CySA+ Security Operations: 181 practice questions

12 of the 181 Security Operations questions in the Certsqill CySA+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CySA+? Take the free 5-min readiness check →

1. Credential stuffing: A security analyst reviews the following authentication log entries from the past hour: 1

1. Credential stuffing ✓

   Correct. Credential stuffing involves using a list of breached username/password pairs across many accounts from a single source. The pattern shows rapid sequential attempts across different usernames from the same IP, with an eventual success — consistent with automated credential stuffing tools.
2. Password spraying

   Incorrect. Password spraying uses one or a few common passwords tried against many accounts to avoid lockouts. The log does not show which passwords were attempted, but the sequential multi-account failures from a single IP with eventual success more strongly suggests credential stuffing using pre-obtained credentials.
3. Brute force attack

   Incorrect. A brute force attack targets a single account with many password attempts. Here, each attempt targets a different username, which rules out classical single-account brute force.
4. Kerberoasting

   Incorrect. Kerberoasting is an offline attack targeting Kerberos service tickets — it does not generate authentication failure logs of this type and is not associated with sequential login attempts against multiple accounts.

Sequential failed logins across different usernames from a single IP, culminating in a success, is the hallmark signature of a credential stuffing attack.

2. Create a suppression rule that excludes alerts originating: Which action BEST addresses this requirement?

1. Create a suppression rule that excludes alerts originating from the vulnerability scanner's IP during its scheduled scan window ✓

   Correct. A targeted suppression (allowlist) rule scoped to the scanner's source IP and time window eliminates known-benign alert sources without broadly reducing detection capability. This is the standard SIEM tuning approach for scheduled, known-good activity.
2. Increase the alert severity threshold so only Critical and High alerts are forwarded to analysts

   Incorrect. Raising the global severity threshold would suppress many legitimate medium-severity threats alongside the scanner noise, creating dangerous blind spots. The problem is specifically scanner-generated false positives, requiring a targeted fix.
3. Disable the SIEM rules that are generating the false positive alerts

   Incorrect. Disabling the rules entirely removes detection capability for genuine malicious activity that would trigger those same rules. Rules should be tuned, not disabled.
4. Reduce the vulnerability scan frequency to decrease alert volume

   Incorrect. Reducing scan frequency degrades vulnerability management coverage and is not a SIEM-level solution. The scan and the SIEM should be configured to work together through proper suppression, not by limiting security activity.

Scoping a suppression rule to the scanner's IP and scan window removes known-benign noise while preserving detection fidelity for real threats.

3. Masquerading: Which MITRE ATT&CK technique does this MOST likely represent?

1. Masquerading (T1036) ✓

   Correct. T1036 Masquerading occurs when adversaries rename or place malicious binaries to look like legitimate system processes. Running a file named 'svchost.exe' from a user-writable path (C:\Users\Public\) while the legitimate binary lives in System32 is a textbook masquerading indicator.
2. Process Injection (T1055)

   Incorrect. Process injection involves inserting code into the address space of a running legitimate process. The log here shows a separate binary being run from a non-standard path — the issue is the binary itself, not code injected into a legitimate process.
3. DLL Search Order Hijacking (T1574.001)

   Incorrect. DLL search order hijacking involves placing a malicious DLL where an application will find it before the legitimate DLL. The scenario describes an executable file in a suspicious path, not a DLL loading issue.
4. Command and Scripting Interpreter (T1059)

   Incorrect. T1059 covers use of interpreters like cmd.exe, PowerShell, or bash to execute commands. The scenario's indicator is the binary path anomaly and impersonation of svchost.exe, which maps to masquerading, not interpreter abuse.

A process named after a legitimate Windows binary but running from a non-standard user-writable path is the defining indicator of MITRE ATT&CK T1036 Masquerading.

4. Deploy a jump server in a dedicated management VLAN: Which architecture change BEST meets all three requiremen

1. Deploy a jump server (bastion host) in a dedicated management VLAN with enforced MFA, and implement ACLs that prohibit direct workstation-to-database traffic ✓

   Correct. A jump server in a dedicated management VLAN addresses all three requirements: (1) ACLs block direct workstation-to-production traffic, (2) the bastion host enforces authentication and provides a central logging point for all production access, (3) this is achievable with existing switches/firewall infrastructure through VLAN and ACL configuration.
2. Implement full network micro-segmentation using software-defined networking (SDN) with identity-based policies

   Incorrect. While SDN micro-segmentation is the gold standard for zero trust, it typically requires significant infrastructure investment (SDN controllers, compatible switching hardware, agent deployment). The constraint is that the solution must work within existing on-premises infrastructure without a full rebuild — this option likely violates that requirement.
3. Install host-based firewalls on all production database servers to block inbound connections from workstation IP ranges

   Incorrect. Host-based firewalls alone do not satisfy requirement (2) — they can block traffic but do not enforce authentication to production access. They also require database servers to be correctly configured and maintained, and do not provide centralized logging of access attempts.
4. Deploy a next-generation firewall (NGFW) between the workstation segment and all other network segments

   Incorrect. An NGFW between segments addresses requirement (1) and partially (2), but does not by itself enforce authentication to production databases. It also may not satisfy requirement (3) depending on existing firewall infrastructure, and does not provide application-layer authentication.

A bastion host with MFA in a dedicated management VLAN, combined with ACLs blocking direct access, satisfies all three constraints within existing infrastructure.

5. The host is likely infected with malware using DNS-based: A network analyst reviews DNS query logs and notices

1. The DNS log pattern indicates a misconfigured NTP client that is querying DNS instead of NTP servers

   Incorrect. NTP clients query NTP servers via UDP port 123, not DNS. A misconfigured NTP client would not generate DNS queries at regular intervals. The pattern described is not consistent with any NTP behavior.
2. The host is likely infected with malware using DNS-based C2 beaconing with jitter to evade timing-based detection ✓

   Correct. The evidence strongly supports DNS-based C2 beaconing: (1) precise periodic DNS queries (beaconing interval), (2) ±5-second jitter (deliberate randomization to evade exact-interval detection), (3) newly registered domain (common for C2 infrastructure — registered close to deployment), (4) no historical DNS reputation, (5) no matching HTTP/S traffic (DNS-only C2 or DNS tunneling).
3. The host is performing legitimate software update checks to a CDN that rotates DNS records

   Incorrect. Legitimate update services use well-known, established domains with years of DNS history, not domains registered 48 hours ago. The 3600±5 second interval with deliberate jitter is not characteristic of legitimate update scheduling, which typically follows OS schedules without sub-second randomization.
4. The regular DNS queries suggest a broken HTTP keep-alive mechanism that falls back to DNS resolution

   Incorrect. HTTP keep-alive is a connection-persistence mechanism at the application layer; it does not generate periodic DNS queries. DNS resolution happens once per connection (or per TTL), not at regular 3600-second intervals with jitter.

Precise periodic DNS queries with deliberate jitter to a newly-registered domain with no web traffic are the hallmark indicators of DNS-based C2 beaconing.

6. Adversary = APT group: During an incident investigation, an analyst documents the following information: • A n

1. Adversary = APT group; Capability = malicious Excel attachments via spear-phishing; Victim = OT network operators; Infrastructure = email delivery system (implied) ✓

   Correct. The Diamond Model has four vertices: Adversary (the threat actor — the APT group), Capability (the tools/techniques — malicious Excel attachments), Victim (the target — OT network operators at energy utilities), and Infrastructure (technical resources used — the email delivery infrastructure). This mapping correctly applies all four vertices.
2. Adversary = nation-state; Capability = energy sector targeting; Victim = Excel attachments; Infrastructure = spear-phishing emails

   Incorrect. This mapping misassigns elements: 'energy sector targeting' is the adversary's goal/motivation (a meta-feature), not a capability. Excel attachments are the capability, not the victim. Victims are the targeted organizations, not the delivery method.
3. Adversary = APT group; Capability = spear-phishing; Victim = energy sector; Infrastructure = Excel attachment

   Incorrect. The Excel attachment is the malicious payload (capability component), not infrastructure. Infrastructure refers to the technical systems used to deliver the capability (email servers, C2 domains, IP addresses). Spear-phishing describes the technique/delivery vector, which is part of the capability, not separate.
4. The Diamond Model is not applicable here because the attacker's identity is unknown

   Incorrect. The Diamond Model is specifically designed for intrusion analysis even with incomplete information. Unknown adversary identity is noted as uncertain but doesn't invalidate the model — analysts work with available information and document confidence levels.

The Diamond Model maps Adversary (APT group), Capability (malicious Excel via spear-phishing), Victim (OT operators), and Infrastructure (email delivery system).

7. Phishing document executing a macro that launches: An EDR platform generates the following alert on a Windows

1. Phishing document executing a macro that launches PowerShell for fileless malware download, followed by a dropper writing a persistence binary ✓

   Correct. The process tree (Word → cmd → PowerShell) is the classic macro-enabled document execution chain. The PowerShell IEX (Invoke-Expression) with DownloadString is a fileless download-and-execute technique. The file write to AppData\Roaming of a svchost-named binary is a dropper establishing persistence — this binary will likely be configured for auto-run.
2. A user manually running a PowerShell script that downloads a legitimate software update

   Incorrect. A user running PowerShell manually would not produce a Word process as the parent. The Word → cmd → PowerShell process tree is specifically characteristic of macro execution, not manual PowerShell use. Legitimate updates do not use IEX with DownloadString from an unrecognized IP.
3. A legitimate Word template update process that spawns PowerShell to retrieve configuration data

   Incorrect. Microsoft Word does not legitimately spawn cmd.exe and then PowerShell to download from external IPs. This process chain has no legitimate business use case in normal Office operation.
4. An EDR false positive caused by Microsoft Office's legitimate cloud connectivity features

   Incorrect. Office 365/Microsoft 365 cloud features use authenticated HTTPS to Microsoft-owned infrastructure (*.office.com, *.microsoft.com), not raw PowerShell IEX calls downloading from arbitrary IPs. This is definitively malicious activity, not a false positive.

Word spawning cmd → PowerShell running IEX DownloadString is the macro-to-fileless-loader attack chain; the file write to AppData represents dropper-based persistence.

8. Anomaly-based IDS: Which detection system is MORE likely to detect this attack, and why?

1. Anomaly-based IDS, because it detects deviations from established baselines without requiring prior knowledge of the specific exploit ✓

   Correct. Anomaly-based detection establishes a baseline of normal behavior (traffic volumes, protocols, connection patterns) and alerts on deviations. A zero-day exploit causes abnormal behavior (unusual process activity, unexpected outbound connections, abnormal request patterns) that deviates from baseline — detectable without a signature.
2. Signature-based IDS, because signatures can detect attack patterns before the exploit is publicly released

   Incorrect. Signature-based detection requires a pre-existing signature for the specific attack pattern. By definition, a zero-day exploit has no published signature — no antivirus or IDS vendor has created a rule for it yet. Signature-based systems cannot detect what they have not seen.
3. Both systems equally, because all network attacks produce the same traffic patterns

   Incorrect. Different attack types produce different traffic patterns. More importantly, signature-based systems fundamentally cannot detect attacks without matching signatures, while anomaly-based systems can detect novel attacks based on behavioral deviation.
4. Neither system, because zero-day exploits are inherently undetectable until a patch is released

   Incorrect. While zero-days cannot be detected by signature-based systems, anomaly-based detection can identify the behavioral consequences of exploitation (abnormal process spawning, unusual network connections, payload delivery anomalies) even without knowing the specific exploit.

Anomaly-based IDS detects zero-days by identifying behavioral deviations from normal baselines, while signature-based systems are blind to unknown exploits.

9. Create a dedicated service account with only the specific: Which recommendation BEST follows the principle of

1. Create a dedicated service account with only the specific permissions required for credentialed scanning (local administrator on target systems or a purpose-built 'scan' group with read-only access) ✓

   Correct. Least privilege requires granting only the minimum permissions necessary for the function. A vulnerability scanner performing credentialed checks needs local read access on target systems, not domain-wide administrative rights. A dedicated, scoped service account limits blast radius if the scanner or its credentials are compromised.
2. Rotate the Domain Admin password for the service account every 90 days to reduce the risk window

   Incorrect. Rotating a Domain Admin password reduces the useful life of a stolen credential but does not address the fundamental over-privilege. If the credential is stolen during the 90-day window, the attacker still has Domain Admin access. The correct fix is removing the excessive privilege entirely.
3. Move the service account to a restricted OU to limit its logon rights via Group Policy

   Incorrect. Logon restrictions via GPO limit where the account can interactively log on, but the account retains its Domain Admin group membership and privileges. The privileges themselves must be reduced, not just the logon scope.
4. Enable MFA on the service account to prevent unauthorized use of the Domain Admin credentials

   Incorrect. MFA on service accounts is technically complex (service accounts are non-interactive) and does not reduce the excessive privilege. The account still has Domain Admin rights. MFA mitigates credential theft risk but does not implement least privilege.

Least privilege for a scan service account means scoped read-only access on target systems, not Domain Admin — limiting blast radius if credentials are compromised.

10. Privilege escalation: Account: svc_backup 14:22:09 — Event ID 4624: Successful logon, Account: svc_backup, Log

1. Privilege escalation — a service account that logged in via network authentication used net.exe to add itself to the local Administrators group, then performed an interactive logon with elevated privileges ✓

   Correct. The sequence shows: (1) network logon of svc_backup (service accounts typically don't perform interactive network logons), (2) execution of net.exe to add svc_backup to local Administrators (privilege escalation), (3) successful group membership addition confirmed (Event 4732), (4) interactive logon (Logon Type 2) after elevation — consistent with an attacker who compromised svc_backup and is now using it interactively with admin rights.
2. A legitimate administrative task — an IT administrator added svc_backup to Administrators for a scheduled maintenance activity

   Incorrect. Several indicators suggest malicious activity: (1) service accounts (svc_backup) should not add themselves to Administrators groups, (2) interactive logon (Type 2) of a service account is highly anomalous, (3) the 8-second sequence from network logon to group addition to interactive logon suggests automation. Legitimate admin tasks are performed by named administrator accounts, not service accounts.
3. A ransomware payload preparing for lateral movement by creating a new domain administrator account

   Incorrect. No new account was created — the existing svc_backup account was added to the Administrators group. Creating a new account would produce Event ID 4720. This is privilege escalation of an existing compromised account, not new account creation.
4. Normal service account activity — backup service accounts require temporary administrative access during backup operations

   Incorrect. Even if a backup service requires local admin rights (many don't), the account should be permanently configured with required rights, not dynamically adding itself to the Administrators group at runtime via net.exe. Runtime privilege addition via net.exe is never legitimate service behavior.

A service account network-logging in, running net.exe to add itself to Administrators, then performing an interactive logon is a classic compromised-credential privilege escalation sequence.

11. STIX for structured threat data representation combined: Which framework and format combination is MOST approp

1. STIX for structured threat data representation combined with TAXII for automated machine-to-machine threat intelligence sharing ✓

   Correct. STIX (Structured Threat Information eXpression) is the standard format for expressing threat intelligence objects (indicators, TTPs, campaigns, threat actors). TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol for sharing STIX data between organizations and platforms. Together they enable automated IOC ingestion into SIEMs and TIPs.
2. MITRE ATT&CK for indicator representation and STIX for transport

   Incorrect. MITRE ATT&CK is a knowledge base of adversary TTPs, not a data format for sharing IOCs. STIX is the data representation format; TAXII is the transport. ATT&CK techniques are commonly referenced within STIX objects but ATT&CK itself is not a sharing protocol or IOC format.
3. OpenIOC for indicator format and HTTP REST API for distribution

   Incorrect. OpenIOC is a valid indicator format (developed by Mandiant) but is not the industry-standard approach for automated intelligence sharing. STIX/TAXII is the dominant standard for interoperable automated threat intelligence exchange across platforms and organizations.
4. CSV files for indicator lists and SFTP for secure transfer between organizations

   Incorrect. CSV/SFTP is a manual, non-standardized approach that does not support automated ingestion or rich context around indicators (TTPs, confidence levels, source attribution). STIX/TAXII is purpose-built for automated, structured threat intelligence sharing.

STIX provides the structured data format for threat intelligence objects; TAXII provides the automated transport protocol for machine-to-machine sharing.

12. Reverse shell established via Python: A Linux system's audit log (/var/log/audit/audit.log) contains the follo

1. Reverse shell established via Python, redirecting stdin/stdout/stderr to a remote socket connection ✓

   Correct. The Python one-liner creates a socket connection to 203.0.113.99:4444, then uses os.dup2() to redirect file descriptors 0 (stdin), 1 (stdout), and 2 (stderr) to the socket, then spawns /bin/sh -i. This is the canonical Python reverse shell — the attacker receives an interactive shell on their listener at port 4444.
2. Bind shell — the process opens a listening port on the local system for the attacker to connect to

   Incorrect. A bind shell listens on a local port (e.g., socket.bind()). This code uses socket.connect() to initiate an outbound connection to the attacker's IP, making it a reverse shell. The attacker has a listener; the victim initiates the connection outbound.
3. Data exfiltration — Python is used to transmit system files over a socket connection

   Incorrect. The code spawns /bin/sh -i (an interactive shell) rather than reading and transmitting files. This is command execution capability (reverse shell), not file exfiltration. Exfiltration would involve reading file contents and sending them over the socket.
4. Port scanning — Python is used to probe the remote host on port 4444 for open services

   Incorrect. Port scanning probes multiple ports or hosts to discover services. This code makes a single connection to a specific host:port and then provides interactive shell access — definitively a reverse shell, not a scan.

The Python code connects outbound to the attacker's IP, duplicates file descriptors to redirect the shell's I/O to the socket, and spawns /bin/sh — this is a classic Python reverse shell.

Other CySA+ domains

• Vulnerability Management — 132 questions →
• Incident Response Management — 114 questions →
• Reporting and Communication — 72 questions →
• All 499 CySA+ questions →