1.3 Given a scenario, use appropriate tools or techniques to determine malicious activity.
Objective 1.3 sits in Security Operations, which carries 33% of the CySA+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An analyst needs a packet capture off a busy link preserved for later analysis in another tool. Which tcpdump flag writes the raw packets to a file?
Correct.
Concept
Capture tools separate live display from durable capture. Writing raw packets to a file keeps the full data for replay and deeper analysis, where on-screen decoding is lossy and transient.
Why B
The manual states -w saves the packet data to a file for later analysis, which is what preserves the capture for another tool.
Now you: objective 1.3 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
You have a .pcap a colleague captured from an isolated segment. Which tcpdump flag reads packets from that saved file instead of a live interface?
Sample question 2 of 3
An analyst's capture on a high-throughput SPAN port finishes and tcpdump reports a large number of packets "dropped by kernel." What does that count indicate?
Sample question 3 of 3
To reduce kernel drops on a heavy capture, an analyst wants to enlarge the OS capture buffer. Which tcpdump option does that?
Full CySA+ question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Operations
- 1.1 1.1 Explain the importance of system and network architecture concepts in security operations.
- 1.2 1.2 Given a scenario, analyze indicators of potentially malicious activity.
- 1.4 1.4 Compare and contrast threat-intelligence and threat-hunting concepts.
- 1.5 1.5 Explain the importance of efficiency and process improvement in security operations.