CySA+ Knowledge Areas Covered Flashcards

A CySA+ analyst receives a CTI feed with IOCs. What is the first step before operationalizing these indicators?

Answer: Validate and contextualize the indicators

IOCs must be validated and contextualized to avoid false positives before they are operationalized in detection tools.

Which CySA+ domain covers ensuring that third-party vendors meet the organization's security standards?

Answer: Compliance and Assessment

Third-party risk management and vendor assessments are covered under the Compliance and Assessment domain.

An analyst uses NetFlow data to establish a baseline and then detects anomalies. This technique is part of which domain?

Answer: Security Operations and Monitoring

Baselining network behavior and detecting anomalies via NetFlow is a Security Operations and Monitoring technique.

Which phase of the incident response lifecycle involves restoring systems from clean backups?

Answer: Recovery

Restoring systems from clean backups to resume normal operations is part of the Recovery phase.

A CySA+ candidate must understand risk scoring in vulnerability management. Which metric indicates exploitability?

Answer: CVSS Exploitability Score

The CVSS Exploitability Score specifically measures how easily a vulnerability can be exploited based on attack vector and complexity.

Which CySA+ concept involves using known attacker TTPs to generate realistic detection rules?

Answer: Adversary Emulation

Adversary emulation uses documented TTPs to simulate real attacks and validate detection capabilities.

An analyst is implementing data loss prevention controls to stop sensitive files from leaving the network. Which domain covers this?

Answer: Security Operations and Monitoring

DLP monitoring and enforcement is a Security Operations and Monitoring function that protects data in transit.