CompTIA Cybersecurity Analyst (CySA+ CS0-003) Practice Test
Este examen se retira el martes, 22 de diciembre de 2026.
CompTIA indica CS0-004 como el reemplazo directo; todavía no hay un examen de práctica para él.
Gana confianza para CompTIA Cybersecurity Analyst (CySA+ CS0-003). Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaDescripción y detalles del examen
La certificación CompTIA Cybersecurity Analyst (CySA+ CS0-003) valida el conocimiento a nivel intermedio y las habilidades prácticas en cybersecurity analytics y threat detection. Esta credencial neutral al proveedor se centra en behavioral analytics, security monitoring y proactive defense para identificar, combatir y prevenir amenazas sofisticadas. Obtener el CySA+ demuestra la capacidad para configurar y usar threat detection tools, realizar data analysis, interpretar resultados para identificar vulnerabilities y threats, y recomendar estrategias de mitigation efectivas, además de alinearse con el NIST Cybersecurity Framework y los estándares ISO 27001 como un referente global para profesionales en incident response, vulnerability management y security operations.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
ATT&CK shows a registry Run key used to survive reboot. Which tactic should the analyst map this to?
A credentialed scan finds hundreds more Windows findings than an unauthenticated scan. What does this usually indicate?
A rule has a 93 percent false positive rate. What is the best reporting recommendation?
A vulnerability management dashboard includes CVSS, EPSS, KEV status, asset criticality, and internet exposure. What is the main benefit?
A live host may contain injected processes and network sessions. Which evidence should be collected before powering it off?
Oportunidades profesionales y salario
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.
Qué temas cubre este examen
Usa las ponderaciones publicadas de los dominios para planificar tu estudio. Los resultados de práctica no predicen tu puntuación en el examen de certificación.
01Security Operations
This domain covers the technical aspects of security operations, focusing on how network architecture and security tools identify malicious activity indicators. It provides the knowledge of the systems and techniques required to maintain a secure environment.
Temas
- System and network architecture
- Malicious activity indicators
- Tools and techniques
- Threat intelligence and hunting
- Process improvement
Objetivos de aprendizaje
- System and network architecture: Explaining log ingestion, operating system (OS) concepts, infrastructure, network architecture, identity and access management (IAM), encryption, and sensitive data protection
- Malicious activity indicators: Analyzing network anomalies like bandwidth spikes and rogue devices, host issues like unauthorized software and data exfiltration, application irregularities like unexpected communication and service interruptions, and threats like social engineering attacks
- Tools and techniques: Detecting malicious activity using tools like Wireshark, security information and event management (SIEM), and VirusTotal, along with techniques like pattern recognition and email analysis, supported by scripting languages like Python and PowerShell
- Threat intelligence and hunting: Comparing threat actors, tactics, techniques, and procedures (TTP); confidence levels; collection methods; intelligence sharing; and hunting techniques
- Process improvement: Standardizing processes, streamlining operations, integrating tools, and using a single pane of glass
02Vulnerability Management
This domain addresses the identification and management of vulnerabilities through scanning, assessment, and prioritization techniques. It emphasizes the use of assessment tool output to effectively manage and mitigate security risks within the organizational network infrastructure.
Temas
- Vulnerability scanning
- Assessment tool output
- Vulnerability prioritization
- Mitigation controls
- Vulnerability response
Objetivos de aprendizaje
- Vulnerability scanning: Implementing asset discovery, internal vs. external scanning, agent vs. agentless, credentialed vs. non-credentialed, passive vs. active, static vs. dynamic, and critical infrastructure scanning
- Assessment tool output: Analyzing network scanning, web application scanners, vulnerability scanners, debuggers, multipurpose tools, and cloud infrastructure assessments
- Vulnerability prioritization: Interpreting common vulnerability scoring system (CVSS), validating findings, assessing exploitability, and considering asset value and zero-day vulnerabilities
- Mitigation controls: Recommending controls for cross-site scripting (XSS), overflow vulnerabilities, and data poisoning
- Vulnerability response: Explaining compensating controls, patching, configuration management, maintenance windows, exceptions, governance, service-level objectives (SLOs), secure software development life cycle (SDLC), and threat modeling
03Incident Response Management
This domain focuses on the incident response life cycle, including frameworks for managing and responding to security incidents. It covers the activities and methodologies required to handle security threats and maintain operational continuity during an active incident.
Temas
- Attack methodology frameworks
- Incident response activities
- Incident management life cycle
Objetivos de aprendizaje
- Attack methodology frameworks: Explaining cyber kill chains, diamond model of intrusion analysis, MITRE ATT&CK, Open Source Security Testing Methodology Manual (OSSTMM), and OWASP testing guide
- Incident response activities: Performing detection, analysis, containment, eradication, and recovery
- Incident management life cycle: Explaining incident response plans, tools, playbooks, tabletop exercises, training, business continuity (BC), disaster recovery (DR), forensic analysis, and root cause analysis
04Reporting and Communication
This domain covers the communication and reporting requirements for both vulnerability management and incident response activities. It ensures that security professionals can document and communicate findings to stakeholders to support informed decision-making and organizational security posture.
Temas
- Vulnerability management reporting
- Incident response reporting
Objetivos de aprendizaje
- Vulnerability management reporting: Explaining compliance reports, action plans, inhibitors to remediation, metrics, key performance indicators (KPIs), and stakeholder communication
- Incident response reporting: Explaining incident declaration, escalation, reporting, communication, root cause analysis, lessons learned, and metrics and KPIs