CompTIA CySA+ CS0-003 practice test

A SOC wants to reduce alert fatigue without missing confirmed malicious activity. Which actions are appropriate? (Choose two.)

Trap 1: Delete noisy detections permanently without review

Permanent deletion can blind the SOC.

Trap 2: Route every alert directly to executives

Executives need summarized risk, not raw alert streams.

A
Suppress alerts only with documented criteria and expiry
Time-bound suppression preserves governance.
B
Delete noisy detections permanently without review
Why wrong: Permanent deletion can blind the SOC.
C
Route every alert directly to executives
Why wrong: Executives need summarized risk, not raw alert streams.
D
Add enrichment such as asset criticality and threat-intel context
Enrichment helps analysts prioritize real risk.

Question 2hardmulti select

A host is suspected of running fileless malware. Which artefacts should be collected quickly? (Choose two.)

Trap 1: A list of cafeteria purchases

Purchases are unrelated to malware state.

Trap 2: A printed office map

The map does not preserve host compromise evidence.

A
Memory image or live response data
Fileless activity may exist mainly in memory.
B
Active network connections and running processes
Live state helps reconstruct behaviour.
C
A list of cafeteria purchases
Why wrong: Purchases are unrelated to malware state.
D
A printed office map
Why wrong: The map does not preserve host compromise evidence.

Question 3easymultiple choice

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is executive leadership, which content choice is most appropriate?

Trap 1: Raw packet captures from the scan

Raw packets belong in technical appendices if needed.

Trap 2: A list of analyst shift times only

Shift times do not convey business risk.

Trap 3: Every command the scanner executed

Command details are not executive-level material.

A
Raw packet captures from the scan
Why wrong: Raw packets belong in technical appendices if needed.
B
A list of analyst shift times only
Why wrong: Shift times do not convey business risk.
C
Every command the scanner executed
Why wrong: Command details are not executive-level material.
D
Business risk, customer impact assessment, remediation status, and remaining exposure
Executives need business impact and risk posture, not raw technical noise. The report should be tuned to executive leadership while preserving factual accuracy.

Question 4mediummultiple choice

A host alert shows certutil.exe downloading a file from an external URL, followed by execution from a user-writable directory. What should the analyst focus on? In the evidence source phase, Which evidence source best supports or refutes the detection?

Trap 1: Only check whether antivirus signatures are current

AV status does not explain this execution chain.

Trap 2: Reinstall the browser used by the user

The suspicious tool chain is certutil and process execution, not browser configuration.

Trap 3: Ignore it because certutil is signed by Microsoft

Signed administrative tools can still be abused by attackers.

A
Only check whether antivirus signatures are current
Why wrong: AV status does not explain this execution chain.
B
Reinstall the browser used by the user
Why wrong: The suspicious tool chain is certutil and process execution, not browser configuration.
C
Ignore it because certutil is signed by Microsoft
Why wrong: Signed administrative tools can still be abused by attackers.
D
Living-off-the-land binary misuse and the downloaded file's hash, origin, and child process
Certutil can be abused to download payloads; file and process context establishes whether execution is malicious.

Question 5hardmultiple choice

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Trap 1: Run disk cleanup to remove temporary files

Cleanup can destroy evidence and does not contain the threat.

Trap 2: Power off the machine immediately in every case

Powering off can destroy memory evidence and may not be the best first action when controlled isolation exists.

Trap 3: Allow the host to run until the next maintenance window

Confirmed active compromise requires timely containment.

A
Network-isolate the endpoint through EDR while preserving disk and memory evidence
EDR isolation limits attacker communication without immediately destroying volatile forensic context.
B
Run disk cleanup to remove temporary files
Why wrong: Cleanup can destroy evidence and does not contain the threat.
C
Power off the machine immediately in every case
Why wrong: Powering off can destroy memory evidence and may not be the best first action when controlled isolation exists.
D
Allow the host to run until the next maintenance window
Why wrong: Confirmed active compromise requires timely containment.

Question 6hardmultiple choice

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Trap 1: Remediate only vulnerabilities with vendor logos in the report

Vendor branding is irrelevant to risk.

Trap 2: Always sort only by CVSS base score

CVSS is useful but incomplete without exploitability and exposure.

Trap 3: Remediate alphabetically by CVE ID

CVE order has no risk meaning.

A
Remediate only vulnerabilities with vendor logos in the report
Why wrong: Vendor branding is irrelevant to risk.
B
Always sort only by CVSS base score
Why wrong: CVSS is useful but incomplete without exploitability and exposure.
C
Remediate alphabetically by CVE ID
Why wrong: CVE order has no risk meaning.
D
Prioritize the KEV/high-EPSS issue after confirming asset exposure
Known exploitation and likelihood can outweigh base CVSS in risk-based prioritization.