CySA+ Prep

In the Diamond Model, what is malware associated with?

What is the primary focus of business continuity (BC)?

What might encrypted HTTP traffic to an unfamiliar domain at intervals suggests?

Why might reimaging be preferred over using antimalware tools after an infection?

In incident detection, what is the primary challenge when dealing with unknown threats?

What is a key capability of SIEM for understanding security incidents?

What type of malicious activity would use of ipconfig in logs?

What is the purpose of penetration testing in incident response training?

Which phase follows weaponization in the cyber kill chain?

What is a primary benefit of OSSTMM?

Which is not a matrix found in the MITRE ATT&CK Framework?

What is the main objective of a lessons-learned review following a security incident?

What is the primary purpose of documenting lessons learned in incident response?

What is essential in DKIM for outgoing emails?

Which should be your primary focus when prioritizing security alerts?

What feature of Wireshark helps analyze traffic across multiple interfaces?

What header field should be checked first for domain spoofing?

What might frequent encrypted communications from a workstation indicate?

A database record was altered without authorization. What type of breach is this?

What does a downward trend in MTTR usually indicate in incident response?

Why are incident response playbooks important for an organization?

What is the primary focus of the Preparation phase in incident response?

What type of malicious activity would use of curl on a compromised server?

What type of malicious activity would be using DownloadString with WebClient?

Best practice for links in email bodies?

What might excessive ARP traffic indicate?

What is a critical legal consideration when collecting digital evidence?

What is a key benefit of listening to stakeholders during an incident?

Which platform checks for reports of abuse linked to an IP address?

Which tool is primarily used for identifying vulnerabilities in a network?

What are playbooks in the context of a SOAR system?

What is crucial in a sandbox environment for malware analysis?

What command writes tcpdump output to "network_traffic.pcap"?

What might HTTP 503 errors indicate during a DDoS attack?

Which SOAR playbook step helps assess alert criticality?

When is netcat listener suspicious?

What is the significance of maintaining a proper chain of custody for evidence?

How does an EDR solution enhance incident response?

What is a critical factor to consider when performing impact analysis of a DDoS attack?

What is a key requirement in the breach reporting process after a credit card data breach?