CompTIA CySA+ Practice Questions: Incident Response (CS0-003)

Question 1

What is the FIRST step in the incident response process? (Q-924430)

Accepted Answer

Preparation

Answer

Containment

Answer

Identification

Answer

Recovery

Question 2

What is the purpose of a playbook in incident response? (Q-924432)

Accepted Answer

To provide step-by-step response procedures

Answer

To automate malware analysis

Answer

To replace human analysts

Answer

To document compliance violations

Question 3

Which metric measures the time to detect a security incident? (Q-627fe9)

Accepted Answer

MTTD

Answer

MTTR

Answer

MTBF

Answer

RTO

Question 4

Which framework provides guidelines for incident response? (Q-924443)

Accepted Answer

NIST SP 800-61

Answer

NIST SP 800-53

Answer

ISO 27001

Answer

PCI DSS

Question 5

What is the purpose of chain of custody documentation? (Q-627fee)

Accepted Answer

To track evidence handling

Answer

To monitor network traffic

Answer

To document password changes

Answer

To record software licenses

Question 6

What does the 'C' in 'CSIRT' stand for? (Q-627ff7)

Accepted Answer

Cyber

Answer

Critical

Answer

Computer

Answer

Central

Question 7

What is the MAIN purpose of a disaster recovery plan (DRP)? (Q-627ffd)

Accepted Answer

To restore operations after an incident

Answer

To prevent all cyberattacks

Answer

To train employees on security

Answer

To document compliance

Question 8

What does the 'D' in 'IDEAL' incident response framework stand for? (Q-628005)

Accepted Answer

Document

Answer

Detect

Answer

Defend

Answer

Destroy

Question 9

What is the PRIMARY purpose of a disaster recovery plan (DRP)? (Q-628013)

Accepted Answer

To restore operations after disruptions

Answer

To prevent cyberattacks

Answer

To train employees

Answer

To document compliance

Question 10

When analyzing a suspected malware sample, which technique would BEST determine its capabilities without executing it?

Accepted Answer

Static analysis

Answer

Dynamic analysis

Answer

Behavioral analysis

Answer

Network analysis

Question 11

A security alert indicates unusual data transfers to an external cloud storage provider. What type of data analysis would BEST identify what was exfiltrated?

Accepted Answer

Endpoint forensic analysis

Answer

NetFlow analysis

Answer

Data loss prevention logs

Answer

SIEM correlation rules

Question 12

During an investigation, you find a user account with administrative privileges that was last used at 3 AM. What should you do NEXT?

Accepted Answer

Compare with baseline activity for this account

Answer

Immediately disable the account

Answer

Check if this matches the user's work schedule

Answer

Review authentication logs for the account

Question 13

Which tool would be MOST effective for analyzing a memory dump from a compromised system?

Accepted Answer

Volatility

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 14

What is the PRIMARY purpose of a playbook in incident response?

Accepted Answer

To provide standardized response procedures

Answer

To replace analyst decision-making

Answer

To document forensic tools

Answer

To automate all remediation

Question 15

During a forensic investigation, which artifact would MOST likely reveal recently executed commands?

Accepted Answer

Windows Prefetch files

Answer

Browser history

Answer

DNS cache

Answer

ARP table

Question 16

What is the PRIMARY purpose of reverse engineering malware?

Accepted Answer

To understand its functionality and indicators

Answer

To delete infected files

Answer

To improve system performance

Answer

To automatically patch vulnerabilities

Question 17

When investigating a phishing incident, which artifact would MOST likely reveal the initial entry point?

Accepted Answer

Email headers

Answer

Firewall logs

Answer

DNS cache

Answer

Process list

Question 18

When analyzing a memory dump, what would the presence of Mimikatz MOST likely indicate?

Accepted Answer

Credential dumping activity

Answer

Normal system process

Answer

Memory optimization

Answer

Antivirus scanning

Question 19

Which Windows registry key would MOST likely contain persistence mechanisms?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 20

Which artifact would MOST likely reveal browser-based credential theft?

Accepted Answer

Browser history and saved passwords

Answer

Windows event logs

Answer

DNS cache

Answer

ARP table

Question 21

What is the PRIMARY purpose of maintaining a chain of custody during an investigation?

Accepted Answer

To ensure evidence admissibility in court

Answer

To encrypt evidence

Answer

To speed up analysis

Answer

To reduce storage requirements

Question 22

Which Windows artifact would MOST likely reveal recently accessed files?

Accepted Answer

LNK files

Answer

Prefetch files

Answer

DNS cache

Answer

ARP table

Question 23

What is the PRIMARY purpose of a memory dump during incident response?

Accepted Answer

To capture volatile evidence

Answer

To free up system resources

Answer

To improve performance

Answer

To create backups

Question 24

Which artifact would MOST likely reveal USB device usage times?

Accepted Answer

Security event logs

Answer

Windows Setup logs

Answer

Application logs

Answer

System Registry

Question 25

Which artifact would be MOST useful for determining data exfiltration via cloud storage?

Accepted Answer

Cloud access security broker logs

Answer

Firewall logs

Answer

DNS cache

Answer

ARP table

Question 26

What does the presence of unexpected registry Run keys indicate?

Accepted Answer

Persistence mechanism

Answer

Normal system operation

Answer

Software update

Answer

Hardware change

Question 27

What is the PRIMARY purpose of a memory dump during forensic analysis?

Accepted Answer

To capture evidence of running processes

Answer

To free up disk space

Answer

To improve system performance

Answer

To create system backups

Question 28

Which artifact would MOST likely reveal browser-based attacks?

Accepted Answer

Browser cache and history

Answer

Windows event logs

Answer

DNS cache

Answer

ARP table

Question 29

What is the PRIMARY purpose of maintaining a chain of custody document?

Accepted Answer

To ensure evidence admissibility

Answer

To encrypt evidence

Answer

To speed up analysis

Answer

To reduce storage needs

Question 30

Which Windows artifact would reveal recently executed programs?

Accepted Answer

Prefetch files

Answer

Browser history

Answer

DNS cache

Answer

ARP table

Question 31

Which artifact would reveal USB device usage times?

Accepted Answer

Security logs

Answer

Setup logs

Answer

App logs

Answer

Registry

Question 32

Which tool would be MOST effective for memory analysis?

Accepted Answer

Volatility

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 33

When investigating phishing, which artifact reveals entry point?

Accepted Answer

Email headers

Answer

Firewall logs

Answer

DNS cache

Answer

Process list

Question 34

What does the presence of Mimikatz in memory indicate?

Accepted Answer

Credential dumping

Answer

Normal process

Answer

Memory optimization

Answer

AV scanning

Question 35

Which registry key contains persistence mechanisms?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 36

What is the PRIMARY purpose of reverse engineering malware?

Accepted Answer

Understand functionality

Answer

Delete files

Answer

Improve performance

Answer

Automate patching

Question 37

What is the PRIMARY purpose of a playbook?

Accepted Answer

Standardize response

Answer

Replace analysts

Answer

Document tools

Answer

Automate remediation

Question 38

What is the primary purpose of a root cause analysis (RCA) after a security incident?

Accepted Answer

To prevent recurrence of the incident

Answer

To assign blame to individuals

Answer

To restore system backups

Answer

To calculate financial loss

Question 39

An endpoint is confirmed to be running ransomware. What is the best immediate containment action?

Accepted Answer

Isolate the host from the network

Answer

Run a marketing report

Answer

Increase mailbox quota

Answer

Disable all backups

Question 40

Why should evidence hashes be calculated during acquisition?

Accepted Answer

To prove the data has not changed during analysis

Answer

To compress the evidence automatically

Answer

To identify the device owner by name

Answer

To remove malware

Question 41

Which incident response phase captures what worked, what failed, and what should change?

Accepted Answer

Lessons learned

Answer

Initial compromise

Answer

Lateral movement

Answer

Credential harvesting

Question 42

Which response action removes attacker-created persistence after containment?

Accepted Answer

Eradication

Answer

Preparation

Answer

Lessons learned only

Answer

Scoping only

Question 43

A phishing investigation needs to determine whether users clicked a link. Which data source helps most?

Accepted Answer

Web proxy or secure web gateway logs

Answer

Keyboard firmware version

Answer

Patch panel map

Answer

Printer toner alerts

Question 44

An analyst creates a timeline from endpoint, firewall, and identity logs. What is the main purpose?

Accepted Answer

Reconstruct attacker activity and sequence of events

Answer

Improve monitor color

Answer

Calculate disk warranty

Answer

Replace change control

CompTIA CySA+ Practice Questions: Incident Response

Q1. What is the FIRST step in the incident response process? (Q-924430)

Q2. What is the purpose of a playbook in incident response? (Q-924432)

Q3. Which metric measures the time to detect a security incident? (Q-627fe9)

Q4. Which framework provides guidelines for incident response? (Q-924443)

Q5. What is the purpose of chain of custody documentation? (Q-627fee)

Q6. What does the 'C' in 'CSIRT' stand for? (Q-627ff7)

Q7. What is the MAIN purpose of a disaster recovery plan (DRP)? (Q-627ffd)

Q8. What does the 'D' in 'IDEAL' incident response framework stand for? (Q-628005)

Q9. What is the PRIMARY purpose of a disaster recovery plan (DRP)? (Q-628013)

Q10. When analyzing a suspected malware sample, which technique would BEST determine its capabilities without executing it?

Q11. A security alert indicates unusual data transfers to an external cloud storage provider. What type of data analysis would BEST identify what was exfiltrated?

Q12. During an investigation, you find a user account with administrative privileges that was last used at 3 AM. What should you do NEXT?

Q13. Which tool would be MOST effective for analyzing a memory dump from a compromised system?

Q14. What is the PRIMARY purpose of a playbook in incident response?

Q15. During a forensic investigation, which artifact would MOST likely reveal recently executed commands?

Q16. What is the PRIMARY purpose of reverse engineering malware?

Q17. When investigating a phishing incident, which artifact would MOST likely reveal the initial entry point?

Q18. When analyzing a memory dump, what would the presence of Mimikatz MOST likely indicate?

Q19. Which Windows registry key would MOST likely contain persistence mechanisms?

Q20. Which artifact would MOST likely reveal browser-based credential theft?

Q21. What is the PRIMARY purpose of maintaining a chain of custody during an investigation?

Q22. Which Windows artifact would MOST likely reveal recently accessed files?

Q23. What is the PRIMARY purpose of a memory dump during incident response?

Q24. Which artifact would MOST likely reveal USB device usage times?

Q25. Which artifact would be MOST useful for determining data exfiltration via cloud storage?

Q26. What does the presence of unexpected registry Run keys indicate?

Q27. What is the PRIMARY purpose of a memory dump during forensic analysis?

Q28. Which artifact would MOST likely reveal browser-based attacks?

Q29. What is the PRIMARY purpose of maintaining a chain of custody document?

Q30. Which Windows artifact would reveal recently executed programs?

Q31. Which artifact would reveal USB device usage times?

Q32. Which tool would be MOST effective for memory analysis?

Q33. When investigating phishing, which artifact reveals entry point?

Q34. What does the presence of Mimikatz in memory indicate?

Q35. Which registry key contains persistence mechanisms?

Q36. What is the PRIMARY purpose of reverse engineering malware?

Q37. What is the PRIMARY purpose of a playbook?

Q38. What is the primary purpose of a root cause analysis (RCA) after a security incident?

Q39. An endpoint is confirmed to be running ransomware. What is the best immediate containment action?

Q40. Why should evidence hashes be calculated during acquisition?

Q41. Which incident response phase captures what worked, what failed, and what should change?

Q42. Which response action removes attacker-created persistence after containment?

Q43. A phishing investigation needs to determine whether users clicked a link. Which data source helps most?

Q44. An analyst creates a timeline from endpoint, firewall, and identity logs. What is the main purpose?

More CompTIA CySA+ practice topics