CompTIA CySA+ V4 v1.0
Question 1
A cybersecurity analyst requests a paid subscription to a threat intelligence feed relevant to a company's industry. Which of the following best describes this type of feed?
- A. Open-source intelligence
- B. Threat mapping
- C. Threat modeling
- D. Closed-source intelligence
Answer : D
Question 2
HOTSPOT -
A systems administrator is reviewing the output of a vulnerability scan.
INSTRUCTIONS -
Review the information in each tab.
Based on the organization’s environment architecture and remediation standards, select the server to be patched within 14 days and select the appropriate technique and mitigation.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer : 
Question 3
A security team reviews a penetration testing report of a web application that contains multiple cross-site scripting (XSS) and Structured Query Language injection (SQLi) vulnerabilities. Which of the following is most likely causing these to occur?
- A. Misconfigured web application firewall (WAF)
- B. Lack of secure input validation
- C. Lack of a Hypertext Transfer Protocol (HTTP) Strict Transport Security (HSTS) header
- D. Lack of endpoint protection in the environment
Answer : B
Question 4
The Chief Information Officer (CIO) is requiring users to phase out a legacy system that no longer receives security updates because the system will be decommissioned soon. Which of the following risk management strategies is the CIO using?
- A. Avoidance
- B. Mitigation
- C. Acceptance
- D. Transference
Answer : A
Question 5
A security team deploys a new scanning solution that requires root, domain administrator, and local server administrator permissions on all systems. Which of the following is the best way to help mitigate the risk for this level of access?
- A. Enabling single sign-on for all administrators
- B. Integrating token-based authentication using a privileged access management (PAM) solution
- C. Using temporary, one-time passwords as part of the login process
- D. Configuring agentless scanning for critical targets
Answer : B
Question 6
Before merging with a software company, the acquiring company's legal team requires a detailed software scan to determine if all code base is using open-source or paid licensed libraries. The vulnerability management analyst needs to provide this report. Which of the following scan methods will best meet this requirement?
- A. Static application security testing (SAST)
- B. Dynamic application security testing (DAST)
- C. Software composition analysis (SCA)
- D. Runtime application self-protection (RASP)
- E. Credentialed vulnerability scan
Answer : C
Question 7
Which of the following is the most likely reason an organization might implement compensating controls?
- A. A vulnerability does not have a patch, and the system is mission critical.
- B. A vulnerability has been fixed, tested, and deployed to production.
- C. A vulnerability is being actively exploited in the wild, but the organization does not use the affected system.
- D. A vulnerability was detected, but the organization has determined the result is a false positive.
Answer : A
Question 8
A vulnerability analyst must perform a security assessment on an edge device running various services. The analyst runs an Nmap port scan and sees the following output:
Which of the following should the analyst do next to validate the discovered remote access service is secure?
- A. Verify that the web server certificate is added to certificate store.
- B. Verify that the Border Gateway Protocol (BGP) route has been published.
- C. Verify that the virtual private network (VPN) service is utilizing Main Mode.
- D. Verify that the web server can be pinged.
Answer : C
Question 9
An analyst performs Nmap scans to determine which hosts may need to be targeted to deploy a critical Windows patch. The patch for the vulnerability is to address a critical security flaw that targets open Server Message Block (SMB) ports on Windows systems only. The analyst scans with the following command:
$sudo nmap -Pn 10.203.10.0/24
The analyst then receives the following output:
Which of the following hosts should the analyst prioritize for patching?
- A. 10.203.10.11
- B. 10.203.10.12
- C. 10.203.10.13
- D. 10.203.10.16
Answer : A
Question 10
An analyst receives the following output:
Which of the following is the correct number of discovered systems that are allowing unencrypted traffic?
- A. 1
- B. 2
- C. 3
- D. 5
Answer : B
Question 11
An incident response team identifies a malicious uniform resource locator (URL) associated with a required business process and performs the following activities:
• Access to the URL has been restricted only to the necessary users through firewall rules and Cloud Security Group rules.
• Additional monitoring has been enabled for traffic related to that site and the allowed users.
• All application servers that need to access that site have been patched with the latest security and software updates.
• Application owners have been notified of the severity and need to remediate this reported issue.
Which of the following best describes the overall mitigation the security team is performing?
- A. Patching solutions
- B. Configuration management
- C. Compensating controls
- D. Attack surface management
Answer : C
Question 12
A vendor releases details of a new vulnerability. When an analyst reviews the scheduled scans, no vulnerabilities are identified. The vulnerability is only discovered after a configuration change. Which of the following scan types did the analyst configure?
- A. External
- B. Credentialed
- C. Agent-based
- D. Network
Answer : C
Question 13
A vulnerability analyst conducts a security assessment on the Remote Desktop Protocol (RDP) security posture within the environment. The analyst issues the following command for the assessment: nmap -p 3389 --script rdp* 10.0.0.0/24
The analyst receives responses, which are divided into one of the two categories, from 13 out of the 254 hosts:
Which of the following conclusions can the analyst make about the output on Category 2?
- A. The systems are joined to an Active Directory domain and using New Technology LAN Manager (NTLM) as an authentication method.
- B. The systems are not joined to an Active Directory domain and are using Kerberos as an authentication method.
- C. The systems are not joined to an Active Directory domain and are using NTLM as an authentication method.
- D. The systems are joined to an Active Directory domain and are using Kerberos as an authentication method.
Answer : C
Question 14
An analyst needs to perform a baseline security evaluation of the company's cloud infrastructure. Which of the following tools is most appropriate for this task?
- A. Open Vulnerability Assessment Scanner (OpenVAS)
- B. Nikto
- C. ScoutSuite
- D. Metasploit
Answer : C
Question 15
The vulnerability management team must scan the cloud environment to establish security baselines. Which of the following assessment tools should the team use to perform this task?
- A. Metasploit
- B. Prowler
- C. Maltego
- D. Caldera
Answer : B