CySA+ Security Ops Quiz: Can You Ace The Biggest Domain?

1. Which metric measures the time between a breach occurring and detection?

Mean Time to Respond (MTTR)

Mean Time to Detect (MTTD)

Mean Time to Contain (MTTC)

Mean Time to Recover (MTTR)

2. What is the primary purpose of a security baseline in operations?

Document all incidents that occur

Establish normal system behavior for comparison and anomaly detection

Track employee vacation schedules

Monitor internet usage only

3. Which technique detects attacks by analyzing deviations from normal behavior?

Signature-based detection

Anomaly-based detection

Rule-based detection

Heuristic scanning

4. What is the CVSS score used for in security operations?

Calculating network bandwidth

Rating vulnerability severity and prioritizing remediation

Encrypting sensitive communications

Authenticating users

5. Which activity involves examining system artifacts to determine what happened during an incident?

Forensic analysis

Vulnerability scanning

Compliance review

Performance tuning

6. What is the primary benefit of threat intelligence sharing in Security Operations (CySA+)?

Reduces operational costs only

Enables faster detection and mitigation of emerging threats

Eliminates all security incidents

Simplifies compliance audits

7. Which framework provides guidance on incident handling and response procedures?

NIST Cybersecurity Framework

ISO 27001

NIST SP 800-61

CIS Controls

8. What is privilege escalation in the context of security operations?

Granting users legitimate access increases

An attacker gaining higher-level permissions than originally granted

A scheduled security audit

Monitoring administrator activity

9. Which protocol is commonly used to transmit security logs to a SIEM?

Syslog

DNS

DHCP

SNMP

10. What does SOAR automate in security operations?

Incident response workflows and investigations

Patch management only

User password resets

Email encryption

11. Which tool is primarily used to collect and analyze security event logs in a SOC environment?

SIEM

Firewall

VPN

NAC

12. What is the primary function of a honeypot in security operations?

Encrypt sensitive data

Detect and distract attackers by mimicking valuable targets

Block malicious IP addresses

Monitor network bandwidth

13. Which type of malware analysis is performed in an isolated environment?

Static analysis

Dynamic analysis

Behavioral analysis

Live analysis

14. What is the purpose of a playbook in incident response?

Document lessons learned after an incident

Provide step-by-step procedures for handling specific incidents

Test firewall rules

Monitor user activity continuously

15. Which indicator of compromise (IOC) is a unique identifier for malware?

File hash

User behavior

Network latency

Patch date

16. What is a false positive in security monitoring?

A real attack that went undetected

A legitimate activity flagged as malicious

A successful exploit

A security patch failure

17. Which log type is most critical for detecting unauthorized access attempts?

Application logs

Authentication logs

Network logs

System logs

18. What does MITRE ATT&CK provide for security operations?

A framework of adversary tactics and techniques

Encryption algorithms

Firewall rules

Compliance standards

19. In incident response, which phase involves containing the threat and preventing further damage?

Detection

Analysis

Containment

Recovery

20. What is the primary goal of threat hunting?

Passively wait for alerts to trigger

Proactively search for undetected threats and indicators of compromise

Block all incoming traffic

Monitor only external networks

CySA+ Security Ops Quiz: Can You Ace the Biggest Domain?