CompTIA CySA+ practice questions.

A SOC analyst reviews EDR telemetry and sees a PowerShell process spawned by Microsoft Word, then a network connection to an unfamiliar external IP. Which MITRE ATT&CK technique best describes the initial pattern?

A vulnerability scanner reports 5,000 findings. The team has bandwidth to remediate 50 per week. They want to weight by likelihood of exploitation in the next 30 days. Which scoring system is purpose-built for that?

A responder isolates an infected workstation by disconnecting it from the network. Per NIST SP 800-61 Rev. 2, which phase is this?

A public US-listed company discovers a material cybersecurity incident on a Tuesday. Per SEC Item 1.05 of Form 8-K (effective December 2023), what is the disclosure deadline?

A vulnerability appears in CISA's Known Exploited Vulnerabilities catalog. Federal civilian agencies must remediate per BOD 22-01. What is the operational implication for a private-sector security team?

An analyst conducts threat hunting against a hypothesis: 'an adversary is using DCSync to extract credentials from our Active Directory.' Which event log telemetry best supports this hunt?