CertArea
All CompTIA exams

Free CS0-003 practice test: 30 questions with answers

30 original questions for CompTIA CySA+ (V3), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

CS0-003 exam guide: topics, cost and format

All 30 CS0-003 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security Operations (8 questions)

  1. Question 1

    A SOC analyst notices many failed logins for one account followed by a successful login from an unfamiliar country. Which conclusion is best supported first?

    1. AA printer malfunction on the third-floor MFP, where a jammed spool queue is holding jobs
    2. BA normal user on travel, so the login needs no further action
    3. CPossible credential compromise that needs investigation and containment
    4. DA routine DNS resolver cache refresh that flushes stale records on the internal server
    Show answer and explanation
    Correct answer: C

    Repeated failures followed by a success from an unusual location suggest credential compromise, which needs investigation and containment. Travel is possible but must be verified, while printers and DNS caches are unrelated.

  2. Question 2

    Which log source is most useful for finding which process on an endpoint made an outbound network connection?

    1. AThe printer's toner usage log, which tracks cartridge levels
    2. BThe building badge reader log, which records each door entry
    3. CThe web server's favicon request log, which lists fetches
    4. DEndpoint detection telemetry that records process and network events
    Show answer and explanation
    Correct answer: D

    Endpoint telemetry records processes and their network connections together, which identifies the process responsible. Printer logs, badge logs and favicon logs do not show process-to-connection relationships.

  3. Question 3

    A SIEM correlation rule fires on every failed login, creating many low-value alerts. The analyst wants to reduce noise without losing real detections. Which change is most appropriate?

    1. ATune the rule with thresholds and context, such as failures per account over a time window
    2. BDelete the raw authentication logs that trigger the rule so the alert volume drops quickly
    3. CDisable the correlation rule for failed logins until the source is reviewed
    4. DSend every alert to the executive team and the board so that leadership can review each failed login event
    Show answer and explanation
    Correct answer: A

    Thresholds and context, such as failures per account over a window, reduce noise while keeping meaningful detections. Disabling the rule removes detection, deleting logs destroys evidence, and sending alerts to executives does not reduce noise.

  4. Question 4

    An analyst must find all hosts that connected to a known malicious IP address in the last 30 days. Which data source is needed first?

    1. AThe office wall calendar with meeting room bookings
    2. BThe printer queue report that lists pending print jobs by user, page count and time
    3. CNetwork flow or firewall logs with destination IP and timestamps
    4. DThe software licence list tracking installed seats and renewal dates
    Show answer and explanation
    Correct answer: C

    Flow or firewall logs record destination addresses and times, which allows a search for connections to the malicious IP. Calendars, printer reports and licence lists do not record network connections.

  5. Question 5

    A threat hunter wants to determine whether a behaviour seen in one incident is present elsewhere in the environment. Which approach fits best?

    1. AReading the incident report once and filing it as closed without searching other hosts
    2. BWaiting for another alert from the SIEM to appear before reviewing related logs
    3. CHypothesis-driven threat hunting using queries across endpoint and network data
    4. DScanning the printers and the shared network storage with a vulnerability assessment tool
    Show answer and explanation
    Correct answer: C

    Hypothesis-driven hunting uses queries across data sources to find the behaviour elsewhere. Waiting for alerts, reading a single report and scanning only printers do not search effectively.

  6. Question 6

    An analyst uses a SIEM and wants to see how many events of each type occurred in the last hour, grouped by source. Which capability is needed?

    1. AA printed copy of the raw logs from each device
    2. BA screenshot of the SIEM dashboard taken earlier
    3. CA manual tally recorded in a paper notebook
    4. DAggregation and grouping in the SIEM query language
    Show answer and explanation
    Correct answer: D

    Aggregation and grouping in the query language produce counts by type and source over a time window. Printed logs, manual notebook counts and screenshots are slow and error-prone.

  7. Question 7

    A security team wants to know when a user account's privileges change in the directory. Which log source records this?

    1. AThe web proxy's cache log, which records cached object
    2. BThe printer's status log, which reports toner levels, paper jams and firmware
    3. CThe nightly backup job history for file servers
    4. DDirectory audit logs for role and group membership changes
    Show answer and explanation
    Correct answer: D

    Directory audit logs record role and group changes with the actor and time. Proxy caches, printer status and backup history do not record privilege changes.

  8. Question 8

    A SOC wants to detect data exfiltration over DNS. Which indicator is the most useful?

    1. AA high number of printed pages sent to the shared office printer after hours
    2. BFrequent changes to the desktop wallpaper and screensaver settings on workstations
    3. CMany emails with the same subject line sent from the same internal account within a day
    4. DUnusually long or high-volume DNS queries to a single unfamiliar domain
    Show answer and explanation
    Correct answer: D

    Long or high-volume DNS queries to one unfamiliar domain are a common indicator of DNS tunnelling or exfiltration. Printing, email subjects and wallpapers are unrelated.

Vulnerability Management (8 questions)

  1. Question 9

    A vulnerability scan reports a critical flaw on a server that is not reachable from the internet. How should the analyst prioritize it?

    1. AAssess the actual exposure and business impact before ranking it against other findings
    2. BTreat every critical flaw as the top priority regardless of context and schedule an emergency change for each
    3. CIgnore the flaw because the server sits on the internal network behind the firewall
    4. DPatch the lowest-severity findings first, working through the backlog in order
    Show answer and explanation
    Correct answer: A

    Prioritization should consider exposure, exploitability and business impact, not severity alone. Ignoring internal flaws and patching low-severity findings first both misjudge risk.

  2. Question 10

    A scanner reports a vulnerability on a system, but the system administrator says the software version is patched. What should the analyst do?

    1. AClose the finding as resolved without checking the host, since the patch level was confirmed
    2. BVerify the finding manually, for example by checking the installed version, and document the result
    3. CIncrease the scan frequency for the rest of the year across every subnet to catch drift
    4. DAssume the scanner is wrong about this host, since the administrator has already checked
    Show answer and explanation
    Correct answer: B

    Manual verification confirms whether the finding is real or a false positive and documents the outcome. Closing without checking, assuming the scanner is wrong and changing frequency do not resolve the question.

  3. Question 11

    A team must decide how often to scan its internet-facing systems. Which factor should drive the frequency?

    1. AThe rate of change and exposure of the systems
    2. BThe number of coffee breaks taken each week
    3. CThe colour of the scanner interface theme
    4. DThe name of the scanning vendor's brand
    Show answer and explanation
    Correct answer: A

    Systems that change often or face the internet need more frequent scanning. Interface colours, break schedules and vendor names do not determine risk-based frequency.

  4. Question 12

    An organization wants to measure how quickly it remediates critical vulnerabilities. Which metric is most useful?

    1. AMean time to remediate critical findings
    2. BThe number of reports printed
    3. CThe average length of vulnerability names
    4. DThe number of scans run last month
    Show answer and explanation
    Correct answer: A

    Mean time to remediate critical findings measures how fast the most serious issues are fixed. Scan counts, printed reports and name lengths do not measure remediation speed.

  5. Question 13

    A web application is vulnerable to injection. The development team asks for the most effective fix at the code level. Which control is recommended?

    1. AHiding the application's admin login page
    2. BParameterized queries and input validation
    3. CTurning off verbose application logging
    4. DIncreasing the server's memory cache
    Show answer and explanation
    Correct answer: B

    Parameterized queries and validation address injection at the source by separating data from commands. Hiding pages, disabling logs and adding memory do not fix the flaw.

  6. Question 14

    A vulnerability has a known exploit that is actively used in attacks, but the vendor patch is not yet available. Which interim action reduces the risk most?

    1. AIgnore the exploit in production until the vendor patch is released, since the risk has already been documented in the register
    2. BPublish the exploit details and proof-of-concept code on the internal wiki so that other teams can inform their own defences
    3. CApply a compensating control such as network restriction or a virtual patch until the patch is available
    4. DTurn off security monitoring and endpoint alerting for the affected system so that maintenance traffic is not flagged
    Show answer and explanation
    Correct answer: C

    Compensating controls such as network restriction or virtual patching reduce exploitability until a fix exists. Ignoring the exploit, publishing it and disabling monitoring all increase risk.

  7. Question 15

    Which two factors should be considered when scoring a vulnerability for remediation priority? (Choose two.)

    1. AThe vendor's logo colour
    2. BThe length of the vulnerability title
    3. CWhether the affected asset is business critical
    4. DThe number of people who attended the scan review
    5. EWhether a public exploit exists for it
    Show answer and explanation
    Correct answer: C, E

    Public exploits raise the likelihood of attack, and asset criticality raises the impact. Logo colours, title lengths and meeting attendance do not affect risk priority.

  8. Question 16

    An organization runs scans but finds that many systems are missing from the results. Which problem is most likely?

    1. AThe scanner has too many configurable features and plugins enabled
    2. BThe scan scope or credentials do not cover all asset groups
    3. CThe reports are printed in full colour on A4 paper
    4. DThe vulnerability titles are too long to fit the default column width
    Show answer and explanation
    Correct answer: B

    Missing systems usually result from incomplete scope or credentials that do not reach all asset groups. Feature counts, title length and report colour do not explain missing coverage.

Incident Response (7 questions)

  1. Question 17

    During an incident, the team must preserve evidence for later legal review. Which step is most important before making changes on a compromised system?

    1. AReboot the affected system immediately to clear the malicious process from RAM and restart it
    2. BCapture a forensic image or memory snapshot with documented chain of custody
    3. CDelete suspicious files and registry run keys to clean the system before imaging it
    4. DInstall the latest available security software updates first
    Show answer and explanation
    Correct answer: B

    Capturing an image or memory snapshot with chain of custody preserves evidence before changes alter it. Rebooting, deleting files and patching can destroy or contaminate evidence.

  2. Question 18

    A SOC confirms a ransomware infection on several endpoints. Which containment action should be taken first?

    1. AIsolate the affected endpoints from the network to stop spread
    2. BSend the ransom payment immediately
    3. CReset the passwords of all users in the company without planning
    4. DWait for the ransomware to finish encrypting files
    Show answer and explanation
    Correct answer: A

    Isolating affected endpoints stops lateral spread and limits further encryption. Waiting, paying immediately and unplanned global password resets do not contain the incident.

  3. Question 19

    An incident response team wants to identify the root cause of an intrusion after containment. Which activity is most appropriate?

    1. AClosing the ticket immediately after containment, before the malware has been removed
    2. BPost-incident analysis that reviews the timeline, entry point and control gaps
    3. CBlaming the first person who noticed the problem and assigning them responsibility for the breach
    4. DWaiting for the next scheduled external audit cycle to decide whether the root cause needs review
    Show answer and explanation
    Correct answer: B

    Post-incident analysis reviews the timeline, entry point and control gaps to prevent a repeat. Closing immediately, blaming individuals and waiting for an audit do not identify the root cause.

  4. Question 20

    A legal team asks for a summary of an incident for regulators, including when the breach occurred and what data was affected. Which activity produces this?

    1. AA verbal summary from a non-involved colleague in sales
    2. BA marketing announcement drafted by the communications team
    3. CIncident reporting with a verified timeline and impact assessment
    4. DA list of the monitoring tools installed on the server
    Show answer and explanation
    Correct answer: C

    A verified timeline and impact assessment give regulators accurate facts, which the report must contain. Verbal summaries from uninvolved people, marketing announcements and tool lists do not provide verified facts.

  5. Question 21

    Which two actions should be part of an incident response playbook for a compromised account? (Choose two.)

    1. ALeave the account active so the attacker can be observed without limits
    2. BReview recent actions the account performed and any changes it made
    3. CEmail the password to the affected user
    4. DDelete all logs related to the account
    5. EReset the account credentials and revoke active sessions
    Show answer and explanation
    Correct answer: B, E

    Resetting credentials and revoking sessions contain the compromise, and reviewing recent actions identifies its extent. Leaving accounts active without limits, emailing passwords and deleting logs all increase risk or destroy evidence.

  6. Question 22

    A SOC must decide whether to notify customers after a data incident. Which factor is most important to the decision?

    1. AWhether personal or regulated data was exposed, and the applicable notification rules
    2. BThe number of emails in the shared inbox and the unread messages in the SOC mailbox
    3. CThe type of coffee and snacks served in the employee break room kitchen
    4. DThe colour of the company's logo, the font of the letterhead and the shade of the branded template
    Show answer and explanation
    Correct answer: A

    Notification obligations depend on whether personal or regulated data was exposed and the applicable rules. Logos, email counts and coffee are irrelevant.

  7. Question 23

    After a malware incident, the team wants to confirm that the systems are clean before returning them to service. Which check gives the strongest assurance?

    1. AA reboot and a visual check of the desktop wallpaper and taskbar icons
    2. BReinstallation of the operating system without restoring user data
    3. CFull scan with updated signatures, integrity checks and monitoring for recurrence
    4. DAssuming the malware was removed because the EDR alert stopped firing and no new alerts appeared
    Show answer and explanation
    Correct answer: C

    A full scan with current signatures, integrity checks and monitoring for recurrence gives strong assurance. Reboots, visual checks, and assumptions are not sufficient, and reinstallation without restoring data is a different recovery decision.

Reporting and Communication (7 questions)

  1. Question 24

    A security manager must report the status of vulnerability remediation to executives. Which format is most appropriate?

    1. AA concise summary with risk-based metrics, trends and decisions needed
    2. BA technical log dump of raw scanner output without context
    3. CA raw export of thousands of scanner results from each host
    4. DA memo that lists open tasks with no metrics or deadlines
    Show answer and explanation
    Correct answer: A

    Executives need concise, risk-based metrics, trends and decisions. Raw lists, technical dumps and metric-free memos do not support decisions.

  2. Question 25

    An analyst must tell a business unit about a vulnerability that will take months to fix. Which approach is best for communication?

    1. ATell them the risk is not important to daily operations, since the affected server is internal and the fix is due
    2. BExplain the risk in business terms, the interim controls and the timeline with clear owners
    3. CSend a raw list of CVE identifiers and CVSS scores from the scanner export with no further explanation
    4. DWait until the vendor fix has been fully tested and deployed across production before communicating
    Show answer and explanation
    Correct answer: B

    Explaining risk in business terms with interim controls and a timeline with owners gives the unit what it needs to act. Downplaying the risk, sending bare identifiers and waiting until the fix are poor communication.

  3. Question 26

    A company must report the number of security incidents by category for a board meeting. Which practice ensures the numbers are consistent across reports?

    1. AEach analyst choosing their own category names for each ticket
    2. BCounting incidents from memory during the monthly review meeting
    3. CRenaming categories each month to match the latest board template
    4. DA defined incident taxonomy used consistently across the ticketing system
    Show answer and explanation
    Correct answer: D

    A defined taxonomy applied consistently makes counts comparable across reports and periods. Individual category names, memory counts and monthly renaming produce inconsistent results.

  4. Question 27

    A security analyst must write a technical report for engineers and a summary for managers from the same investigation. Which approach is best?

    1. AA verbal briefing for managers with no written record kept in the case management system
    2. BA full technical log of commands, hashes, packet captures and registry changes, with no impact or scope described
    3. CA detailed technical appendix with a separate executive summary that uses plain language and impact
    4. DOne combined report with no executive summary, placing raw timelines, IOC lists and log excerpts in the body
    Show answer and explanation
    Correct answer: C

    A technical appendix serves engineers, while a plain-language executive summary focused on impact serves managers. One report with no summary, purely technical content and verbal-only summaries do not serve both audiences.

  5. Question 28

    A SOC wants a metric that shows how quickly it detects threats. Which metric measures this?

    1. AMean time to print
    2. BAverage coffee time
    3. CMean time to detect
    4. DNumber of monitors
    Show answer and explanation
    Correct answer: C

    Mean time to detect measures the average time between the start of a threat and its detection. Printing time, coffee time and monitor counts are not security metrics.

  6. Question 29

    A manager asks why the security team needs more budget. Which argument is most persuasive?

    1. AQuantified risk reduction and the business impact of incidents avoided
    2. BA longer list of security tools deployed with no measurable outcomes or metrics attached
    3. CThe team's preference for newer equipment and the latest hardware refresh cycle
    4. DThe rented square footage of the team's office and the number of desks it holds
    Show answer and explanation
    Correct answer: A

    Quantified risk reduction and avoided business impact connect spending to outcomes that managers value. Tool lists without outcomes, equipment preferences and office size are weaker arguments.

  7. Question 30

    A report must show whether controls operate as designed over time. Which measure supports this?

    1. AThe character length of the report title and its subtitle
    2. BThe number of networked printers per floor
    3. CThe colour scheme and font family used in the report
    4. DControl effectiveness metrics tracked over time
    Show answer and explanation
    Correct answer: D

    Control effectiveness metrics over time show whether controls keep working as designed. Printer counts, colour schemes and title lengths do not measure control performance.