Free CompTIA CySA+ Practice Questions

Q1.A multinational corporation is evaluating its AI-powered security tools for compliance with emerging AI governance requirements. The EU AI Act classifies certain AI systems as high-risk and imposes strict transparency and accountability obligations. Which TWO of the following AI security use cases would MOST likely be classified as high-risk under the EU AI Act framework?

• A.AI-based automated log aggregation from SIEM platforms
• B.AI-driven employee behavior monitoring and insider threat scoring
• C.AI-generated summaries of publicly available threat intelligence reports
• D.AI-driven access control decisions for critical infrastructure
• E.ML-based network traffic baseline analysis

Domain: Security Operations

Q2.A vulnerability analyst runs a credentialed scan against a Windows server and the scan report shows that a specific CVE has been detected by both a plugin-based check and a version-based check, but the results conflict. The plugin-based check reports the vulnerability as not present, while the version-based check reports it as present. Which interpretation is most likely correct and why?

• A.The version-based check is correct because version numbers are definitive indicators of vulnerability presence
• B.The conflict indicates a scanner malfunction that invalidates all scan results for this server
• C.Both checks are unreliable when they conflict, so the finding should be removed from the report
• D.The plugin-based check is likely correct because it actively verified the vulnerability condition, while the version-based check may be a false positive due to backported patches

Domain: Vulnerability Management

Q3.A security analyst is reviewing Volatility output from the netscan plugin on a compromised Windows server. The output shows that the process svchost.exe (PID 4820) has an established TCP connection to an external IP address on port 443. The analyst then runs the pslist plugin and confirms svchost.exe PID 4820 exists, but the psscan plugin shows an additional svchost.exe process (PID 6144) that does not appear in the pslist output. What does this discrepancy MOST likely indicate?

• A.A normal process that terminated but has not been fully cleaned from memory
• B.A hidden process using DKOM to unlink itself from the process list
• C.A child process of PID 4820 that inherited the svchost.exe name
• D.A Volatility analysis error producing duplicate process entries

Domain: Incident Response

Q4.A CISO is evaluating the security program against the Capability Maturity Model (CMM). The organization has documented security policies and procedures, security tools are deployed and operational, but processes vary significantly between teams and incident response depends heavily on individual analyst expertise. At which CMM level is this security program MOST likely operating?

• A.CMM Level 1 – Initial
• B.CMM Level 2 – Repeatable
• C.CMM Level 3 – Defined
• D.CMM Level 4 – Quantitatively Managed

Domain: Reporting and Communication

Q5.A threat intelligence analyst is building an adversary profile and needs to map a specific attack to ATT&CK. The adversary gained initial access through a supply chain compromise, executed code through a scripting interpreter, escalated privileges by exploiting a vulnerable kernel driver, and exfiltrated data over an alternative protocol. Which TWO mappings correctly pair the activity with its ATT&CK tactic?

• A.Supply chain compromise maps to the Collection tactic
• B.Exfiltration over alternative protocol maps to the Exfiltration tactic
• C.Supply chain compromise maps to the Initial Access tactic
• D.Scripting interpreter maps to the Persistence tactic
• E.Kernel driver exploitation maps to the Lateral Movement tactic

Domain: Security Operations

Q6.An organization mandates that all software vendors provide an SBOM before procurement approval. During review of an SBOM for a new security tool, the analyst discovers that the product includes a logging library with a known critical vulnerability that was exploited in a major supply chain attack last year. The vendor states the vulnerable function is not called in their implementation. How should the analyst proceed?

• A.Accept the vendor's statement and approve the procurement without conditions
• B.Reject the product and seek an alternative regardless of business need
• C.Request vendor evidence of non-reachability and require a remediation timeline for the vulnerable component
• D.Approve the product with a note to revisit in one year

Domain: Vulnerability Management

Q7.During an incident investigation, a forensic analyst discovers that an attacker used a compromised service account to access a file server, then used PsExec to move laterally to three additional servers before exfiltrating data to a cloud storage provider. When mapping to the Cyber Kill Chain, which phase does the use of PsExec for lateral movement represent?

• A.Reconnaissance
• B.Delivery
• C.Actions on Objectives
• D.Weaponization

Domain: Incident Response

Q8.After a phishing incident that resulted in credential theft, the incident response team determines that the root cause was the lack of phishing-resistant MFA on the organization's email system. The team drafts an RCA report with recommendations. Which recommendation in the RCA report would most directly prevent the same type of incident from recurring?

• A.Conduct additional phishing awareness training for all employees
• B.Block all external links in incoming emails
• C.Increase the password rotation frequency from 90 to 30 days
• D.Implement FIDO2 security keys for email authentication

Domain: Reporting and Communication

Q9.A security engineer notices that a low-interaction honeypot deployed in the DMZ is generating alerts about SSH brute force attempts from multiple IP addresses. The same honeypot has never detected any advanced post-exploitation activity. A colleague suggests upgrading to a high-interaction honeypot to capture more detailed adversary techniques. Which TWO factors should the engineer consider before making this decision?

• A.High-interaction honeypots require significantly more maintenance resources including OS patching and continuous monitoring
• B.High-interaction honeypots require no monitoring since they are isolated from the production network
• C.Low-interaction honeypots provide more detailed forensic data about attacker post-exploitation techniques
• D.A compromised high-interaction honeypot could potentially be used as a pivot point to attack production systems if not properly isolated
• E.Upgrading will eliminate all SSH brute force alerts since high-interaction honeypots do not detect scanning

Domain: Security Operations

Q10.A payment processor must comply with PCI DSS requirements for quarterly external vulnerability scanning. The ASV scan report identifies several findings, including an OpenSSL vulnerability on a web server. The security team patches OpenSSL and requests a rescan. The rescan shows the vulnerability is remediated but identifies two new low-severity findings. What is the correct determination regarding PCI DSS ASV scan compliance?

• A.The scan passes because low-severity findings do not cause ASV scan failure
• B.The scan fails and all findings must be remediated before achieving compliance
• C.A third scan is required that excludes the newly discovered findings
• D.The scan fails because new vulnerabilities appeared between scan cycles

Domain: Vulnerability Management