CySA+ practice test

Key: D

1. AA common JA3 fingerprint, a certificate from a known CA and a recognized vendor CDN all match normal traffic, so this flow is low priority.
2. BA JA3 fingerprint already classed as benign with a trusted certificate is the least suspicious entry in the table.
3. CMail to the company's own domain over a wildcard certificate is expected business traffic, and its size alone is not an indicator.
4. DCorrect: a rare JA3 fingerprint plus a self-signed certificate and a suspicious SNI are the strongest malicious-TLS signals here, so this flow earns the costly decryption first.

Key: B

1. AThe asset is a database server, so cloud object storage access logs say nothing about how it would be attacked.
2. BCorrect: an internet-facing critical data store needs authentication logs to catch credential abuse and EDR process telemetry to catch host compromise.
3. CWorkstation EDR would watch the low-criticality dev workstation while the public database that needs priority stays uncovered.
4. DApplication performance metrics track availability and speed; they record no security events such as logins or malicious processes.

Key: B

1. AHostB queries two different domains at irregular times, which looks like ordinary client activity rather than a timed callback.
2. BCorrect: HostA queries the same domain at exact 60-second intervals and ignores its own 300-second TTL cache, a regular cadence typical of beaconing.
3. COnly HostA shows periodic timing; HostB has no fixed interval or repeated destination.
4. DHostA's fixed interval to one domain is a clear beaconing pattern, so saying neither host is suspicious misses it.

Key: D

1. ANo database reader role appears in the log, and a trust policy is a configuration setting that cannot by itself show a bypass happened.
2. BEvt_2 used MFA and targets a read-only audit role, which matches the intended trust relationship.
3. CEvt_3 also presented MFA, so nothing in the log shows the trust policy being bypassed.
4. DCorrect: Evt_1 shows an external account assuming Prod_Admin with no MFA, which violates the policy that requires MFA for external accounts.

Key: D

1. AActivity confined to business hours is normal, and nothing in the log ties time of day to exfiltration.
2. BRandom endpoints with widely varying sizes do not match the log, which shows two fixed URIs and similar byte counts.
3. CThe log contains no user-agent field, and changing user agents point to scraping or evasion rather than cookie-based exfiltration.
4. DCorrect: a fixed session value with a steadily incrementing ID and near-identical upload sizes suggests data is being sent out in sequenced chunks.

Key: A

1. ACorrect: an SSH login from an internal subnet never seen before, at 2 a.m., fits a host-to-host pivot and is suspicious even without canonical host fields.
2. BAn Okta login through the corporate VPN in the morning is the normal remote-work pattern and shows no movement between internal hosts.
3. CA login from the headquarters IP during business hours is the expected baseline for that user.
4. DSSH from a known jump host during the day is the sanctioned administrative path, so it does not indicate lateral movement.

Key: D

1. AA public code-hosting site over 443 is a common, reputable destination and typical background traffic for a sandboxed machine.
2. BA well-known search portal over 443 is ordinary browser or operating-system background traffic in a sandbox capture.
3. CThe operating system's connectivity check over port 80 runs on every boot, so it is expected noise.
4. DCorrect: an unfamiliar update host that belongs to no known vendor, on a nonstandard port (8080) and contacted right after detonation, is the classic profile of a C2 callback.

Key: C

1. ABlocking the internal IP before checking for a legitimate cause can break production workflows, including replication itself.
2. BTreating the spike as malicious without validation skips triage and risks declaring an incident over a false positive.
3. CCorrect: confirming whether native cross-region replication explains the traffic rules out a common benign cause before escalating.
4. DIsolating the buckets is a disruptive containment step; it belongs after confirmation, and triage still has to happen first.

Key: A

1. ACorrect: H-1's configuration edit at 01:45 falls outside its approved 03:00–05:00 window, so it is unapproved and needs escalation.
2. BH-11's service stop at 02:15 falls inside its 02:00–04:00 maintenance window, so it matches approved change.
3. CH-13's service stop at 03:10 falls inside its 03:00–05:00 window, so it is expected.
4. DH-14's configuration edit at 02:50 falls inside its 02:00–04:00 window, so it is expected.