CySA+ Difficulty Level 1 — Questions and Answers
Question 1: Basic: Which of the following best describes a brute force attack?
- Exploiting a software vulnerability to gain unauthorized access
- Flooding a system with traffic to overwhelm it
- Attempting all possible password combinations to gain access (Correct answer)
- Impersonating a trusted entity to steal information
Correct answer: Attempting all possible password combinations to gain access
A brute force attack is a method of cracking passwords or encryption keys by systematically trying every possible combination of characters until the correct one is found. This exhaustive approach relies on computational power to guess credentials, often targeting weak passwords or login mechanisms without lockout policies. It's a fundamental concept in cybersecurity, highlighting the importance of strong, complex passwords.
Question 2: Intermediate: A security analyst detects unusual outbound traffic from a workstation. Which of the following should be the first step in addressing this potential incident?
- Notify the user and ask them to stop using the workstation
- Isolate the workstation from the network (Correct answer)
- Perform a vulnerability scan on the workstation
- Re-image the workstation immediately
Correct answer: Isolate the workstation from the network
When unusual outbound traffic is detected, the immediate priority is to contain the potential threat and prevent further compromise or data exfiltration. Isolating the workstation from the network severs its connection to other systems and the internet, stopping the malicious activity from spreading or continuing. This containment step is critical in incident response before further investigation and remediation can occur.
Question 3: Advanced: A recent vulnerability scan flagged a critical issue related to outdated OpenSSL libraries. What is the most appropriate action to remediate this vulnerability?
- Block incoming traffic to the affected system
- Patch or update the OpenSSL libraries to the latest version (Correct answer)
- Decommission the system immediately
- Increase monitoring on the affected system
Correct answer: Patch or update the OpenSSL libraries to the latest version
Outdated software libraries, like OpenSSL, often contain known vulnerabilities that attackers can exploit. The most direct and effective remediation for such a critical issue is to apply the vendor-provided security patches or update to the latest stable version of the software. This action directly addresses the root cause of the vulnerability, closing the security gap and protecting the system from exploitation.
Question 4: Basic: What is the purpose of a web application firewall (WAF)?
- To detect and block malicious web traffic (Correct answer)
- To encrypt data in transit between a browser and a server
- To authenticate users before accessing a web application
- To manage and distribute network traffic evenly
Correct answer: To detect and block malicious web traffic
A Web Application Firewall (WAF) is specifically designed to protect web applications from various attacks, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It filters and monitors HTTP traffic between a web application and the internet, blocking malicious requests before they can reach the application. This provides a crucial layer of defense for web-facing services.
Question 5: Advanced: During a forensic investigation, a security analyst identifies unexpected DNS queries originating from multiple internal hosts. What might this indicate?
- A misconfigured DNS server
- A Distributed Denial of Service (DDoS) attack
- Malware communicating with a command-and-control server (Correct answer)
- A benign application update process
Correct answer: Malware communicating with a command-and-control server
Unexpected DNS queries from multiple internal hosts, especially to unusual or suspicious domains, are a strong indicator of malware activity. Malicious software often uses DNS to resolve the IP addresses of its command-and-control (C2) servers, allowing it to receive instructions or exfiltrate data. This pattern suggests a coordinated compromise across several systems.
CySA+ Difficulty Level 1
Basic: Which of the following best describes a brute force attack?