10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The C)CSA exam has 100 questions and runs 2 hours.
These 10 free C)CSA questions are organized by exam domain, so you can see how each part of the Certified Cybersecurity Analyst blueprint is tested. Reveal the answer and explanation under each question.
A SOC analyst receives a high-confidence alert showing a user logged in from an unusual location and accessed a sensitive file share. No malware indicators are found. What should the analyst do FIRST?
Correct answer: B - Validate activity using identity, endpoint, and access logs
A forensic investigator receives a disk image for examination. Which action BEST preserves evidence integrity?
Correct answer: B - Create a verified working copy and document acquisition details
A malware analyst executes a suspicious program in an isolated environment and observes registry changes and network connections. Which method is being used?
Correct answer: A - Dynamic analysis
A team wants reusable detection for future variants of a malware family based on observed characteristics. What is MOST appropriate?
Correct answer: B - Create a YARA rule
Encrypted traffic shows repeated timing and destination patterns associated with one external host. Which analysis is MOST useful?
Correct answer: A - Behavioral traffic analysis
Repeated unusual ICMP traffic leaves an internal system for an external host. What is the PRIMARY concern?
Correct answer: B - Possible covert communication
A company has strong firewall controls but poor endpoint visibility. Which improvement directly addresses the gap?
Correct answer: B - Implement endpoint monitoring
A security team wants to measure whether defenses detect realistic attacks. Which activity is BEST?
Correct answer: B - Test detection and response capabilities against simulated threats
A SIEM detects a user downloading large amounts of data overnight outside normal behavior. Which capability is MOST relevant?
Correct answer: A - User behavior analytics
A SIEM alert rule creates excessive noise from isolated failed logins. What improvement is BEST?
Correct answer: B - Correlate related events
The C)CSA exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more C)CSA questions with explanations.
Continue in the free practice test →
View plans