CySA+ Practice Test (V4)

Question 1

An endpoint detection and response alert triggered on a host assigned to a network administrator. An analyst begins to review the network session logs for the host:

 2025-05-01 11:46 duration: 30s process: chrome.exe  src_port: 48026 dst_port: 443
 2025-05-01 11:48 duration: 58s process: outlook.exe src_port: 49654 dst_port: 25
 2025-05-01 11:48 duration: 2478s process: putty.exe src_port: 48652 dst_port: 22
 2025-05-01 11:50 duration: 46s process: update.exe  src_port: 36845 dst_port: 53

Which of the following processes requires further investigation?

Question 2

A security operations center analyst reviews security information and event management logs and sees the following:

Which of the following attacks has most likely occurred?

Question 3

A Security Information Event Manager (SIEM) alerts a security administrator to the following log:

Based on the log, which of the following most likely generated this alert?

Question 4

An analyst scans the network during the middle of the week while most employees are on-site. The employees report performance issues to their leadership team. Which of the following should the analyst take into consideration for future scans?

Question 5

After a risk assessment, a server was found hosting a vulnerable legacy system that has the following characteristics:

• There is no patch or official fix available from the vendor.
• There is no official support provided by the vendor.
• Customers consider the system mission critical. 
  

Which of the following actions will best decrease the risk posed by the legacy system?

Question 6

A new policy prohibits external access to database servers. A recent external port scan identified the following open Transmission Control Protocol (TCP) ports:

• 21
• 25
• 68
• 80
• 389
• 443
• 587
• 1514
• 3306
• 3389
• 8080

Which of the ports must be closed to be compliant with the new policy?  (Select two).

Question 7

A security operations analyst observes an attacker scanning network ports and systems. Which of the following describes this phase of the Cyber Kill Chain?

Question 8

An analyst receives an alert that a binary infected with ransomware was detected on a remote employee's system. The analyst confirms the file matches the detection signature. Which of the following is the next step?  

Question 9

Which of the following best describes the incident response phase in which a team brings systems and services back into operation?

Question 10

During an incident response, an analyst discovers artifacts important to the investigation. These artifacts may need to be processed by law enforcement at a later time. Which of the following is the most important when handling the artifacts?

Question 1: C (update.exe)

Question 10: B (The artifacts must be preserved in their original state and maintained with a chain of custody.)