CompTIA CS0-003: CompTIA CySA+ (V3)

Last checked October 22, 2026 against the official CompTIA exam page.

1. Question 1Security Operations

   A SOC analyst notices many failed logins for one account followed by a successful login from an unfamiliar country. Which conclusion is best supported first?

   1. AA printer malfunction on the third-floor MFP, where a jammed spool queue is holding jobs
   2. BA normal user on travel, so the login needs no further action
   3. CPossible credential compromise that needs investigation and containment
   4. DA routine DNS resolver cache refresh that flushes stale records on the internal server
   Show answer and explanationHide answer

   Correct answer: C

   Repeated failures followed by a success from an unusual location suggest credential compromise, which needs investigation and containment. Travel is possible but must be verified, while printers and DNS caches are unrelated.

2. Question 2Vulnerability Management

   A vulnerability scan reports a critical flaw on a server that is not reachable from the internet. How should the analyst prioritize it?

   1. AAssess the actual exposure and business impact before ranking it against other findings
   2. BTreat every critical flaw as the top priority regardless of context and schedule an emergency change for each
   3. CIgnore the flaw because the server sits on the internal network behind the firewall
   4. DPatch the lowest-severity findings first, working through the backlog in order
   Show answer and explanationHide answer

   Correct answer: A

   Prioritization should consider exposure, exploitability and business impact, not severity alone. Ignoring internal flaws and patching low-severity findings first both misjudge risk.

3. Question 3Incident Response

   During an incident, the team must preserve evidence for later legal review. Which step is most important before making changes on a compromised system?

   1. AReboot the affected system immediately to clear the malicious process from RAM and restart it
   2. BCapture a forensic image or memory snapshot with documented chain of custody
   3. CDelete suspicious files and registry run keys to clean the system before imaging it
   4. DInstall the latest available security software updates first
   Show answer and explanationHide answer

   Correct answer: B

   Capturing an image or memory snapshot with chain of custody preserves evidence before changes alter it. Rebooting, deleting files and patching can destroy or contaminate evidence.

4. Question 4Reporting and Communication

   A security manager must report the status of vulnerability remediation to executives. Which format is most appropriate?

   1. AA concise summary with risk-based metrics, trends and decisions needed
   2. BA technical log dump of raw scanner output without context
   3. CA raw export of thousands of scanner results from each host
   4. DA memo that lists open tasks with no metrics or deadlines
   Show answer and explanationHide answer

   Correct answer: A

   Executives need concise, risk-based metrics, trends and decisions. Raw lists, technical dumps and metric-free memos do not support decisions.

5. Question 5Security Operations

   Which log source is most useful for finding which process on an endpoint made an outbound network connection?

   1. AThe printer's toner usage log, which tracks cartridge levels
   2. BThe building badge reader log, which records each door entry
   3. CThe web server's favicon request log, which lists fetches
   4. DEndpoint detection telemetry that records process and network events
   Show answer and explanationHide answer

   Correct answer: D

   Endpoint telemetry records processes and their network connections together, which identifies the process responsible. Printer logs, badge logs and favicon logs do not show process-to-connection relationships.