Question 1

An organization's next-generation firewall logs show a blocked attempt to connect to a web server on a port associated with a known vulnerability. The connection originated from an IP address listed on a threat intelligence feed. At which phase of the Cyber Kill Chain was this attack successfully disrupted?

Accepted Answer

Delivery, Exploitation, Installation, Reconnaissance

Question 2

An incident response plan (IRP) serves as the strategic, overarching guide for an organization's response to security incidents. Which of the following are essential components that should be clearly defined within the IRP? (Select Two)

Accepted Answer

The criteria for incident declaration and severity classification, A complete inventory of all hardware and software assets, Step-by-step technical procedures for eradicating specific malware, The roles, responsibilities, and contact information for the incident response team, A list of approved software for employee workstations

Question 3

A cybersecurity analyst discovers a critical vulnerability in a legacy SCADA system that controls a manufacturing plant's assembly line. The vendor has confirmed that no patch will be released for this version of the system. To mitigate the risk without impacting operations, which of the following would be the MOST effective response?

Accepted Answer

Implement network segmentation to isolate the SCADA system., Perform daily vulnerability scans on the system., Accept the risk and document it in the risk register., Upgrade the SCADA system to the latest supported version.

Question 4

An organization is seeking a security testing methodology that provides a holistic view of its security posture by evaluating not just technical controls, but also human and physical security elements. The assessment must include tests for social engineering and an evaluation of physical access controls to the data center. Which framework is BEST suited for this requirement?

Accepted Answer

Open Source Security Testing Methodology Manual (OSSTMM), MITRE ATT&CK, OWASP Testing Guide, Cyber Kill Chain

Question 5

A help desk ticket is escalated to the security team where a user reports their workstation is performing extremely slowly and an unfamiliar application named `system_updater.exe` is consuming high CPU resources. The application is located in the user's `Downloads` folder. This is a primary indicator of:

Accepted Answer

Unauthorized software installation, A service interruption, A file integrity monitoring alert, A rogue device on the network

Question 6

A cloud security engineer is tasked with ensuring all virtual machines deployed in the production environment adhere to the company's security standards defined in a hardened OS image. The engineer uses an automation tool to continuously monitor for deviations from this baseline and automatically revert any unauthorized changes. This approach is a primary component of:

Accepted Answer

Threat hunting, Service-level objectives (SLOs), Secure SDLC, Configuration management

Question 7

A security analyst at a global logistics firm is presented with three findings requiring immediate prioritization, but the team can only address one in the next 24 hours. Finding A is a vulnerability with a CVSS score of 9.8 on an isolated internal build server. Finding B is a vulnerability with a CVSS score of 6.5 on the company's primary internet-facing API gateway, which processes all customer orders. Finding C is a credible report of a zero-day exploit affecting the operating system of the core production database cluster, though no patch or CVE is available. Which finding should be prioritized for immediate remediation?

Accepted Answer

Finding C, because zero-day exploits are unknown threats and therefore pose the greatest risk to critical data assets., Finding A, because its CVSS score of 9.8 is the highest, indicating it is the most severe vulnerability., Finding B, because its combination of high asset value, public exposure, and potential for exploitation presents the most immediate and significant business impact., All findings should be entered into the risk register and addressed according to the standard patching cycle to ensure process compliance.

Question 8

While reviewing the security logs of a critical Windows Server, an analyst discovers multiple event IDs 4738 immediately followed by event IDs 4728 and 4756 for a newly created administrative account. This sequence of events is highly indicative of which type of malicious activity?

Accepted Answer

Privilege escalation through group membership changes, Installation of a persistent rootkit, A brute-force password attack, Data exfiltration via DNS tunneling

Question 9

An attacker uses PsExec with a legitimate administrator account on a domain controller to execute commands on adjacent servers. Considering the attacker has already established a foothold, which MITRE ATT&CK tactic does this action represent?

Accepted Answer

Execution, Initial Access, Credential Access, Lateral Movement

Question 10

A security operations center (SOC) analyst at a large-scale manufacturing firm is reviewing network flow data and observes a significant and sustained increase in outbound encrypted traffic from a specific engineering workstation. This activity is occurring late at night, and the destination IP address geolocates to a country where the firm has no business presence. The workstation's user is not on-call. Which of the following malicious activities does this pattern of indicators most strongly suggest?

Accepted Answer

Data exfiltration, A Distributed Denial-of-Service (DDoS) attack, Unauthorized software installation, A spear-phishing campaign

Question 11

A cybersecurity analyst identifies a zero-day exploit being actively used against the company's public-facing VPN concentrator. The vendor has not yet released a patch. Which actions are most appropriate for the analysis and containment phases? (Select Two)

Accepted Answer

Wait for the vendor to release an official patch., Isolate or segment the VPN concentrator from critical internal networks., Perform a full backup of the device's configuration., Rebuild the device from a known-good golden image., Implement compensating controls, such as an IPS signature.

Question 12

During a review of a vulnerability scan report, a cybersecurity analyst identifies a critical heap overflow vulnerability in a third-party binary application. The vendor cannot provide a patch for several months. Which operating system-level compensating control would be MOST effective at making exploitation of this vulnerability unreliable for an attacker?

Accepted Answer

Using application whitelisting, Enforcing file integrity monitoring (FIM), Implementing host-based intrusion detection (HIDS), Address Space Layout Randomization (ASLR)

Question 13

A web server, compromised through a zero-day exploit in its content management system (CMS), has been successfully contained and the malicious artifacts eradicated. The CMS vendor has not yet released a security patch. Which course of action best facilitates recovery while mitigating risk?

Accepted Answer

Keep the server offline indefinitely until the vendor provides an official patch., Rebuild the server on a different operating system to prevent reinfection., Restore the web server from the last known-good backup and bring it back online immediately., Deploy a web application firewall (WAF) with virtual patching rules to protect the CMS.

Question 14

A company's cloud-hosted customer relationship management (CRM) application suddenly becomes unavailable to all users. The cloud provider's status page shows no outages. Internal monitoring tools show that the application servers are running, but network flow logs reveal an abnormally high volume of inbound traffic from thousands of disparate IP addresses. The traffic consists primarily of small, well-formed HTTP GET requests targeting the application's login page. This situation is most characteristic of:

Accepted Answer

A rogue device consuming network resources, A successful data exfiltration attempt, An application-layer DDoS attack, A network-layer volumetric DDoS attack

Question 15

A security manager at a global manufacturing firm is preparing a vulnerability management report for a quarterly business review. The audience includes the Chief Information Security Officer (CISO), IT operations leadership, and non-technical business unit directors. To ensure the report is impactful and drives action across all stakeholder groups, which two elements are most crucial to include? (Select Two)

Accepted Answer

A trend analysis of the vulnerability aging metric, showing the number of critical vulnerabilities older than 30, 60, and 90 days., A risk-prioritized action plan that maps critical vulnerabilities to specific high-value business applications and outlines remediation owners., An exhaustive list of all discovered vulnerabilities, sorted by host IP address., The complete raw XML output from the vulnerability scanning tool for archival purposes., A comparison of the company's vulnerability scanner discovery count against industry-average vulnerability data.

Question 16

While analyzing ARP table logs from a core switch, a security analyst identifies a new MAC address that does not correspond to any device in the asset inventory. The device is using a static IP address within the data center's management subnet. Which of the following is the most likely security concern?

Accepted Answer

An ARP poisoning attack, A MAC spoofing attack, A rogue access point, A rogue server or device

Question 17

A logistics company's vulnerability management team has identified a severe vulnerability in the firmware of its warehouse's automated sorting systems, which are considered operational technology (OT). Remediation has been repeatedly postponed by the operations department. What is the MOST likely inhibitor in this scenario?

Accepted Answer

Concern over operational disruption and downtime, Absence of a valid CVSS score for the vulnerability, High cost of patching the firmware, Lack of security team expertise in OT systems

Question 18

While investigating an alert on a financial analyst's workstation, a SOC analyst discovers two key pieces of evidence. First, firewall logs show persistent, low-and-slow communication over TCP port 4444 to an IP address listed on a threat intelligence feed as a known command-and-control (C2) server. Second, endpoint detection and response (EDR) logs show a PowerShell script executing `svchost.exe` from the `%TEMP%` directory, a highly unusual behavior. Which two indicators of malicious activity are present in this scenario? (Select Two)

Accepted Answer

Unexpected network communication, Unauthorized software, Rogue device on the network, Data exfiltration, Service interruption

Question 19

To ensure consistent vulnerability scanning coverage for a large, mobile workforce whose laptops are not always connected to the corporate network, which scanning implementation is most effective?

Accepted Answer

Agent-based scanning, Internal network-based scanning, Agentless scanning, External perimeter scanning

Question 20

Communicating a new SQL injection finding to developers requires what essential components for the report to be effective and actionable? (Select Two)

Accepted Answer

The security team's annual budget, Evidence of the vulnerability, such as a proof-of-concept exploit, A list of all other vulnerabilities found in the last scan, Specific remediation guidance, including code examples, The name of the scanner software used

CompTIA Cybersecurity Analyst CySA+ Practice Exams (2025) for DevelopersData ScientistsData AnalystsData EngineersAnyoneDevelopers

Master the CompTIA Cybersecurity Analyst CySA+ Exam

Practice Exam Domains Covered - Latest 2025 certification alignment

2025 Practice Exam Details

Cutting Edge Exam Prep with AI Enhanced Learning

AI Enhanced Learning With Premium Certification Practice Exams

Real-time AI Learning:

Unparalleled Understanding:

Advanced Learning with AI:

Exam Prep Powered by our Certification Practice System

Fast-Track Your Preparation Path

Realistic Exam Experience and Comprehensive Preparation

Fully Crafted and Supported by Experts in the USA

Proven Quality and Trust for Real Success

In-depth Explanations for Complete Mastery

Chosen and Trusted by Professionals Worldwide

Ella Sanders

Marvin Watson

Jiwon Thomas

Peter Chen

Ava Thompson

Sophia Padilla

Daniel Garcia

Edward Martinez

Brandon Hill

Ali Karim

Ella Sanders

Marvin Watson

Jiwon Thomas

Peter Chen

Ava Thompson

Sophia Padilla

Daniel Garcia

Edward Martinez

Brandon Hill

Ali Karim

Ella Sanders

Marvin Watson

Jiwon Thomas

Peter Chen

Ava Thompson

Sophia Padilla

CompTIA Cybersecurity Analyst CySA+ Certification Preparation Path

Focus on Passing on the First Attempt

Practice with Realistic Exams for Real Success

Build a Deep and Solid Foundation

Invest in Your Future

Why Choose Our CompTIA Practice Exams?

Built on Trust, Quality, and Proven Success

Expertise Backed by Professionals

Customer Focused, Always

CompTIA Cybersecurity Analyst CySA+ Certification PreparationChoose Your Path to Success

Starter Practice Exam1 Exam

Pro Practice Pack3 Exam Bundle

Ultimate Practice Pack6 Exam Bundle

Prepare for Success with CompTIA Cybersecurity Analyst CySA+ Exam Practice

CompTIA Cybersecurity Analyst CySA+ Certification Preparation

The Goal of our Certification Preparation

Who Should Pursue this Certification Preparation?

ConsiderationsWhen Choosing Practice Exams

Beware of Outdated Content

Quality Matters in Exam Prep

Avoid Non-Expert Materials

Anytime, Anywhere Access

Unlimited Attempts

Cross-Device Sync

Frequently Asked Questions

How closely do your practice questions resemble the actual exam?▼

How up-to-date are your practice exams?▼

How long do I have access to the practice exams?▼

Are your practice exams available on mobile devices?▼

Do you provide explanations for the answers?▼

Take the Next Step Towards CompTIA Certification Prep

CompTIA Cybersecurity Analyst CySA+ Practice Exams (2025) for
Developers
Data Scientists
Data Analysts
Data Engineers
Anyone
Developers

CompTIA Cybersecurity Analyst CySA+ Certification Preparation
Choose Your Path to Success

Starter Practice Exam
1 Exam

Pro Practice Pack
3 Exam Bundle

Ultimate Practice Pack
6 Exam Bundle

Considerations
When Choosing Practice Exams