COMPTIA CYBERSECURITY ANALYST (CYSA+)
CS0-003 Practice Exam
Official Practice Exam -- 2026/2027 Edition
100 Questions 165 Minutes 75% Passing Score 3-Year Recertification
TABLE OF CONTENTS
Domain 1: Security Operations ...................... Questions 1-33 (33 questions)
Domain 2: Vulnerability Management ...................... Questions 34-63 (30 questions)
Domain 3: Incident Response and Management ...................... Questions 64-83 (20 questions)
Domain 4: Reporting and Communication ...................... Questions 84-100 (17 questions)
Answer Key .......................... Final Page
EXAM INSTRUCTIONS
This practice exam contains 100 multiple-choice questions divided across four domains aligned with the
official CompTIA CySA+ (CS0-003) exam blueprint. You have 165 minutes to complete all questions.
Select the single best answer for each question. The passing score is 75% (75 of 100 questions correct).
Each question includes the correct answer (highlighted in green) and a rationale explaining the correct
choice and why the most common wrong answer is incorrect. Use these explanations to deepen your
understanding of the underlying concepts, not just to memorize answers.
Domain 1: Security Operations covers SIEM, SOAR, threat hunting, security monitoring, and security
automation. Domain 2: Vulnerability Management covers scanning, CVSS, patch management, and
risk-based prioritization. Domain 3: Incident Response and Management covers the IR lifecycle, forensic
analysis, evidence handling, and containment strategies. Domain 4: Reporting and Communication covers
security reporting, stakeholder communication, metrics, and compliance documentation.
Review all rationales carefully, even for questions you answered correctly, to ensure comprehensive
preparation for the actual exam. Good luck!
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 1 of 52
, Domain 1: Security Operations -- 2026/2027
Q1 Question 1 of 100
A 34-year-old security analyst at a regional bank reviews the SIEM dashboard at 09:15 and notices a
surge in failed RDP login attempts from an external IP address targeting the domain controller. The
attempts occur in rapid succession over a two-minute window. This pattern is most consistent with
which type of attack?
A. A distributed denial-of-service attack against RDP services
B. A brute-force credential attack against the domain controller
C. A pass-the-hash attack using cached credentials
D. A man-in-the-middle attack intercepting RDP traffic
Correct Answer: B
Rationale:
Rapid successive failed RDP login attempts from a single external IP indicate a brute-force attack attempting to
guess credentials. A DDoS would not produce failed login logs, pass-the-hash uses stolen hashes rather than
guessing, and a MITM attack intercepts traffic rather than generating login attempts.
Q2 Question 2 of 100
During a routine review of firewall logs, a 28-year-old network security engineer discovers that an
internal host at 10.0.5.22 is making outbound connections to a known command-and-control server on
port 4444 every 45 minutes. The connection lasts approximately 3 seconds each time. What is the most
appropriate immediate action for the engineer to take?
A. Block the C2 IP at the perimeter firewall and isolate the internal host
B. Update the antivirus signatures on the affected host
C. Send an email notification to the asset owner
D. Monitor the connection for an additional 24 hours before acting
Correct Answer: A
Rationale:
Blocking the C2 IP and isolating the internal host stops active command-and-control communication and prevents
further data exfiltration. Updating AV may miss the specific malware, email notification delays response, and
monitoring for 24 hours allows the adversary continued access.
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 2 of 52
,Q3 Question 3 of 100
A security operations center receives an alert that a user account belonging to a finance department
employee was used to access a sensitive database at 02:30 AM from a VPN connection originating in a
country where the company has no offices. The user confirms they were not working at that time. Which
analytic method would best confirm whether this represents a credential compromise?
A. Reviewing the user's web browsing history from the previous day
B. Correlating the VPN login with the user's typical access patterns and geolocation baseline
C. Checking the database for recently added records
D. Examining the user's email inbox for phishing messages
Correct Answer: B
Rationale:
Correlating the anomalous VPN login against the user's established geolocation and time-of-day baseline directly
evaluates whether the access deviates from normal behavior. Web browsing history, database records, and email
checks are supplementary and do not directly confirm credential misuse.
Q4 Question 4 of 100
A threat hunting team at a healthcare organization identifies an unknown process named 'svch0st.exe'
running from the temp directory on a critical server. The process is communicating with an external host
over HTTPS. Which of the following best describes the technique being used by the adversary?
A. Privilege escalation through token manipulation
B. Defense evasion through process masquerading
C. Lateral movement through remote services
D. Persistence through scheduled task creation
Correct Answer: B
Rationale:
Naming a malicious process to resemble a legitimate Windows process (svchost.exe) is a classic masquerading
technique used for defense evasion. This does not involve privilege escalation, lateral movement, or scheduled
tasks; its primary goal is to avoid detection by blending in.
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 3 of 52
, Q5 Question 5 of 100
A junior analyst is configuring a new SIEM correlation rule. The organization has experienced several
phishing campaigns that lead to credential harvesting. The analyst wants to detect when a single source
IP address successfully authenticates to more than five different user accounts within a ten-minute
window. Which SIEM feature should the analyst use?
A. Static threshold alerting on total login count
B. Time-based correlation with cardinality aggregation
C. Vulnerability scan integration with asset database
D. Threat intelligence feed auto-ingestion
Correct Answer: B
Rationale:
Time-based correlation with cardinality aggregation counts the number of unique (distinct) user accounts associated
with a single source IP within a defined time window, exactly matching the detection requirement. Static thresholds
count total events rather than unique accounts, and the other options are unrelated to this detection logic.
Q6 Question 6 of 100
A manufacturing company deploys an EDR solution across all endpoints. After two weeks, the SOC
team notices that several alerts were generated for 'suspicious PowerShell execution' on workstations in
the engineering department. Investigation reveals the scripts are part of a legitimate build automation
process. What is the best course of action?
A. Uninstall the EDR agent from engineering workstations to eliminate noise
B. Create an exclusion rule for the specific PowerShell scripts used in the build process
C. Disable PowerShell entirely on all engineering workstations
D. Ignore the alerts and rely on manual review only
Correct Answer: B
Rationale:
Creating a targeted exclusion for the known legitimate scripts reduces alert fatigue while preserving EDR visibility for
all other PowerShell activity. Uninstalling EDR removes all protection, disabling PowerShell breaks the build
process, and ignoring alerts risks missing real threats.
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 4 of 52
CS0-003 Practice Exam
Official Practice Exam -- 2026/2027 Edition
100 Questions 165 Minutes 75% Passing Score 3-Year Recertification
TABLE OF CONTENTS
Domain 1: Security Operations ...................... Questions 1-33 (33 questions)
Domain 2: Vulnerability Management ...................... Questions 34-63 (30 questions)
Domain 3: Incident Response and Management ...................... Questions 64-83 (20 questions)
Domain 4: Reporting and Communication ...................... Questions 84-100 (17 questions)
Answer Key .......................... Final Page
EXAM INSTRUCTIONS
This practice exam contains 100 multiple-choice questions divided across four domains aligned with the
official CompTIA CySA+ (CS0-003) exam blueprint. You have 165 minutes to complete all questions.
Select the single best answer for each question. The passing score is 75% (75 of 100 questions correct).
Each question includes the correct answer (highlighted in green) and a rationale explaining the correct
choice and why the most common wrong answer is incorrect. Use these explanations to deepen your
understanding of the underlying concepts, not just to memorize answers.
Domain 1: Security Operations covers SIEM, SOAR, threat hunting, security monitoring, and security
automation. Domain 2: Vulnerability Management covers scanning, CVSS, patch management, and
risk-based prioritization. Domain 3: Incident Response and Management covers the IR lifecycle, forensic
analysis, evidence handling, and containment strategies. Domain 4: Reporting and Communication covers
security reporting, stakeholder communication, metrics, and compliance documentation.
Review all rationales carefully, even for questions you answered correctly, to ensure comprehensive
preparation for the actual exam. Good luck!
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 1 of 52
, Domain 1: Security Operations -- 2026/2027
Q1 Question 1 of 100
A 34-year-old security analyst at a regional bank reviews the SIEM dashboard at 09:15 and notices a
surge in failed RDP login attempts from an external IP address targeting the domain controller. The
attempts occur in rapid succession over a two-minute window. This pattern is most consistent with
which type of attack?
A. A distributed denial-of-service attack against RDP services
B. A brute-force credential attack against the domain controller
C. A pass-the-hash attack using cached credentials
D. A man-in-the-middle attack intercepting RDP traffic
Correct Answer: B
Rationale:
Rapid successive failed RDP login attempts from a single external IP indicate a brute-force attack attempting to
guess credentials. A DDoS would not produce failed login logs, pass-the-hash uses stolen hashes rather than
guessing, and a MITM attack intercepts traffic rather than generating login attempts.
Q2 Question 2 of 100
During a routine review of firewall logs, a 28-year-old network security engineer discovers that an
internal host at 10.0.5.22 is making outbound connections to a known command-and-control server on
port 4444 every 45 minutes. The connection lasts approximately 3 seconds each time. What is the most
appropriate immediate action for the engineer to take?
A. Block the C2 IP at the perimeter firewall and isolate the internal host
B. Update the antivirus signatures on the affected host
C. Send an email notification to the asset owner
D. Monitor the connection for an additional 24 hours before acting
Correct Answer: A
Rationale:
Blocking the C2 IP and isolating the internal host stops active command-and-control communication and prevents
further data exfiltration. Updating AV may miss the specific malware, email notification delays response, and
monitoring for 24 hours allows the adversary continued access.
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 2 of 52
,Q3 Question 3 of 100
A security operations center receives an alert that a user account belonging to a finance department
employee was used to access a sensitive database at 02:30 AM from a VPN connection originating in a
country where the company has no offices. The user confirms they were not working at that time. Which
analytic method would best confirm whether this represents a credential compromise?
A. Reviewing the user's web browsing history from the previous day
B. Correlating the VPN login with the user's typical access patterns and geolocation baseline
C. Checking the database for recently added records
D. Examining the user's email inbox for phishing messages
Correct Answer: B
Rationale:
Correlating the anomalous VPN login against the user's established geolocation and time-of-day baseline directly
evaluates whether the access deviates from normal behavior. Web browsing history, database records, and email
checks are supplementary and do not directly confirm credential misuse.
Q4 Question 4 of 100
A threat hunting team at a healthcare organization identifies an unknown process named 'svch0st.exe'
running from the temp directory on a critical server. The process is communicating with an external host
over HTTPS. Which of the following best describes the technique being used by the adversary?
A. Privilege escalation through token manipulation
B. Defense evasion through process masquerading
C. Lateral movement through remote services
D. Persistence through scheduled task creation
Correct Answer: B
Rationale:
Naming a malicious process to resemble a legitimate Windows process (svchost.exe) is a classic masquerading
technique used for defense evasion. This does not involve privilege escalation, lateral movement, or scheduled
tasks; its primary goal is to avoid detection by blending in.
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 3 of 52
, Q5 Question 5 of 100
A junior analyst is configuring a new SIEM correlation rule. The organization has experienced several
phishing campaigns that lead to credential harvesting. The analyst wants to detect when a single source
IP address successfully authenticates to more than five different user accounts within a ten-minute
window. Which SIEM feature should the analyst use?
A. Static threshold alerting on total login count
B. Time-based correlation with cardinality aggregation
C. Vulnerability scan integration with asset database
D. Threat intelligence feed auto-ingestion
Correct Answer: B
Rationale:
Time-based correlation with cardinality aggregation counts the number of unique (distinct) user accounts associated
with a single source IP within a defined time window, exactly matching the detection requirement. Static thresholds
count total events rather than unique accounts, and the other options are unrelated to this detection logic.
Q6 Question 6 of 100
A manufacturing company deploys an EDR solution across all endpoints. After two weeks, the SOC
team notices that several alerts were generated for 'suspicious PowerShell execution' on workstations in
the engineering department. Investigation reveals the scripts are part of a legitimate build automation
process. What is the best course of action?
A. Uninstall the EDR agent from engineering workstations to eliminate noise
B. Create an exclusion rule for the specific PowerShell scripts used in the build process
C. Disable PowerShell entirely on all engineering workstations
D. Ignore the alerts and rely on manual review only
Correct Answer: B
Rationale:
Creating a targeted exclusion for the known legitimate scripts reduces alert fatigue while preserving EDR visibility for
all other PowerShell activity. Uninstalling EDR removes all protection, disabling PowerShell breaks the build
process, and ignoring alerts risks missing real threats.
CompTIA CySA+ -- 2026/2027 | Passing Score: 75% | Page 4 of 52
