CompTIA CySA+ Security Operations and Monitoring Practice Questions

Question 1

What does a SIEM correlation rule detecting 'multiple failed logins followed by a successful login' MOST likely indicate?

Accepted Answer

Brute force attack

Answer

Normal user behavior

Answer

Password spraying attack

Answer

Credential stuffing

Question 2

What is the PRIMARY purpose of performing threat hunting in a SIEM?

Accepted Answer

To proactively search for undetected threats

Answer

To respond to known alerts

Answer

To generate compliance reports

Answer

To monitor system performance

Question 3

Which log source would be MOST valuable for investigating a suspected DNS exfiltration attempt?

Accepted Answer

DNS server query logs

Answer

Firewall logs

Answer

Windows event logs

Answer

Authentication logs

Question 4

What does a sudden increase in NetFlow data to an external IP address MOST likely indicate?

Accepted Answer

Data exfiltration

Answer

Normal backup process

Answer

Software update

Answer

VPN connection

Question 5

What is the PRIMARY benefit of implementing a deception technology solution?

Accepted Answer

Early detection of active attackers

Answer

Preventing all attacks

Answer

Reducing firewall rules

Answer

Automating patching

Question 6

During log analysis, you notice multiple Event ID 4672 entries followed by PsExec execution. What does this MOST likely indicate?

Accepted Answer

Lateral movement attempt

Answer

Normal administrative activity

Answer

Scheduled task execution

Answer

Software installation

Question 7

What does a SIEM alert showing 'unusual geolocation login' MOST likely indicate?

Accepted Answer

Compromised credentials

Answer

VPN usage

Answer

New branch office

Answer

Cloud migration

Question 8

When reviewing IDS alerts, which pattern would MOST likely indicate a port scan?

Accepted Answer

Multiple SYN packets to sequential ports

Answer

Single packet to one port

Answer

Established TCP connections

Answer

UDP broadcasts

Question 9

What does a sudden spike in DNS queries for random subdomains MOST likely indicate?

Accepted Answer

Domain generation algorithm

Answer

New website launch

Answer

DNS exfiltration

Answer

Misconfigured resolver

Question 10

Which log would be MOST useful for investigating a potential brute force attack against a web application?

Accepted Answer

Web server logs

Answer

DNS logs

Answer

NetFlow data

Answer

Firewall logs

Question 11

What is the PRIMARY benefit of implementing canary tokens in a network?

Accepted Answer

Early detection of unauthorized access

Answer

Preventing data breaches

Answer

Improving network performance

Answer

Automating patching

Question 12

What does a SIEM correlation rule detecting 'RDP connections followed by unusual process execution' MOST likely indicate?

Accepted Answer

Lateral movement

Answer

Normal administrative activity

Answer

Scheduled maintenance

Answer

Software deployment

Question 13

Which technique would be MOST effective for detecting credential dumping activity?

Accepted Answer

Monitoring for LSASS memory access

Answer

Analyzing DNS queries

Answer

Reviewing firewall logs

Answer

Checking CPU usage

Question 14

When analyzing packet captures, what would a large number of TCP SYN packets without corresponding ACKs MOST likely indicate?

Accepted Answer

SYN flood attack

Answer

Normal TCP handshakes

Answer

Network congestion

Answer

Misconfigured firewall

Question 15

Which Windows Event Log would contain information about account lockouts?

Accepted Answer

Security

Answer

System

Answer

Application

Answer

Setup

Question 16

What does the presence of unexpected PowerShell scripts in TEMP directories MOST likely indicate?

Accepted Answer

Malicious script execution

Answer

Normal Windows maintenance

Answer

Software installation

Answer

Backup process

Question 17

Which technique would be MOST effective for detecting DNS tunneling?

Accepted Answer

Analyzing query lengths and frequencies

Answer

Blocking all external DNS

Answer

Disabling DNS caching

Answer

Monitoring TCP connections

Question 18

What does a sudden increase in GPO modifications MOST likely indicate?

Accepted Answer

Potential compromise of domain admin

Answer

Normal domain maintenance

Answer

Policy update rollout

Answer

New server deployment

Question 19

Which log source would be MOST valuable for investigating a suspected insider threat?

Accepted Answer

Data loss prevention logs

Answer

DNS logs

Answer

Switch logs

Answer

CPU utilization logs

Question 20

What is the PRIMARY purpose of a threat intelligence feed in a SIEM?

Accepted Answer

To provide context for detected indicators

Answer

To reduce storage requirements

Answer

To replace all correlation rules

Answer

To encrypt log data

Question 21

Which technique would be MOST effective for detecting beaconing malware?

Accepted Answer

Analyzing periodic outbound connections

Answer

Monitoring CPU usage

Answer

Checking file hashes

Answer

Reviewing login times

Question 22

What does the presence of unexpected scheduled tasks with obfuscated commands MOST likely indicate?

Accepted Answer

Persistence mechanism

Answer

Normal system maintenance

Answer

Backup process

Answer

Software update

Question 23

What is the PRIMARY benefit of network segmentation for incident response?

Accepted Answer

Containing lateral movement

Answer

Improving network speed

Answer

Reducing firewall rules

Answer

Simplifying logging

Question 24

When reviewing proxy logs, what would a high volume of requests to pastebin.com MOST likely indicate?

Accepted Answer

Data exfiltration

Answer

Normal research activity

Answer

Software updates

Answer

Web development

Question 25

What does a SIEM alert for 'unusual after-hours file access' MOST likely indicate?

Accepted Answer

Compromised credentials

Answer

Scheduled backup

Answer

System maintenance

Answer

Automated process

Question 26

Which technique would be MOST effective for detecting process hollowing?

Accepted Answer

Analyzing memory structures

Answer

Checking file hashes

Answer

Monitoring CPU usage

Answer

Reviewing scheduled tasks

Question 27

When analyzing NetFlow data, what would a spike in traffic to TCP port 3389 MOST likely indicate?

Accepted Answer

RDP brute force attempts

Answer

Increased web traffic

Answer

Email server usage

Answer

DNS amplification

Question 28

What does the presence of unexpected WMI event subscriptions MOST likely indicate?

Accepted Answer

Persistence mechanism

Answer

Normal system monitoring

Answer

Software installation

Answer

Performance tuning

Question 29

Which technique would be MOST effective for detecting C2 traffic in encrypted channels?

Accepted Answer

Analyzing JA3/JA3S fingerprints

Answer

Decrypting all traffic

Answer

Blocking all encrypted traffic

Answer

Checking file hashes

Question 30

When reviewing authentication logs, what would multiple failed NTLM logins followed by a successful Kerberos login MOST likely indicate?

Accepted Answer

Password spray attack

Answer

Normal user behavior

Answer

System misconfiguration

Answer

Token replay attack

Question 31

What does a SIEM alert for 'unusual PowerShell command-line length' MOST likely indicate?

Accepted Answer

Obfuscated malicious script

Answer

Normal administrative task

Answer

Software installation

Answer

System update

Question 32

Which technique would be MOST effective for detecting DLL side-loading?

Accepted Answer

Analyzing DLL load paths

Answer

Checking file hashes

Answer

Monitoring CPU usage

Answer

Reviewing firewall logs

CompTIA CySA+ Practice Questions: Security Operations and Monitoring

Q1. What does a SIEM correlation rule detecting 'multiple failed logins followed by a successful login' MOST likely indicate?

Q2. What is the PRIMARY purpose of performing threat hunting in a SIEM?

Q3. Which log source would be MOST valuable for investigating a suspected DNS exfiltration attempt?

Q4. What does a sudden increase in NetFlow data to an external IP address MOST likely indicate?

Q5. What is the PRIMARY benefit of implementing a deception technology solution?

Q6. During log analysis, you notice multiple Event ID 4672 entries followed by PsExec execution. What does this MOST likely indicate?

Q7. What does a SIEM alert showing 'unusual geolocation login' MOST likely indicate?

Q8. When reviewing IDS alerts, which pattern would MOST likely indicate a port scan?

Q9. What does a sudden spike in DNS queries for random subdomains MOST likely indicate?

Q10. Which log would be MOST useful for investigating a potential brute force attack against a web application?

Q11. What is the PRIMARY benefit of implementing canary tokens in a network?

Q12. What does a SIEM correlation rule detecting 'RDP connections followed by unusual process execution' MOST likely indicate?

Q13. Which technique would be MOST effective for detecting credential dumping activity?

Q14. When analyzing packet captures, what would a large number of TCP SYN packets without corresponding ACKs MOST likely indicate?

Q15. Which Windows Event Log would contain information about account lockouts?

Q16. What does the presence of unexpected PowerShell scripts in TEMP directories MOST likely indicate?

Q17. Which technique would be MOST effective for detecting DNS tunneling?

Q18. What does a sudden increase in GPO modifications MOST likely indicate?

Q19. Which log source would be MOST valuable for investigating a suspected insider threat?

Q20. What is the PRIMARY purpose of a threat intelligence feed in a SIEM?

Q21. Which technique would be MOST effective for detecting beaconing malware?

Q22. What does the presence of unexpected scheduled tasks with obfuscated commands MOST likely indicate?

Q23. What is the PRIMARY benefit of network segmentation for incident response?

Q24. When reviewing proxy logs, what would a high volume of requests to pastebin.com MOST likely indicate?

Q25. What does a SIEM alert for 'unusual after-hours file access' MOST likely indicate?

Q26. Which technique would be MOST effective for detecting process hollowing?

Q27. When analyzing NetFlow data, what would a spike in traffic to TCP port 3389 MOST likely indicate?

Q28. What does the presence of unexpected WMI event subscriptions MOST likely indicate?

Q29. Which technique would be MOST effective for detecting C2 traffic in encrypted channels?

Q30. When reviewing authentication logs, what would multiple failed NTLM logins followed by a successful Kerberos login MOST likely indicate?

Q31. What does a SIEM alert for 'unusual PowerShell command-line length' MOST likely indicate?

Q32. Which technique would be MOST effective for detecting DLL side-loading?

More CompTIA CySA+ practice topics