CompTIA Cybersecurity Analyst (CySA+) V4 Free Sample Questions

When utilizing public or cloud-based GenAI tools, the primary governance risk is data leakage. Submitting proprietary incident data, PII, or internal network architecture details to a public LLM can result in that sensitive data being absorbed into the model's training set and potentially exposed to unauthorized parties. The other options represent technical or workflow issues, but data privacy/leakage is the paramount governance risk.

Hypothesis-driven threat hunting is a proactive approach where the hunter creates a hypothesis (e.g., "An attacker is bypassing execution policies using PowerShell") based on threat intelligence or knowledge of adversary tactics, and then searches the environment for evidence of that specific behavior, assuming traditional defenses have failed. It relies on behavioral analysis rather than static IoC matching.

Event ID 4769 is generated every time a Kerberos service ticket (TGS) is requested. In a Kerberoasting attack, an adversary requests TGS tickets for service accounts (which have SPNs) to extract them and crack the service account passwords offline. Without Event ID 4769, detecting the anomalous volume of TGS requests associated with Kerberoasting is highly difficult. Password spraying, LLMNR poisoning, and DCSync are detected via other event IDs or network traffic.

Impossible travel alerts trigger when the physical distance between two authentication source IP addresses cannot be traversed in the time elapsed. A common benign cause (false positive) is a user connecting to a VPN routing traffic through an exit node in another country, making their IP appear to be in Tokyo while they are physically in New York.

Zero Trust Architecture (ZTA) shifts the security perimeter from the network edge to identity and context. Deploying identity-aware proxies ensures that every access request is authenticated and authorized based on user identity and device posture, regardless of network location. Microsegmentation prevents lateral movement by isolating workloads. Upgrading firewalls or deploying NIDS still relies on network-centric boundaries, which contradicts the core mandate of ZTA.

Endpoint Detection and Response (EDR) solutions are designed to monitor endpoint behavior at a deep level, including memory analysis, process trees, and registry modifications. Analyzing memory for DLL injection and isolating the endpoint from the network are core EDR capabilities. SIEMs are used for log aggregation and correlation across disparate systems (like firewalls and badge readers) and evaluating cloud identity logs.

Mimikatz is a well-known credential dumping tool used to extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory (specifically the LSASS process in Windows). The immediate risk is credential theft, which facilitates privilege escalation and lateral movement. It is not used for DoS, ransomware encryption, or SQL injection.

DNS tunneling abuses the DNS protocol to bypass firewalls and proxy restrictions. Attackers often use TXT records because they allow for larger payloads of arbitrary text. The presence of base64-encoded strings in TXT responses from a non-standard external IP is a classic indicator of a Command and Control (C2) channel or data exfiltration via DNS tunneling.

Security Assertion Markup Language (SAML) 2.0 is an XML-based standard in which an Identity Provider (IdP) issues signed assertions that Service Providers (SPs) trust for web SSO. The attack described is a 'Golden SAML' attack: with the IdP's token-signing private key, the attacker forges valid signed XML assertions for any user and bypasses authentication entirely. OpenID Connect uses JSON-based JWT ID tokens, OAuth 2.0 is an authorization framework whose tokens are not XML assertions, and RADIUS is a network AAA protocol.

True. AI Hallucinations occur when a Generative AI model generates output that sounds plausible and confident but is entirely fabricated or factually incorrect. In security operations, this is a significant risk as it can result in false positives, misattribution of threats, or wasted time during incident response.