CompTIA CySA+ Practice Questions: Threat Management (CS0-003)

Question 1

Which attack involves injecting malicious scripts into trusted websites? (Q-627fe1)

Accepted Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Answer

Buffer Overflow

Answer

Man-in-the-Middle

Question 2

Which of the following is a post-exploitation framework? (Q-627fe3)

Accepted Answer

Metasploit

Answer

Snort

Answer

Nmap

Answer

Burp Suite

Question 3

What type of malware encrypts files and demands payment? (Q-924434)

Accepted Answer

Ransomware

Answer

Spyware

Answer

Trojan

Answer

Worm

Question 4

Which file format is MOST likely to contain a macro virus? (Q-627fe5)

Accepted Answer

.docx

Answer

.exe

Answer

.pdf

Answer

.jpg

Question 5

What does the 'A' in 'APT' stand for? (Q-924436)

Accepted Answer

Advanced

Answer

Automated

Answer

Anomalous

Answer

Aggregated

Question 6

What is the MAIN purpose of a honeypot? (Q-924439)

Accepted Answer

To attract and analyze attackers

Answer

To store backups

Answer

To encrypt traffic

Answer

To block DDoS attacks

Question 7

What does IOC stand for in threat intelligence? (Q-627feb)

Accepted Answer

Indicator of Compromise

Answer

Internet of Computers

Answer

Integrity of Code

Answer

Incident Operations Center

Question 8

What is the main risk of using default credentials? (Q-627fec)

Accepted Answer

Easy unauthorized access

Answer

Increased bandwidth usage

Answer

Data corruption

Answer

Software incompatibility

Question 9

Which attack intercepts communication between two parties? (Q-924445)

Accepted Answer

Man-in-the-Middle

Answer

Phishing

Answer

SQL Injection

Answer

Cross-Site Scripting

Question 10

Which type of testing involves simulating an attack without prior knowledge? (Q-924447)

Accepted Answer

Black-box testing

Answer

Vulnerability scanning

Answer

Penetration testing

Answer

White-box testing

Question 11

What does the 'D' in 'DDoS' stand for? (Q-627ff3)

Accepted Answer

Distributed

Answer

Data

Answer

Dynamic

Answer

Domain

Question 12

Which of the following is a key characteristic of heuristic analysis in antivirus software? (Q-924450)

Accepted Answer

It uses behavioral patterns to identify new threats

Answer

It only detects known malware signatures

Answer

It requires daily database updates

Answer

It cannot detect zero-day exploits

Question 13

What is the primary purpose of a sandbox in malware analysis? (Q-627ff4)

Accepted Answer

To isolate and observe suspicious code execution

Answer

To permanently delete malicious files

Answer

To encrypt sensitive documents

Answer

To speed up network traffic

Question 14

What is the PRIMARY goal of penetration testing? (Q-627ff6)

Accepted Answer

To identify and exploit vulnerabilities

Answer

To achieve 100% system uptime

Answer

To train employees on phishing

Answer

To document compliance

Question 15

Which tool would you use to analyze memory dumps for malware? (Q-924454)

Accepted Answer

Volatility

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 16

Which attack exploits session management vulnerabilities? (Q-924455)

Accepted Answer

Session hijacking

Answer

SQL Injection

Answer

Phishing

Answer

DDoS

Question 17

Which attack involves overwhelming a service with fake requests? (Q-924459)

Accepted Answer

DDoS

Answer

Phishing

Answer

Man-in-the-Middle

Answer

SQL Injection

Question 18

Which of the following is an example of social engineering? (Q-924461)

Accepted Answer

Phishing email

Answer

DDoS attack

Answer

SQL injection

Answer

Zero-day exploit

Question 19

Which attack involves modifying data in transit? (Q-924463)

Accepted Answer

Man-in-the-Middle

Answer

DoS

Answer

Phishing

Answer

Brute force

Question 20

Which type of malware replicates itself across networks? (Q-924466)

Accepted Answer

Worm

Answer

Trojan

Answer

Spyware

Answer

Ransomware

Question 21

Which tool is used for password cracking? (Q-924468)

Accepted Answer

John the Ripper

Answer

Nmap

Answer

Wireshark

Answer

Snort

Question 22

Which tool is used for intercepting HTTP traffic? (Q-924473)

Accepted Answer

Burp Suite

Answer

Nmap

Answer

Nessus

Answer

Metasploit

Question 23

Which attack involves manipulating database queries? (Q-924475)

Accepted Answer

SQL injection

Answer

XSS

Answer

DDoS

Answer

Phishing

Question 24

What is the PRIMARY purpose of a threat feed? (Q-628016)

Accepted Answer

To provide real-time threat intelligence

Answer

To store backups

Answer

To encrypt data

Answer

To train employees

Question 25

What is the MAIN purpose of a red team exercise? (Q-628017)

Accepted Answer

To simulate adversarial attacks

Answer

To audit compliance

Answer

To train employees on phishing

Answer

To patch vulnerabilities

Question 26

Which of the following is a key characteristic of a fileless malware attack? (Q-924481)

Accepted Answer

It resides only in memory

Answer

It modifies system registry entries

Answer

It requires physical access

Answer

It encrypts entire hard drives

Question 27

Which tool would you use to analyze a suspicious PowerShell script? (Q-924483)

Accepted Answer

PowerShell ISE

Answer

Volatility

Answer

Nmap

Answer

Wireshark

Question 28

What is the MAIN security concern with IoT devices? (Q-628025)

Accepted Answer

Default credentials and weak patching

Answer

High cost

Answer

Large storage capacity

Answer

Complex user interfaces

Question 29

What is the PRIMARY purpose of a purple team exercise? (Q-628026)

Accepted Answer

To improve collaboration between red/blue teams

Answer

To test physical security controls

Answer

To audit compliance documents

Answer

To encrypt backup files

Question 30

What is the MAIN security risk of QR codes? (Q-628029)

Accepted Answer

Phishing via obscured URLs

Answer

Data corruption

Answer

High bandwidth usage

Answer

Software incompatibility

Question 31

Which of the following is a characteristic of a supply chain attack? (Q-924494)

Accepted Answer

Targets software vendors to compromise downstream users

Answer

Only affects physical hardware shipments

Answer

Requires physical access to networks

Answer

Is prevented by antivirus software

Question 32

What is the PRIMARY purpose of a reverse shell? (Q-628032)

Accepted Answer

To bypass firewalls for command execution

Answer

To encrypt outbound traffic

Answer

To block DDoS attacks

Answer

To validate TLS certificates

Question 33

Which of the following is a characteristic of a watering hole attack? (Q-924498)

Accepted Answer

Targets specific websites frequented by victims

Answer

Requires physical access to networks

Answer

Only affects mobile devices

Answer

Is prevented by spam filters

Question 34

Which tool would you use to analyze suspicious PDF files? (Q-924502)

Accepted Answer

PDFid

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 35

Which of the following is a characteristic of a pass-the-hash attack? (Q-924504)

Accepted Answer

Uses password hashes instead of plaintext passwords

Answer

Requires physical access to workstations

Answer

Only affects Linux systems

Answer

Is prevented by antivirus software

Question 36

Which of the following is a characteristic of a living-off-the-land (LOTL) attack? (Q-924508)

Accepted Answer

Leverages legitimate system tools

Answer

Uses only custom malware

Answer

Requires physical access

Answer

Is prevented by spam filters

Question 37

Which of the following is a characteristic of a golden ticket attack? (Q-924512)

Accepted Answer

Uses forged Kerberos tickets

Answer

Targets only Linux systems

Answer

Requires physical smart cards

Answer

Is prevented by antivirus

Question 38

Which of the following BEST describes a cold boot attack? (Q-924514)

Accepted Answer

Stealing encryption keys from RAM after power loss

Answer

Exploiting a system during its startup process

Answer

Overloading a server with repeated restart commands

Answer

Intercepting data during a graceful shutdown

Question 39

Which of the following is a characteristic of a DLL sideloading attack? (Q-924515)

Accepted Answer

Exploits trusted application directories

Answer

Requires physical access to systems

Answer

Only affects Linux systems

Answer

Is prevented by spam filters

Question 40

Which of the following is a characteristic of a reflective amplification attack? (Q-924518)

Accepted Answer

Uses third-party servers to multiply traffic

Answer

Targets only wireless networks

Answer

Requires physical access to routers

Answer

Is prevented by antivirus software

Question 41

Which of the following is a characteristic of a pass-the-ticket attack? (Q-924522)

Accepted Answer

Uses stolen Kerberos tickets

Answer

Requires physical smart cards

Answer

Only affects Linux systems

Answer

Is prevented by spam filters

Question 42

Which of the following is a characteristic of a golden SAML attack? (Q-924526)

Accepted Answer

Forges authentication assertions

Answer

Targets only Linux systems

Answer

Requires physical access

Answer

Is prevented by antivirus

Question 43

Which of the following is a characteristic of a golden ticket attack? (Q-924530)

Accepted Answer

Uses forged Kerberos tickets

Answer

Targets only Linux systems

Answer

Requires physical smart cards

Answer

Is prevented by antivirus

Question 44

Which of the following is a characteristic of a pass-the-hash attack? (Q-924532)

Accepted Answer

Uses password hashes instead of plaintext passwords

Answer

Requires physical access to workstations

Answer

Only affects Linux systems

Answer

Is prevented by antivirus software

Question 45

Which of the following is a characteristic of a living-off-the-land (LOTL) attack? (Q-924536)

Accepted Answer

Leverages legitimate system tools

Answer

Uses only custom malware

Answer

Requires physical access

Answer

Is prevented by spam filters

Question 46

Which of the following is a characteristic of a golden ticket attack? (Q-924540)

Accepted Answer

Uses forged Kerberos tickets

Answer

Targets only Linux systems

Answer

Requires physical smart cards

Answer

Is prevented by antivirus

Question 47

Which of the following is a characteristic of a pass-the-hash attack? (Q-924542)

Accepted Answer

Uses password hashes instead of plaintext passwords

Answer

Requires physical access to workstations

Answer

Only affects Linux systems

Answer

Is prevented by antivirus

Question 48

Which of the following is a characteristic of a living-off-the-land (LOTL) attack? (Q-924546)

Accepted Answer

Leverages legitimate system tools

Answer

Uses only custom malware

Answer

Requires physical access

Answer

Is prevented by spam filters

Question 49

Which of the following is a characteristic of a golden ticket attack? (Q-924550)

Accepted Answer

Uses forged Kerberos tickets

Answer

Targets only Linux systems

Answer

Requires physical smart cards

Answer

Is prevented by antivirus

Question 50

Which attack technique involves an adversary using legitimate credentials to move from one system to another within a network?

Accepted Answer

Lateral movement

Answer

Privilege escalation

Answer

Persistence

Answer

Exfiltration

Question 51

A threat hunter starts with the idea that attackers may abuse PowerShell remoting. What is this starting point called?

Accepted Answer

Hypothesis

Answer

Hash collision

Answer

Patch window

Answer

Evidence locker

Question 52

Mapping an attacker technique to T1059 helps align findings with which framework?

Accepted Answer

MITRE ATT&CK

Answer

ISO OSI

Answer

PCI DSS payment categories

Answer

ITIL change states

Question 53

Which term describes a collection of related incidents likely caused by the same adversary campaign?

Accepted Answer

Case or campaign cluster

Answer

Disk stripe

Answer

Broadcast domain

Answer

Print queue

CompTIA CySA+ Practice Questions: Threat Management

Q1. Which attack involves injecting malicious scripts into trusted websites? (Q-627fe1)

Q2. Which of the following is a post-exploitation framework? (Q-627fe3)

Q3. What type of malware encrypts files and demands payment? (Q-924434)

Q4. Which file format is MOST likely to contain a macro virus? (Q-627fe5)

Q5. What does the 'A' in 'APT' stand for? (Q-924436)

Q6. What is the MAIN purpose of a honeypot? (Q-924439)

Q7. What does IOC stand for in threat intelligence? (Q-627feb)

Q8. What is the main risk of using default credentials? (Q-627fec)

Q9. Which attack intercepts communication between two parties? (Q-924445)

Q10. Which type of testing involves simulating an attack without prior knowledge? (Q-924447)

Q11. What does the 'D' in 'DDoS' stand for? (Q-627ff3)

Q12. Which of the following is a key characteristic of heuristic analysis in antivirus software? (Q-924450)

Q13. What is the primary purpose of a sandbox in malware analysis? (Q-627ff4)

Q14. What is the PRIMARY goal of penetration testing? (Q-627ff6)

Q15. Which tool would you use to analyze memory dumps for malware? (Q-924454)

Q16. Which attack exploits session management vulnerabilities? (Q-924455)

Q17. Which attack involves overwhelming a service with fake requests? (Q-924459)

Q18. Which of the following is an example of social engineering? (Q-924461)

Q19. Which attack involves modifying data in transit? (Q-924463)

Q20. Which type of malware replicates itself across networks? (Q-924466)

Q21. Which tool is used for password cracking? (Q-924468)

Q22. Which tool is used for intercepting HTTP traffic? (Q-924473)

Q23. Which attack involves manipulating database queries? (Q-924475)

Q24. What is the PRIMARY purpose of a threat feed? (Q-628016)

Q25. What is the MAIN purpose of a red team exercise? (Q-628017)

Q26. Which of the following is a key characteristic of a fileless malware attack? (Q-924481)

Q27. Which tool would you use to analyze a suspicious PowerShell script? (Q-924483)

Q28. What is the MAIN security concern with IoT devices? (Q-628025)

Q29. What is the PRIMARY purpose of a purple team exercise? (Q-628026)

Q30. What is the MAIN security risk of QR codes? (Q-628029)

Q31. Which of the following is a characteristic of a supply chain attack? (Q-924494)

Q32. What is the PRIMARY purpose of a reverse shell? (Q-628032)

Q33. Which of the following is a characteristic of a watering hole attack? (Q-924498)

Q34. Which tool would you use to analyze suspicious PDF files? (Q-924502)

Q35. Which of the following is a characteristic of a pass-the-hash attack? (Q-924504)

Q36. Which of the following is a characteristic of a living-off-the-land (LOTL) attack? (Q-924508)

Q37. Which of the following is a characteristic of a golden ticket attack? (Q-924512)

Q38. Which of the following BEST describes a cold boot attack? (Q-924514)

Q39. Which of the following is a characteristic of a DLL sideloading attack? (Q-924515)

Q40. Which of the following is a characteristic of a reflective amplification attack? (Q-924518)

Q41. Which of the following is a characteristic of a pass-the-ticket attack? (Q-924522)

Q42. Which of the following is a characteristic of a golden SAML attack? (Q-924526)

Q43. Which of the following is a characteristic of a golden ticket attack? (Q-924530)

Q44. Which of the following is a characteristic of a pass-the-hash attack? (Q-924532)

Q45. Which of the following is a characteristic of a living-off-the-land (LOTL) attack? (Q-924536)

Q46. Which of the following is a characteristic of a golden ticket attack? (Q-924540)

Q47. Which of the following is a characteristic of a pass-the-hash attack? (Q-924542)

Q48. Which of the following is a characteristic of a living-off-the-land (LOTL) attack? (Q-924546)

Q49. Which of the following is a characteristic of a golden ticket attack? (Q-924550)

Q50. Which attack technique involves an adversary using legitimate credentials to move from one system to another within a network?

Q51. A threat hunter starts with the idea that attackers may abuse PowerShell remoting. What is this starting point called?

Q52. Mapping an attacker technique to T1059 helps align findings with which framework?

Q53. Which term describes a collection of related incidents likely caused by the same adversary campaign?

More CompTIA CySA+ practice topics