10 free CompTIA CySA+ CS0-003 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 627 questions. Work through them, then open each answer to check your reasoning.
Get all 627 questions (US$39) · Download these 10 as a PDF
Question 1
A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability.
Which of the following CVE metrics would be most accurate for this zero-day threat?
Show answer and explanation
Correct answer: A. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The described threat is remotely exploitable, needs no privileges and no user interaction, and impacts confidentiality and integrity heavily while leaving availability untouched. Option A maps exactly to that profile: AV:N (network attack vector, consistent with active remote exploitation), AC:L (low complexity, as seen with a zero-day being exploited at scale), PR:N (no privilege escalation required), UI:N (no user interaction), S:U (unchanged scope), C:H and I:H (significant confidentiality and integrity loss), and A:N (no availability impact). No other vector combines all of these values.
Why the other options are wrong
- B. It requires high privileges (PR:H) and user interaction (UI:R), and it lists an availability impact (A:L), contradicting the scenario.
- C. It requires user interaction (UI:R), understates confidentiality loss (C:L), and adds a high availability impact the scenario says does not exist.
- D. It restricts the attack to local access (AV:L), requires privileges and user interaction, and shows high availability impact with only low integrity impact.
Question 2
Which of the following tools would work best to prevent the exposure of PII outside of an organization?
Show answer and explanation
Correct answer: D. DLP
Data Loss Prevention (DLP) is specifically designed to monitor, detect, and prevent unauthorized transmission of sensitive information including PII outside organizational boundaries. DLP tools scan data in motion and at rest to enforce policies against exfiltration. PAM manages privileged access, IDS detects intrusions, and PKI manages encryption, none are designed to specifically prevent PII exposure.
Why the other options are wrong
- A. PAM controls privileged account access but doesn't prevent data exfiltration
- B. IDS detects network intrusions but doesn't prevent sensitive data disclosure
- C. PKI manages certificates and encryption but doesn't monitor for data exposure
Question 3
An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:
Which of the following tuning recommendations should the security analyst share?
Show answer and explanation
Correct answer: C. Configure an Access-Control-Allow-Origin header to authorized domains
The assessment results show 'Cross-Domain Misconfiguration (34)' as a critical alert, indicating improper handling of cross-origin requests. The proper remediation for cros-omain issues is to configure the Access-Control-Allow-Origin header to specify only authorized domains, which controls which origins can access resources and prevents unauthorized cross-domain access. This directly addresses the misconfiguration vulnerability without blocking legitimate cross-domain communication.
Why the other options are wrong
- A. HttpOnly flag is for cookies and HTTPS is enforced by Strict-Transport-Security; this doesn't address cross-domain misconfiguration issues.
- B. X-Frame-Options prevents clickjacking (separate alert exists for missing ant-lickjacking header) and doesn't resolve cross-domain misconfiguration.
- D. Disabling CORS entirely is overly restrictive; the proper fix is to configure it correctly for authorized domains rather than disable it completely.
Question 4
Which of the following items should be included in a vulnerability scan report? (Choose two.)
Show answer and explanation
Correct answer: D, E
D. Affected hosts E. Risk score Affected hosts (D) and risk scores (E) are essential components of vulnerability scan reports as they identify which systems are vulnerable and prioritize remediation efforts. Lessons learned, playbooks, SLAs, and education plans are post-scan activities or separate documentation components, not standard elements of the scan report itself.
Why the other options are wrong
- A. Lessons learned are derived after remediation, not part of initial scan output
- B. SLAs are contractual terms, not vulnerability scan data
- C. Playbooks are incident response procedures, not scan report contents
- F. Education plans are developed separately from technical scan results
Question 5
The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released.
Which of the following would best protect this organization?
Show answer and explanation
Correct answer: A. A mean time to remediate of 30 days
Exploitation typically begins about 45 days after a patch is released, so a 30-day mean time to remediate (MTTR) closes the exposure window first. MTTR tracks completed remediation, so it is the metric that actually gets patches onto systems inside the threat window. The other options meet or exceed 45 days, measure only reaction speed, or delay installation.
Why the other options are wrong
- B. A 45-day mean time to detect matches the exploitation timeline, so attacks land first
- C. Mean time to respond gauges reaction speed, not whether the patch is deployed
- D. Third-party testing delays deployment, extending exposure
Question 6
A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:
Which of the following scripting languages was used in the script?
Show answer and explanation
Correct answer: A. PowerShell
The script uses PowerShell-specific cmdlets and syntax including Get-ADUser, Ad-DGroupMember, Set-ADUser with the -Replace parameter, and the foreach loop structure with parentheses around the collection. These are characteristic PowerShell commands for Active Directory management. The use of Get-Content with .this.txt file reading and piping to foreach, combined with AD-specific cmdlets, are distinctly PowerShell constructs.
Why the other options are wrong
- B. Ruby would use different syntax for loops (each do..end) and would not have native Active Directory cmdlets like Get-ADUser.
- C. Python would use 'for user in' syntax and would require importing modules rather than having built-in AD cmdlets.
- D. Shell script would use different loop syntax (for in, while) and would not have these PowerShell AD cmdlets available.
Question 7
A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS.
Which of the following most likely describes the observed activity?
Show answer and explanation
Correct answer: B. An on-path attack is being performed by someone with internal access that forces users into port 80
An on-path attacker with internal access can intercept HTTPS requests and force downgrade to HTTP (port 80), which explains why users intermittently see both HTTP and HTTPS access. This is consistent with compromised user accounts and represents an active man-in-the-middle attack. SSL certificate issues would cause complete unavailability, load balancing wouldn't downgrade protocols, and BGP changes don't affect individual user protocol selection.
Why the other options are wrong
- A. SSL certificate issues cause consistent HTTPS failures, not intermittent switching between protocols
- C. Web servers under load use internal queuing, not protocol downgrade to HTTP
- D. BGP operates at network routing layer and doesn't control application-layer protocol selection
Question 8
A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:
Security Policy 1006: Vulnerability Management
1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.
2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.
3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.
According to the security policy, which of the following vulnerabilities should be the highest priority to patch?
Show answer and explanation
Question 9
Which of the following will most likely ensure that mission-critical services are available in the event of an incident?
Show answer and explanation
Correct answer: A. Business continuity plan
A business continuity plan identifies mission-critical functions and defines the processes, alternate sites, and workarounds that keep services running during a disruption. That makes continuity planning the direct answer; recovery and preventive plans only support it.
Why the other options are wrong
- B. Vulnerability management reduces incident likelihood, not availability during one
- C. Disaster recovery restores systems and data after a disruption
- D. Asset management tracks and classifies resources, not service availability
Question 10
The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization.
Which of the following solutions will assist in reducing the risk?
Show answer and explanation
Correct answer: A. Deploy a CASB and enable policy enforcement
A Cloud Access Security Broker (CASB) with policy enforcement provides visibility into shadow IT cloud applications and enforces organizational security policies, data protection rules, and compliance controls. CASBs monitor and block unauthorized cloud use while allowing sanctioned applications. MFA, API gateways, and SSO improve security but don't specifically eliminate shadow IT or reduce the risk of unsanctioned cloud applications.
Why the other options are wrong
- B. MFA secures authentication but doesn't prevent unauthorized cloud application use
- C. API gateways manage API access but don't address shadow IT cloud application discovery and control
- D. SSO improves authentication but doesn't prevent employees from using unsanctioned cloud services
That was 10 of 627.
The full CompTIA CySA+ CS0-003 pack has all 627 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.