CompTIA CySA+ (CS0-003) - 340 Questions

1. A SOC analyst is reviewing SIEM alerts and notices that log timestamps from a remote branch office are consistently 3 hours ahead of the SIEM server time. Which configuration issue is most likely causing this discrepancy?

2. A security analyst needs to investigate a potential intrusion on a Windows workstation. Which Windows Registry hive should the analyst examine to find recently executed programs that do not appear in standard process lists?

3. An organization wants to implement a solution that automatically executes a series of predefined response actions when a specific SIEM alert fires, such as isolating an endpoint and blocking an IP at the firewall. Which technology best fulfills this requirement?

4. A threat analyst observes that an internal host is making outbound DNS queries for randomly generated 32-character subdomains of a single domain at regular 60-second intervals. Which type of malicious activity does this behavior most likely indicate?

5. A SOC analyst captures network traffic and wants to filter for all TCP SYN packets directed at a web server to identify potential reconnaissance activity. Which Wireshark display filter should the analyst use?