Free CompTIA CySA+ Practice Test (CS0-003) 2026

Right answer (B): That's correct! Password spraying targets multiple accounts with a small number of commonly used passwords from the same source, which matches the pattern of one IP hitting many accounts.

Wrong answers:

• A): Credential stuffing uses previously breached username-password pairs and typically originates from distributed sources rather than a single IP.
• C): A brute force attack against a single account generates many attempts on one account, not across multiple accounts as described.
• D): Session hijacking involves stealing an active session token and would not produce failed login attempts in the authentication logs.

Right answer (C): That's correct! A Word document spawning PowerShell is a behavioral indicator because it represents an abnormal parent-child process relationship that deviates from expected application behavior.

Wrong answers:

• A): Network-based indicators involve suspicious traffic patterns such as connections to known malicious IPs or unusual DNS queries, not local process execution chains.
• B): Signature-based detection relies on matching known malware hashes or byte patterns, whereas this scenario identifies suspicious behavior without a specific signature.
• D): A compliance violation relates to policy or regulatory non-adherence and is not a technical indicator of compromise.

Right answer (D): That's correct! SOAR platforms uniquely provide automated playbook execution that can orchestrate responses across multiple security tools without human intervention.

Wrong answers:

• A): Log aggregation is a core SIEM function that collects and normalizes data from firewalls, endpoints, servers, and other sources into a central repository.
• B): Real-time correlation is a fundamental SIEM capability that matches events against detection rules to identify threats as they occur.
• C): Dashboard visualization is a standard SIEM feature that presents alert data, trends, and metrics in graphical formats for analyst review.

Right answer (A): That's correct! Implementing compensating controls such as network segmentation, WAF rules, or IPS signatures reduces risk immediately while scheduling the patch for a proper maintenance window.

Wrong answers:

• B): Applying the patch immediately on a production database during business hours risks unplanned downtime and data loss that could impact critical operations.
• C): Marking it as a false positive without validation ignores a legitimate critical vulnerability and leaves the system exposed to exploitation.
• D): Waiting for the next quarterly cycle leaves the critical vulnerability unaddressed for potentially months, greatly increasing the window of exposure.

Right answer (B): That's correct! Parameterized queries prevent SQL injection at the source by separating SQL logic from user-supplied data, making it impossible for input to alter query structure.

Wrong answers:

• A): A WAF can detect and block some injection attempts but is a compensating control that can be bypassed with obfuscation or novel attack patterns.
• C): Restricting to read-only limits the damage from exploitation but does not prevent data exfiltration through SELECT-based injection attacks.
• D): TLS encrypts the connection between application and database but has no effect on SQL injection, which operates at the application logic layer.

Right answer (C): That's correct! The CVSS environmental score allows analysts to adjust the base score based on the specific deployment context, including network accessibility and existing mitigations.

Wrong answers:

• A): Treating every vulnerability as critical without context leads to inefficient resource allocation and patch fatigue across the organization.
• B): Ignoring vulnerabilities on air-gapped systems is dangerous because insider threats, removable media, and supply chain attacks can still exploit them.
• D): The difficulty of updating does not increase the vulnerability's risk score, though it may affect the remediation timeline and approach.

Right answer (D): That's correct! After containment, the NIST framework proceeds to eradication, which removes the threat, followed by recovery to restore normal operations.

Wrong answers:

• A): Preparation is the first phase that occurs before any incident and involves creating policies, assembling the team, and conducting training exercises.
• B): Detection and Analysis is the second phase where the incident is initially identified and investigated, which has already occurred in this scenario.
• C): Containment has already been completed as stated in the question, so repeating this phase would be redundant and delay remediation.

Right answer (A): That's correct! Creating a forensic image with a documented hash preserves the original evidence in its exact state and establishes an integrity baseline for chain of custody.

Wrong answers:

• B): Logging into the server directly modifies access timestamps and could alter or overwrite volatile data that may contain critical evidence.
• C): Rebooting the server destroys volatile memory contents including running processes, network connections, and encryption keys that may be essential to the investigation.
• D): Deleting files destroys evidence, removes forensic artifacts, and could trigger anti-forensic mechanisms embedded in the malware.

Right answer (B): That's correct! Executive leadership needs business-focused reporting that translates technical findings into risk impact, financial exposure, and recommended investment in remediation.

Wrong answers:

• A): Detailed technical reports with raw scan data overwhelm non-technical stakeholders and fail to communicate business relevance or strategic priorities.
• C): A vulnerability spreadsheet sorted by IP provides no business context and requires technical expertise to interpret that executives typically do not possess.
• D): Packet captures are raw technical evidence used by SOC analysts and forensic investigators, not a communication format suitable for leadership briefings.

Right answer (C): That's correct! Legal counsel, executive management, and the vendor must be notified first to coordinate response, assess legal obligations, and stop the compromised update from spreading further.

Wrong answers:

• A): Notifying the media prematurely can cause reputational damage, interfere with the investigation, and may violate legal requirements around disclosure timing.
• B): A company-wide email could alert the attacker if they have internal access and may cause unnecessary panic before the scope is fully understood.
• D): While law enforcement notification may be required, internal stakeholders and legal counsel should be engaged first to preserve evidence and determine reporting obligations.