HTB CDSA Practice Questions - HTB Certified Defensive Security Analyst Exam - HTB CDSA Practice Questions - HTB Certified Defensive Security Analyst Exam

Question 1

In the NIST incident handling lifecycle, which phase immediately follows the Detection and Analysis phase?

Containment, Eradication, and Recovery Preparation Post-Incident Activity Identification

Correct Answer:

Containment, Eradication, and Recovery

Question 2

A SOC analyst sees 50 failed Windows logon events (Event ID 4625) in 10 minutes from a single source IP targeting one account. Which attack type does this most likely indicate?

Password spraying Credential stuffing Brute force attack Pass-the-hash

Correct Answer:

Brute force attack

Question 3

Which Sysmon Event ID records the creation of a new process and is most useful for detecting execution of malicious binaries?

Sysmon Event ID 1 Sysmon Event ID 3 Sysmon Event ID 8 Sysmon Event ID 11

Correct Answer:

Sysmon Event ID 1

Question 4

In Elastic/KQL, which query correctly searches for all Windows Security events with Event ID 4688 (process creation)?

event.code:4688 AND winlog.channel:Security SELECT * FROM Security WHERE EventID=4688 index=windows EventCode=4688 event_id=4688 source=WinEventLog:Security

Correct Answer:

event.code:4688 AND winlog.channel:Security

Question 5

A Wireshark capture shows repeated TCP SYN packets sent to ports 21, 22, 23, 25, 80, and 443 on a target host with no SYN-ACK responses. What does this traffic pattern indicate?

A TCP SYN port scan A successful TCP handshake negotiation An ARP spoofing attack A UDP flood denial of service

Correct Answer:

A TCP SYN port scan

Question 1

Exam overview

About this Exam

Prepare with the HTB CDSA Practice Questions - HTB Certified Defensive Security Analyst Exam practice quiz. This question bank includes 100 questions covering windows, event, elastic, rule, and query. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

HTB CDSA Practice Questions - HTB Certified Defensive Security Analyst Exam

This practice set contains 100 questions from the matching question bank and focuses on windows, event, elastic, rule, and query. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Keep studying

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

HTB CDSA Practice Questions - HTB Certified Defensive Security Analyst Exam

Frequently Asked Questions

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

Arizona CNA Certified Nursing Assistant Practice Exam

Certified Professional Public Buyer (CPPB) Practice Exam

Arizona Security Guard Knowledge Practice Exam

Certified Specialist Business Intelligence (CSBI) Practice Test

Certified Specialist In Renal Nutrition (CSR) Practice Exam