CS0-003: Security Operations
Security Operations is one of the skill areas tested on the CySA+ (Cybersecurity Analyst) (CS0-003) exam. Below are free CS0-003 practice questions with worked answers and a concept diagram — each with a plain-language explanation. Practice the first 10 questions of CS0-003 free, no signup.
The concept, in one picture
3 free CS0-003 Security Operations questions
Several employees at a logistics firm have had their corporate credentials misused. Around the same time, staff begin reporting that the internal HR portal intermittently loads over plain HTTP instead of HTTPS, then returns to HTTPS later in the day. Which of the following best explains this behavior?
- The portal's TLS certificate has expired, so the server can no longer accept connections on port 443
- A misconfigured OSPF route on the core switches is redirecting portal traffic to a different subnet
- The web server automatically redirects sessions to port 80 whenever HTTPS request volume peaks
- ✓ An attacker on the internal network is performing an on-path attack that strips TLS and downgrades victims to HTTP
An on-path (adversary-in-the-middle) attacker who intercepts traffic can strip TLS and force victims onto plain HTTP, letting the attacker capture credentials in cleartext — which explains both the intermittent downgrades (only intercepted sessions are affected) and the compromised accounts. An expired certificate would break HTTPS consistently for everyone and would produce browser warnings, not an on-again-off-again pattern. A routing misconfiguration changes where packets go, not which application protocol the session uses. Web servers do not shed load by silently downgrading clients from HTTPS to HTTP; that is not a real load-management behavior.
During a risk review at an insurance company, the security team discovers that employees are storing customer documents in several unsanctioned file-sharing SaaS services. The CISO wants both visibility into this shadow IT usage and the ability to block the risky services. Which of the following should the team deploy?
- Single sign-on federation across all approved business applications
- ✓ A cloud access security broker with enforcement policies enabled
- Phishing-resistant multifactor authentication for all cloud logins
- An API gateway in front of the company's internally developed services
A cloud access security broker (CASB) sits between users and cloud services, discovers which sanctioned and unsanctioned SaaS applications employees are actually using, and can enforce policies that block or restrict the risky ones — exactly the visibility-plus-control combination the CISO asked for. SSO only streamlines authentication to applications IT already knows about and manages; it does nothing about apps adopted outside IT's view. MFA strengthens login security on known accounts but neither discovers nor blocks unsanctioned services. An API gateway manages and secures traffic to the organization's own APIs; it has no role in governing employees' use of third-party SaaS.
A SOC analyst at a logistics company reviews egress firewall logs and sees a warehouse workstation sending outbound TLS traffic at regular intervals to an overseas IP address that appears on a threat intelligence blocklist. Each request contains unusual extra characters embedded in the HTTP headers. Which of the following types of activity has the analyst most likely identified?
- A buffer overflow attack against the workstation
- Directory traversal targeting a web server
- ✓ Beaconing to a command-and-control server
- Cross-site scripting injected into a company web page
Beaconing is the periodic, often covert communication an infected host makes to attacker-controlled infrastructure — regular intervals, a known-malicious destination, and data hidden in header fields are classic signs. A buffer overflow is a memory-corruption exploit against a running program, not an outbound traffic pattern. Directory traversal is an inbound attack that abuses path input to read files on a server. Cross-site scripting is malicious script injected into web content and executed in victims' browsers; none of these produce recurring outbound connections from an internal host to a blocklisted IP.
Practice CS0-003 free
The first 10 questions of every exam are free. No signup, no email wall.
Start practicing →Get a free CS0-003 study plan by email
A short plan to work through CS0-003 by skill area, plus a note when we add new questions. Optional — the practice above stays free. No spam, unsubscribe anytime.