20 free CompTIA CySA+ practice questions

Correct answer: C · Impossible travel, an identity-based indicator of shared credentials

Two sign-ins from places too far apart to travel between in the time that separates them match impossible travel, which CompTIA lists among identity-based indicators. Microsoft's description of this detection says it suggests that a different user is using the same credentials, and the stem rules out a VPN or proxy that could explain the second location. Beaconing is a host calling out to a server on a regular schedule, which a pair of sign-ins does not show. Typosquatting relies on look-alike domain names to trick users. Resource consumption is a host symptom such as unusual CPU or memory use, not a sign-in pattern.

Look for this next time: Sign-ins from distant places in less time than travel would take point to impossible travel, a sign that someone else holds the credentials.

Correct answer: A · A built-in Windows utility used to download a file, a living-off-the-land technique

certutil.exe is a legitimate Windows tool, and MITRE ATT&CK lists it among the utilities adversaries use to download tools under Ingress Tool Transfer. A Word process that spawns a command shell, which then fetches an executable from an unknown site, is the pattern CompTIA's objectives call Living Off the Land Binaries (LOLBins): trusted system binaries doing an attacker's work. Certificate renewal does not run from Word through cmd.exe or save an executable to the temp folder. The missing signature match does not make the activity benign, because built-in tools are signed and expected on the host, so signature checks alone often miss it. A scanner agent would not be launched by a Word process.

Look for this next time: When a trusted system binary downloads files on behalf of an Office process, treat it as possible living-off-the-land activity, even with no signature hit.

Correct answer: D · CyberChef, to decode the Base64 text so it can be read

Microsoft's PowerShell documentation says -EncodedCommand accepts a base-64-encoded string version of a command, formatted as UTF-16LE text, so the string is encoded, not encrypted. CyberChef, which GCHQ publishes as a browser-based tool for encoding, decoding, and data analysis, can reverse both steps so the analyst reads the script without executing it. Wireshark analyzes captured network traffic, and there is no capture here. YARA matches patterns in files or memory and would not turn the string back into a script. WHOIS returns domain registration data, and the encoded string is not a domain.

Look for this next time: -EncodedCommand text is Base64, so decode it with a tool such as CyberChef instead of running it.

Correct answer: B · The group's behaviors, such as how it dumps and reuses credentials

David Bianco's Pyramid of Pain ranks indicators by how much pain detecting them causes an adversary. Hash values, IP addresses, and domain names sit near the bottom because attackers can change them quickly, which is what the team keeps seeing. Tactics, techniques, and procedures (TTPs) sit at the top: detecting a behavior such as credential dumping and reuse forces the group to learn new behaviors, not just swap tools or infrastructure. Faster hash sharing, hourly IP feeds, and domain sinkholing are still useful, but they stay at the levels the group already changes easily.

Look for this next time: In the Pyramid of Pain, TTPs are the hardest indicators for an attacker to change, while hashes, IPs, and domains are the easiest.

Correct answer: B · Repudiation, because users can deny actions that left no proof

Microsoft's STRIDE guidance describes repudiation as users denying an action when other parties have no way to prove otherwise, often in a system that cannot trace the action. That matches approvals stored with no record of who approved them, and the fix is non-repudiation, such as signed or audited approval records. Tampering is unauthorized modification of data, which the stem does not describe. Spoofing is impersonating another user, and information disclosure is exposure of data to people who should not see it. Neither is the problem of an action that cannot be tied to the person who took it.

Look for this next time: If someone can deny an action and the system cannot prove they took it, the STRIDE threat is repudiation.

Correct answer: D · A SOAR playbook that runs the enrichment steps and opens the ticket

CompTIA's objectives place automation and orchestration, including security orchestration, automation, and response (SOAR), under streamlining operations. A repeatable sequence of reputation lookups, sandbox submission, and ticket creation is what a SOAR playbook automates, which leaves analysts to judge the enriched results. More correlation rules add alerts but do none of the enrichment work. Longer retention helps later searches but does not speed up each review. A honeypot mailbox is a deception control that gathers intelligence, and it does not process the emails employees have already reported.

Look for this next time: Repeated, ordered enrichment steps are the classic case for a SOAR playbook.

Correct answer: A · Hallucination, confident output that the source data does not support

NIST's Generative AI Profile (NIST AI 600-1) calls this confabulation, confidently stated but false content, and notes that it is known colloquially as hallucination. A host name that exists nowhere in the log is invented output, so the analyst must check AI summaries against the source data. Model poisoning means the model's training data was manipulated, which nothing in the stem suggests. A malicious prompt is input designed to subvert the assistant, and the analyst wrote an ordinary request. Data exposure concerns sensitive data leaving approved control, but the assistant is approved and the problem is a false detail, not a leak.

Look for this next time: Treat AI output as a lead to verify: a detail that is missing from the source data is a hallucination.

Correct answer: C · A credentialed scan, logging in with the approved scan account

NIST SP 800-115 explains that some network-based scanners use administrator-level credentials to extract vulnerability information from hosts, while scanners without credentials rely mostly on discovering hosts, open ports, and related vulnerabilities. Missing patches and local settings sit inside the operating system, so a credentialed scan with the approved account is the way to see them. An external scan is also uncredentialed, and perimeter devices limit it further. A passive scan only observes existing traffic. A discovery scan maps reachable hosts and ports, which the first scan already did.

Look for this next time: To see patch levels and local configuration, use a credentialed scan; uncredentialed scans mostly see the network surface.

Correct answer: A · Passive scanning of mirrored traffic, which sends nothing to the devices

NIST SP 800-82r3 says passive scans inspect existing traffic without adding any, which suits sensitive OT devices that may behave unexpectedly when probed. It also says active scans may cause device instability, call for extreme caution, and are best scheduled during planned OT outages, and none is planned here. An active scan overnight or during the busiest shift still probes the controllers directly. An external scan would not inventory devices on an internal plant network. The trade-off is that a passive scan misses devices that are not communicating and can take days.

Look for this next time: On fragile OT networks with no planned outage, start with passive discovery, because active scans can disrupt controllers.

Correct answer: D · Finding 2, because it is exposed and known to be exploited now

FIRST's CVSS v4.0 specification says the base score reflects a vulnerability's intrinsic severity and that consumers should add threat and environmental context before making remediation decisions. CISA describes its KEV catalog as the authoritative source of vulnerabilities exploited in the wild and recommends prioritizing them. Finding 2 combines active exploitation with internet exposure on a remote-access device, so it goes first. The higher base score of Finding 1 does not outweigh its isolation. Patch availability does not make two findings equally urgent, and the stem gives no evidence that weak monitoring makes the lab server a bigger risk.

Look for this next time: Rank findings by exploitation and exposure as well as CVSS: a KEV-listed flaw on an internet-facing system usually comes first.

Correct answer: B · Something blocked the probes, so Nmap cannot tell whether it is open

Nmap's reference guide says a port is filtered when packet filtering, from a firewall, router rules, or host-based firewall software, keeps the probes from reaching it, so Nmap cannot determine whether it is open. From a guest VLAN, that is usually the intended result. An open port would be listed as open. A closed port is reachable and answers, but has no application listening, which is a different state. Filtered describes one port and does not show that the host is down; Nmap reports host status separately.

Look for this next time: In Nmap, filtered means something blocked the probes, not that the port is closed or the host is down.

Correct answer: C · Record an exception and add compensating controls, such as isolating it

CompTIA's objectives list exceptions and compensating controls among mitigation strategies, and NIST defines a compensating control as one used in place of a recommended control that provides equivalent or comparable protection. A documented exception with compensating controls, such as placing the device on a restricted segment, reduces risk until the planned replacement. Dropping the device from the inventory hides the risk instead of managing it. Forcing a patch built for another OS version onto a clinical device in use risks breaking it. Informal acceptance with no record leaves no owner, no review date, and no added protection.

Look for this next time: When a system cannot be patched, document the exception and add compensating controls such as segmentation.

Correct answer: D · Command and control, a channel for remote instructions

Lockheed Martin's guide to the Cyber Kill Chain describes command and control (C2) as malware opening a channel that lets the adversary manipulate the victim remotely, most commonly over web, DNS, or email protocols. Regular HTTPS check-ins that return instructions are that channel, and the guide calls blocking it the defender's last best chance to stop the operation. Delivery was the email attachment, and exploitation and installation came before the beaconing. Actions on objectives is the attacker pursuing the mission's goal, such as stealing data, which the stem does not yet show.

Look for this next time: Regular check-ins that bring back instructions mark the Kill Chain's command-and-control phase.

Correct answer: A · The goal is the Credential Access tactic, and the method is a technique

MITRE says tactics represent the 'why' of an ATT&CK technique, the adversary's tactical goal, and Credential Access is the tactic for an adversary trying to steal account names and passwords. The method, dumping credentials from LSASS memory, is the 'how', which ATT&CK records as a technique, OS Credential Dumping, with LSASS Memory as a sub-technique. Swapping the two reverses the model. ATT&CK lists procedures as examples of how specific groups or software carried out a technique, not as labels for goals. A method is a technique, so the two observations cannot both be tactics.

Look for this next time: In ATT&CK, the tactic is the attacker's goal and the technique is how the attacker reaches it.

Correct answer: C · Isolate the workstation with EDR, so the encryption stops spreading

Detection and analysis are done, so containment comes next in the incident response process. NIST SP 800-61r3 describes containment as preventing the expansion of an incident and gives moving a compromised endpoint to an isolated network as an example. Isolating the host with EDR stops further encryption and keeps it powered on, which preserves volatile evidence. Reimaging belongs to eradication and recovery, and doing it now destroys evidence before the incident is scoped. Restoring the share while the host is still online lets the files be encrypted again. A report to all staff can wait and goes through the communication plan.

Look for this next time: After confirming an active incident, contain it first: isolate the host before eradication or restoration.

Correct answer: B · To prove the image matches the original and was not altered

NIST SP 800-86 says acquired data should have its integrity verified, typically by computing the message digest of the original and copied data and comparing them to make sure they are the same, which matters most when the data may be needed for legal reasons. Matching SHA-256 values show the image is an exact copy, and the recorded values let anyone check later that it was not changed. Hashing does not encrypt or compress data. Comparing file hashes with known samples can find known malware, but that is not why the analyst hashed the whole drive and its image.

Look for this next time: Hash the original and the image and compare the values to validate evidence integrity.

Correct answer: D · Convert every timestamp to UTC, which puts the logon at 13:59, before the transfer

NIST SP 800-92 notes that organizations with systems in several time zones often need to convert all logged times to a single time zone, and that inconsistent timestamps can make one event look earlier than another. Converting the Windows entry to UTC gives 13:59, six minutes before the 14:05 transfer, so the logon came first. Trusting one device's clock over the other ignores the time-zone difference itself. Logs from mixed time zones can be correlated once they are normalized, so the Windows events are still useful evidence. Keeping the recorded order mixes two clocks and produces the wrong sequence.

Look for this next time: Normalize every log source to one time zone, usually UTC, before you build a timeline.

Correct answer: C · Time to detect of 56 hours and time to respond of 6 hours

Under the SOC's own definitions, time to detect runs from Monday 02:00 to Wednesday 10:00, which is 48 hours plus 8 hours, or 56 hours. Time to respond runs from the Wednesday 10:00 alert to containment at 16:00, which is 6 hours. Swapping the two values reverses the definitions. The 62-hour figure is the whole span from first activity to containment, which belongs to neither metric as defined here. Averaging these values across incidents gives the mean time to detect and mean time to respond that CompTIA lists among SOC metrics.

Look for this next time: Apply your organization's definitions: detection runs from first activity to alert, and response runs from alert to containment.

Correct answer: A · A contractual agreement, because the vendor contract limits patching

CompTIA's objectives list contractual agreements among the inhibitors to remediation, along with legacy systems, patch availability, and organizational governance. Here the only obstacle is the vendor's support agreement, so the report should name it and plan around it, for example by asking the vendor to certify the patch or adding compensating controls in the meantime. The stem rules out the other three: the operating system is supported, so this is not a legacy system; a patch exists; and the change board approved the work.

Look for this next time: Name the real blocker in the report: when a vendor contract restricts patching, the inhibitor is contractual.

Correct answer: B · Business impact, current status, and the decision the board must make

CompTIA's objectives list the executive summary as its own item, apart from post-incident reports such as the after action report. Its readers are decision-makers rather than analysts, so leading with what the incident cost or put at risk, where things stand now, and the funding decision gives the board what it needs in plain language. A full list of indicators belongs in technical reporting and threat intelligence sharing. A command-by-command log supports the timeline and lessons learned. Raw scan output serves the vulnerability team. Each can sit in an appendix, but none of them should open a board summary.

Look for this next time: An executive summary leads with impact, status, and the decision needed; technical detail goes in appendices.