Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. CompTIA
  5. CS0-003

CompTIA CS0-003 Exam Questions
CompTIA CySA+ (CS0-003) (Page 4 )

Updated On: 21-Feb-2026
Page 4 of 96
PDF with 533 Questions

An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack.
Which of the following logs should the team review first?

  1. CDN
  2. Vulnerability scanner
  3. DNS
  4. Web server

Answer(s): C



A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack.
Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

  1. Weaponization
  2. Reconnaissance
  3. Delivery
  4. Exploitation

Answer(s): D



An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets.
Which of the following steps of an attack framework is the analyst witnessing?

  1. Exploitation
  2. Reconnaissance
  3. Command and control
  4. Actions on objectives

Answer(s): B



An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country.
Which of the following best describes what is happening? (Choose two.)

  1. Beaconing
  2. Domain Name System hijacking
  3. Social engineering attack
  4. On-path attack
  5. Obfuscated links
  6. Address Resolution Protocol poisoning

Answer(s): C,E



During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application.
Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

  1. Conduct regular red team exercises over the application in production
  2. Ensure that all implemented coding libraries are regularly checked
  3. Use application security scanning as part of the pipeline for the CI/CD flow
  4. Implement proper input validation for any data entry form

Answer(s): C






Post your Comments and Discuss CompTIA CS0-003 exam dumps with other Community members:

Join the CS0-003 Discussion