CySA+ mock exam: one timed shift

Key: C

1. AStoring the full decrypted payload keeps exactly the sensitive plaintext the question wants to avoid, even with role-based access.
2. BKeeping every metadata field in plaintext logs can still capture sensitive values such as full URLs, and it adds no protection.
3. CCorrect: The server name (SNI), the JA3 client fingerprint and the certificate fingerprint identify suspicious flows without payload content, and encryption at rest plus access audits protect what is stored.
4. DThese are the right fields, but without encryption or access auditing the stored indicators are left unprotected.

Key: D

1. AUSB installation does not scale to 800 endpoints, and daily full-privilege updates widen the attack surface instead of shrinking it.
2. BOne shared admin service account means a single stolen credential exposes every endpoint, including the domain controllers.
3. CGiving every installer domain admin rights hands out the most powerful credential in the environment during rollout.
4. DCorrect: Certificate-based enrollment proves each agent's identity, signed updates block tampered packages and least-privilege service accounts limit the damage if an agent is compromised.

Key: A

1. ACorrect: The parsed JSON leaves both IPs inside one Message string, so the SIEM has no source or destination IP field for the geolocation lookup to use.
2. BRisk scoring comes after enrichment, so a low score cannot explain missing geolocation data.
3. CEscalation routing decides who receives an alert; it does nothing to enrich the alert's fields.
4. DThe raw syslog line was ingested, as the Message field shows; the failure happened later, during parsing.

Key: B

1. AOnly one packet is larger with PSH-ACK flags; the regular pattern comes from the small, repeated SYN packets.
2. BCorrect: Small packets of the same size sent to the same destination about once a minute show the regular rhythm of automated beaconing.
3. CEvery flow goes to the same destination, 203.0.113.5, so random destinations do not fit the data.
4. DThe table shows small, one-way packets, while this option describes high-volume two-way bursts.

Key: B

1. Aapp-deployment-role updating a function from an internal IP, with MFA not applicable, is normal for a workload role.
2. BCorrect: user.asmith requested a session token from an external IP without MFA, which fits a stolen password or token being used from outside.
3. Cuser.jdoe signed in from an internal IP with MFA, which is the expected pattern.
4. Dservice-automation-role assuming a role from an internal address is routine machine activity.

Key: D

1. AThe signals do point to exfiltration, but briefing executives before you contain the hosts lets the data keep leaving while people talk.
2. BScheduled backups do not usually upload to rare domains or produce DNS TXT anomalies, so blaming backups ignores the evidence.
3. CThree separate data sources already agree, so waiting for more confirmation only gives the attacker more time to move data out.
4. DCorrect: archive staging on the endpoint, large uploads to rare domains and DNS TXT anomalies back each other up, so treat it as exfiltration, isolate the hosts and block the domains.

Key: D

1. ARegistry and process analysis looks for malware on an endpoint, but a malicious OAuth app works in the cloud with no code on the device.
2. BOn-premises firewall logs do not see traffic between the third-party app and the SaaS provider.
3. CRevoking the token may come later, but the question asks how to verify the grant, and isolating the endpoint assumes malware with no evidence.
4. DCorrect: Matching the grant time against the SaaS provider's own audit logs for bulk data exports or permission changes shows whether the app is actually misusing its access.

Key: B

1. AThe readable vendor domains show irregular, human-driven timing, which is what legitimate SaaS traffic looks like.
2. BCorrect: Random-looking domains with the same naming pattern, each contacted every 300 seconds exactly, combine DGA-style names with automated beaconing.
3. CHeavy traffic to one well-known domain such as mail.office-suite.example is normal SaaS use.
4. DIrregular timing to popular domains looks like human browsing, the opposite of beaconing.

Key: B

1. AMissing debugging tools would limit the analysis, but the real violation is that the payload runs next to production.
2. BCorrect: Corporate VDI is connected to the production network and shared resources, so opening the macro there could let malware spread; triage belongs in an isolated sandbox.
3. CNothing about VDI prevents the macro from reaching its C2 server, and that is part of the danger.
4. DHashing first is good practice, but skipping it does not break isolation the way running the file on a connected system does.