Worth 34% of the CompTIA CySA+ (CS0-004) exam. CertClue has 101 questions on this objective.
A SIEM is only as useful as the correlation rules built on top of it. Raw logs from a firewall, an endpoint agent, and an identity provider each tell a partial story on their own; correlation is what turns those fragments into a single detectable event a human can act on.
Exam tip. When a scenario describes multiple weak signals that only become suspicious together, the tested concept is correlation, not any single log source.
AI tools are now embedded in security operations, from alert summarization to automated triage, which introduces a new category of risk alongside the traditional threats CySA plus already covers. Analysts need to recognize these risks as distinct failure modes, not generic software bugs.
Exam tip. If a scenario shows an AI tool producing a wrong but plausible-sounding answer, that is hallucination. If the input itself was manipulated to change the AI's behavior, that is prompt injection.
Free, with the answer and the reasoning. No account needed.
1. A security analyst wants to identify which processes on a live, running Windows system have established network connections right now. Which built-in command would show this?
netstat -ano lists active network connections along with the process ID responsible for each one, letting an analyst tie a suspicious connection back to a specific running process. ipconfig /all shows local network adapter configuration, not active connections, systeminfo reports general OS and hardware details, and chkdsk checks disk integrity, none of which show live connection-to-process mapping.
2. TechCore Solutions' SIEM correlates a login from an employee's account in Toronto with a VPN session for the same account from a different country nine minutes later. Which detection concept does this pairing illustrate?
Impossible travel flags two authentications for the same identity from locations a person could not realistically travel between in the time elapsed. Privilege escalation is gaining higher rights, credential stuffing is testing breached credentials against many accounts, and beaconing is regular outbound callback traffic from malware, none of which describe this specific two-location pattern.
3. An EDR alert at Quillon Media flags the use of a legitimate, digitally signed Windows system binary to download a file from an external server and execute it, a technique that bypasses application allow-listing because the binary itself is trusted. What category of technique does this describe?
Using legitimate, signed system binaries already present on the host to download or execute malicious content is the defining characteristic of living-off-the-land binary (LOLBin) abuse, which is specifically designed to evade allow-listing and signature-based detection. It is not a kernel exploit, supply chain compromise, or credential attack.
The full CompTIA CySA+ bank, the study notes behind these summaries, and a readiness score that tells you which objective to revise next. Free, no paid tier.
Take the free CompTIA CySA+ practice test