Free CompTIA CySA+ Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CompTIA CySA+ practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Two log sources record the same event in different time zones and field formats. Which logging function converts their fields into consistent representations?

   1. A. Log rotation
   2. B. Log normalization
   3. C. Log compression
   4. D. Log archival

   Answer: B

   Explanation: "In log normalization, each log data field is converted to a particular data representation and categorized consistently." Normalization aligns field representations; rotation changes files, compression reduces storage, and archival retains data.

   Reference: Guide to Computer Security Log Management — Section 3.2, log normalization

2. 2A team must assess which services an unauthenticated internet attacker can reach through the existing perimeter. Where should it perform the scan?

   1. A. From an administrator session on each internal server
   2. B. From the internal management network behind the firewall
   3. C. From outside the organization's security perimeter
   4. D. From a privileged agent installed on each endpoint

   Answer: C

   Explanation: "External security testing is conducted from outside the organization’s security perimeter." The outside viewpoint preserves the perimeter restrictions faced by the specified attacker; privileged local and internal views answer different exposure questions.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 2.4.1, External and Internal

3. 3In the Cyber Kill Chain, which phase combines an exploit with a malicious payload into a deliverable weapon?

   1. A. Delivery
   2. B. Installation
   3. C. Reconnaissance
   4. D. Weaponization

   Answer: D

   Explanation: "Coupling a remote access trojan with an exploit" Weaponization prepares the payload before delivery. Delivery transmits it; reconnaissance gathers targets and installation establishes presence.

   Reference: Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains — Section 3.2, phase 2

4. 4What should a vulnerability assessment report pair with each identified weakness to support corrective action?

   1. A. A recommendation for mitigating the weakness
   2. B. A declaration that every affected asset must be replaced
   3. C. A statement that the scanner score settles risk acceptance
   4. D. A guarantee that exploitation has already occurred

   Answer: A

   Explanation: "Upon completion of analysis, a report should be generated that identifies system, network, and organizational vulnerabilities and their recommended mitigation actions." Findings need actionable mitigation recommendations. Replacement is not always required, a scanner cannot approve acceptance, and a finding does not establish exploitation.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 8.2, Reporting

5. 5What is the purpose of synchronizing clocks on systems that generate security logs?

   1. A. To make event timestamps consistent across sources
   2. B. To convert every log into the same file format
   3. C. To remove duplicate records from each source
   4. D. To assign a common retention period to all logs

   Answer: A

   Explanation: "Organizations should use time synchronization technologies such as Network Time Protocol (NTP) servers whenever possible to keep log sources’ clocks consistent with each other." Clock synchronization supports temporal comparison, rather than format conversion, deduplication, or retention policy.

   Reference: Guide to Computer Security Log Management — Section 3.2, footnote 24

6. 6A fragile network must be inventoried without transmitting probing packets. Which discovery approach meets this constraint?

   1. A. Actively fingerprint operating systems with unusual packets
   2. B. Observe existing traffic with passive network discovery
   3. C. Probe each address with ICMP and TCP connection attempts
   4. D. Run exploit checks against each listening service

   Answer: B

   Explanation: "This is done without sending out a single probing packet." Passive discovery observes communications. Active fingerprinting, connection probes, and exploit checks transmit packets and violate the stated constraint.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 4.1, passive network discovery

7. 7What distinguishes the Delivery phase of the Cyber Kill Chain?

   1. A. Researching and selecting prospective targets
   2. B. Transmitting the weapon to the target environment
   3. C. Combining an exploit with a malicious payload
   4. D. Executing the intruder's code after arrival

   Answer: B

   Explanation: "Transmission of the weapon to the targeted environment." Delivery is transport to the victim environment, distinct from reconnaissance, preparation, and code execution.

   Reference: Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains — Section 3.2, phase 3

8. 8Executives need risk and progress information, while administrators need technical remediation details from the same assessment. Which reporting approach addresses both audiences?

   1. A. Send both groups the same raw scan export without audience-specific interpretation
   2. B. Give executives only scan counts and administrators no finding-level remediation details
   3. C. Tailor detail and emphasis to each audience while preserving consistent findings
   4. D. Give both groups only an aggregate summary without technical remediation specifics

   Answer: C

   Explanation: "Because a report may have multiple audiences, multiple report formats may be required to ensure that all are appropriately addressed." Multiple formats can address differing responsibilities without contradicting verified findings. The stated executive and administrator needs are not met by uninterpreted raw output, counts alone, or a uniform summary lacking remediation detail.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 8.2, Reporting

9. 9Which method detects whether an archived security log has changed since its original integrity value was recorded?

   1. A. Compare its filename with the retention schedule
   2. B. Compare its entry count with a different host's log
   3. C. Compare its current digest with its protected original digest
   4. D. Compare its compression ratio with a previous archive

   Answer: C

   Explanation: "Log File Integrity Checking: Comparing the current message digest for a log file to the original message digest to determine if the log file has been modified." The digest comparison detects content changes; names, unrelated counts, and compression ratios do not establish integrity.

   Reference: Guide to Computer Security Log Management — Appendix A, Log File Integrity Checking

10. 10A vulnerability assessment must inspect installed patches and host configuration details unavailable through exposed network services. Which scanning method provides the necessary local access?

    1. A. An external unauthenticated port scan
    2. B. A passive capture of ordinary user traffic
    3. C. An unauthenticated scan using service-banner version matching
    4. D. An authenticated scan with appropriate host privileges

    Answer: D

    Explanation: "Some network-based scanners have administrator-level credentials on individual hosts and can extract vulnerability information from hosts using those credentials." Appropriate credentials provide local host details. Port reachability, observed user traffic, and externally reported service versions do not grant access to installed patch records and local configuration objects.

    Reference: Technical Guide to Information Security Testing and Assessment — Section 4.3, Vulnerability Scanning