Home / Flashcard library / Careers & certifications / CompTIA CySA+ / Practice Questions

Careers & certifications

CompTIA CySA+ — Practice Questions flashcards

6 of 60 questions free to study here · 4 topics · the whole deck is built into Willys

CS0-003 multiple-choice practice questions, one best answer each, on log and indicator analysis, threat hunting, scanning and CVSS prioritisation, incident response, forensics and reporting.

Get the app All CompTIA CySA+ decks

Practice deck · part of CompTIA CySA+ · written against: Exam CS0-003 objectives. Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list
  1. While building a timeline in the SIEM, an analyst sees a firewall entry for a workstation's outbound connection stamped four minutes before the proxy entry showing the user clicking the link that caused it. What is the best interpretation?

    A) The firewall records only denied connections, not allowed ones
    B) The attacker opened the connection before the user clicked
    C) The proxy is caching the request and logging it a day late
    D) The log sources are not synchronised to a common time source
    D) The log sources are not synchronised to a common time source

    Effects that appear before their causes point to clock drift between log sources, which scrambles correlation. Point every source at a common NTP server and store timestamps in UTC rather than inventing an attacker action to explain the gap.
    Security Operations › Architecture and Logging
  2. EDR shows an unfamiliar binary in a user's AppData\Roaming folder launching every time that user logs on to a Windows workstation. Where should the analyst look first for the autostart entry?

    A) The Run and RunOnce registry keys under HKCU and HKLM
    B) The DNS client cache held by the workstation
    C) The browser's saved passwords and its cookie store files
    D) The hosts file in the System32 drivers folder
    A) The Run and RunOnce registry keys under HKCU and HKLM

    The Run and RunOnce keys are the classic autostart locations, and an entry pointing into a user-writable folder such as AppData is a strong persistence lead. The hosts file and DNS cache affect name resolution, not what launches at logon.
    Security Operations › Architecture and Logging
  3. A non-credentialed scan of a Linux server reports no missing patches. A credentialed scan the same day lists dozens. What is the best interpretation?

    A) The credentialed scan produced banner false positives
    B) Patches were rolled back between the two scans
    C) The non-credentialed result proves the host is patched
    D) The credentialed scan read installed package versions
    D) The credentialed scan read installed package versions

    A credentialed scan logs in and reads installed packages and settings, revealing local vulnerabilities that a network-only view cannot see. The non-credentialed result is still useful as an attacker's outside view.
    Vulnerability Management › Scanning Methods
  4. Controllers on a plant's OT network crashed during an active scan last year. The plant still needs a current inventory of devices and software versions. Which approach fits best?

    A) A faster active scan with more parallel connections
    B) An external scan of the plant from the public internet
    C) Passive scanning from a sensor on a span port or tap
    D) An aggressive credentialed scan during business hours
    C) Passive scanning from a sensor on a span port or tap

    Passive scanning identifies devices, protocols and versions from traffic they already send, without probing fragile ICS equipment. It is slower and can miss quiet hosts, but it avoids repeating the crash.
    Vulnerability Management › Scanning Methods
  5. Intelligence shows an attacker has packaged an exploit and a backdoor into a malicious PDF but has not yet sent it to anyone. Which Cyber Kill Chain phase has the attacker reached?

    A) Weaponization
    B) Exploitation
    C) Delivery
    D) Reconnaissance
    A) Weaponization

    Building the deliverable payload is weaponization. Emailing the PDF would be delivery, and the reader flaw firing on a victim's machine would be exploitation.
    Incident Response and Management › Attack Frameworks
  6. The same critical finding keeps reappearing on servers that were patched last quarter. What is the best interpretation?

    A) Normal behaviour that simply needs repatching each quarter
    B) Scanner false positives that are safe to suppress for good
    C) A new zero-day that the original vendor patch never covered
    D) A process failure, such as rebuilding from an outdated image
    D) A process failure, such as rebuilding from an outdated image

    Recurring findings usually mean an outdated build image, configuration drift or a rolled-back patch. Fix the image and configuration management, not just the individual hosts.
    Reporting and Communication › Vulnerability Reporting

Unlock the whole deck

You are studying a free 6-question sample. All 60 questions of CompTIA CySA+ — Practice Questions, the other 2 CompTIA CySA+ decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More CompTIA CySA+ decks

Security Operations and Vulnerability ManagementIncident Response and Reporting

← All CompTIA CySA+ decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

  • Checked against the CompTIA CySA+ CS0-003 (V3) exam objectives, document version 6.0 (topic list only; no text copied).
  • Checked against the FIRST CVSS v3.1 specification, MITRE ATT&CK Enterprise v19 tactics and techniques, RFC 9989 (DMARC, which obsoletes RFC 7489), RFC 7208 (SPF), RFC 5321 (Received trace headers) and RFC 3227 (order of volatility), NIST SP 800-61 Rev. 2 (withdrawn and superseded by Rev. 3; used for severity factors and incident communications), SP 800-61 Rev. 3, SP 800-86 and the SP 800-53 Rev. 5 glossary (public domain), and the CISA Known Exploited Vulnerabilities catalogue.
  • Also checked against the OWASP Top 10:2021 and OWASP Cheat Sheet Series (CC BY-SA 4.0), the Lockheed Martin Cyber Kill Chain and Diamond Model of Intrusion Analysis papers, and Microsoft, AWS, Red Hat, VirusTotal, Prowler and Pacu documentation (reference only).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and CySA+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.