which is the most accurate method?

An oil company website is defaced with political propaganda. Which type of threat actor is most likely responsible?

SSO is the best way to prevent issues with accounts creation across many systems.

Which best defends against sensitive data exfiltration?

Which is the best approach to ensure drives cannot be reused

A hard drive has a Linux swap partition. Which Linux command would help you extract human friendly content for analysis

A team meeting to discuss response plans is a Tabletop exercise

Diamond Model of Analysis - Adversary point relates to the intruder domain, email address and software version.

Which control function can verify that data has not been altered without authorization.

An individual's control over personal information is MOST related to privacy rather than confidentiality or integrity.

You wish to automate security tool data and reports acquisition. Best tool?

User input validation is the best prevention of script injection vulnerabilities

Effective authentication and authorization methods is the best parameter mitigation choice.

Why would it be a good practice to prohibit the use of short message service (SMS) tokens?

Proactive threat hunting includes understanding attack vectors and integrating intelligence sources.

Which 2 are reasons consumer IoT devices should not be allowed in enterprises?

What best prevents exfiltration of sensitive data?

Events show the use of a URL with ../../../../ which indicates directory traversal attack.

What would allow a company to securely allow data to be stored in the cloud (3rd-party network)?