24 free CompTIA CySA+ CS0-004 practice questions from the CertStash pack of 95, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 24 free here, all 95 in the pack, and each step includes the one before it.
Get all 95 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which of the following is the most important reason why tactics, techniques, and procedures (TTP) are beneficial to a defensive strategy?
Show answer and explanation
Correct answer: D. TTP provides useful insights on the strategy and behavior of an attacker.
Tactics, techniques and procedures describe how an adversary operates rather than what artefacts they happened to leave behind. Hashes and IP addresses change the moment an attacker rebuilds their infrastructure, but the strategy and behaviour behind an intrusion is costly to change and tends to persist across campaigns. Defending against behaviour therefore keeps working after the indicators have rotated.
Why the other options are wrong
- A. Hash values and IP addresses are the most disposable indicators an attacker has; they are trivially changed.
- B. Indicators of compromise are the artefacts left by an attack, not the behaviour that produced it.
- C. Tooling can be swapped for an equivalent utility without changing how the adversary operates.
Question 2
Which of the following is the best reason to heavily segment business-critical assets from within the network?
Show answer and explanation
Correct answer: A. Legacy systems
Legacy systems are the reason segmentation has to be heavy rather than nominal. They frequently cannot be patched, cannot run modern endpoint controls and cannot be replaced without breaking a business process, so the only control left is to restrict what can reach them. Segmentation compensates for protections the asset itself cannot carry.
Why the other options are wrong
- B. Degraded functionality is a consequence of segmenting, not a reason to do it.
- C. Asset obfuscation hides an asset's identity and is a side effect rather than the driver.
- D. A proprietary server describes what the asset is, not why it needs isolating.
Question 3
A cybersecurity analyst receives an unstructured text document that contains advanced persistent threat (APT)-related indicators of compromise (IoCs). The analyst needs to extract the IPv4 addresses. Which of the following is the best tool to accomplish this task?
Show answer and explanation
Correct answer: A. CyberChef
CyberChef is built for exactly this: transforming and extracting data from unstructured text through chained operations, including a recipe that pulls IPv4 addresses out of arbitrary content. The document is text rather than captured traffic, so a parsing and extraction tool is the right instrument.
Why the other options are wrong
- B. Wireshark analyses packet captures and cannot process a text document.
- C. Zeek generates logs from live or captured network traffic, not from prose.
- D. OpenCTI stores and relates threat intelligence once it is structured; it is not an extraction tool.
Question 4
Which of the following best describes why operational technology (OT) devices use compensating controls?
Show answer and explanation
Correct answer: C. Traditional IT security solutions may not be compatible.
Operational technology runs on real-time and often decades-old platforms that cannot host an agent, cannot tolerate a scan and cannot be taken offline to patch. Because the standard controls simply will not run there, the organisation applies compensating controls - segmentation, monitoring, strict access - that achieve the security objective by another route.
Why the other options are wrong
- A. Bandwidth consumption is a performance consideration, not the reason a control cannot be applied.
- B. Scheduled outage windows make maintenance easier, which argues against needing compensation.
- D. Lack of encryption is one specific gap rather than the general incompatibility that drives the approach.
Question 5
A public threat intelligence report includes indicators of compromise (IoCs) for threat actors. The threat actors are exploiting a zero-day vulnerability that the vendor has not fixed. Which of the following techniques should be used until a patch is available?
Show answer and explanation
Correct answer: C. Continuous monitoring
With no patch available the vulnerability cannot be closed, so the practical objective becomes knowing immediately if it is exploited. Continuous monitoring against the published indicators gives that early warning and buys time until the vendor releases a fix, which is why it is the interim measure.
Why the other options are wrong
- A. Sinkholing redirects traffic destined for known malicious infrastructure and does not address the vulnerable system.
- B. Eradication removes an attacker who is already present; nothing indicates a compromise yet.
- D. Evidence acquisition is a forensic activity performed after an incident is confirmed.
Question 6
The Chief Information Security Officer wants to improve internal security measures by continuously validating and verifying access to the production environment. Which of the following concepts best describes this practice?
Show answer and explanation
Correct answer: C. Zero Trust
Zero Trust removes any notion of implicit trust based on location or prior authentication. Every request to the production environment is authenticated and authorised afresh against current context, which is exactly the continuous validation and verification the CISO is describing.
Why the other options are wrong
- A. Secure access service edge converges networking and security delivery at the edge; it is a delivery model rather than the trust principle.
- B. A next-generation firewall inspects traffic at a boundary and does not continuously re-verify a session's authorisation.
- D. Privileged access management governs elevated accounts specifically, a narrower scope than all access to production.
Question 7
Which of the following allows an organization to leverage AI in various forms while protecting business objectives and data?
Show answer and explanation
Correct answer: A. Usage policies
A usage policy is what allows an organisation to adopt AI deliberately rather than by accident. It defines which tools are permitted, what data may be entered into them and what outputs may be relied on, which is how the business gets the benefit while keeping data and objectives protected.
Why the other options are wrong
- B. Prompt engineering improves the quality of results and provides no protection.
- C. A non-disclosure agreement binds a party contractually but does not govern day-to-day use of a tool.
- D. An incident response policy applies once something has gone wrong.
Question 8
A security operations center analyst is using the command line to display specific traffic. The analyst uses the following command: $tshark -r file.pcap -Y "http or udp" Which of the following will the command line display?
Show answer and explanation
Correct answer: B. Unencrypted web requests and DNS traffic
The display filter selects frames Wireshark's dissectors have identified as HTTP together with all UDP traffic. HTTP is web traffic in the clear, and DNS runs over UDP, so the output is unencrypted web requests alongside DNS. Encrypted web traffic is HTTPS over TCP and matches neither term.
Why the other options are wrong
- A. Encrypted web requests are dissected as TLS, not HTTP, so the filter excludes them.
- C. The filter matches a great deal of traffic; it does not exclude everything.
- D. Encrypted web traffic is not matched, so the result cannot include both.
Question 9
Which of the following network architectures would best implement a perimeter-less network topology?
Show answer and explanation
Correct answer: B. Secure access service edge
Secure access service edge dissolves the perimeter by moving security enforcement into a distributed cloud fabric and applying it to the user and the session wherever they are. Access no longer depends on being inside a network boundary, which is what makes the topology perimeter-less.
Why the other options are wrong
- A. A hybrid cloud connects environments and still relies on boundaries between them.
- C. Cloud-native computing describes how applications are built and packaged.
- D. Content delivery networks distribute content geographically to improve performance.
Question 10
A new security operations center (SOC) manager joins a team that struggles to meet service-level agreements (SLAs). The alert backlog continues to increase daily. Which of the following will the manager most likely need to do?
Show answer and explanation
Correct answer: B. Improve the triage processes.
A growing backlog against fixed service levels is a throughput problem in how alerts are assessed and prioritised. Improving triage is what increases the rate at which alerts are correctly dispositioned, so it addresses the cause rather than moving the queue elsewhere.
Why the other options are wrong
- A. Automating escalation moves alerts up the chain faster without reducing the volume needing judgement.
- C. Better threat intelligence improves detection quality over time but does not clear a backlog.
- D. Customer service response addresses perception rather than the work itself.
What people say about the full CS0-004 pack 4.5 from 2
Latest dumps are available at Cert Stash. I gave my CS0-004 certification exam and achieved 92% marks by studying from these sample exams. I suggest Cert Stash to everyone taking the CompTIA CS0-004 exam.
Question 11
A team lead asks an analyst to integrate multiple security tools to provide an enhanced view into data that is not readily available in the tool console. Which of the following will best meet this requirement?
Show answer and explanation
Correct answer: A. Utilizing application programming interfaces
Getting at data the vendor's console does not surface means going to the source directly, and the application programming interface is what exposes it. Pulling from each tool's API lets the team combine and present data on their own terms rather than being limited to the views the products ship with.
Why the other options are wrong
- B. Security orchestration automates response workflows rather than surfacing hidden data.
- C. Infrastructure as code provisions environments.
- D. Playbooks define procedures for handling events.
Question 12
An analyst is assigned to a new cybersecurity improvement project. The analyst wants to better understand the workflow processes and the skill set of the cybersecurity engineers on this task force. The analyst sets up a recurring, weekly conference call. Which of the following best describes the purpose for the conference call?
Show answer and explanation
Correct answer: C. To manage and facilitate team coordination
A standing weekly call among the people doing the work is a coordination mechanism. It is how the analyst builds a picture of the workflows and the skills on the team and keeps the effort aligned as the project runs, which is team coordination rather than training or requirements gathering.
Why the other options are wrong
- A. Incident response training teaches a defined syllabus rather than surfacing how a team works.
- B. Vendor sessions involve external suppliers, who are not part of this task force.
- D. Responding to customer requirements is externally directed work.
Question 13
An analyst uses an AI platform to help correlate events. The AI output contains events that did not happen. This results in inaccurate correlations. Which of the following best describes what has occurred?
Show answer and explanation
Correct answer: A. Hallucinations
A hallucination is a model producing output that is fluent and plausible but not grounded in its input - here, events that never occurred. The defining feature is that the fabrication originates in the model's generation rather than in tampered data or a hostile instruction.
Why the other options are wrong
- B. Data exposure is the unintended disclosure of information, not the invention of it.
- C. Malicious prompts would require an attacker crafting input to steer the model.
- D. Model poisoning corrupts training data to change behaviour, which is a deliberate attack rather than this failure mode.
Question 14
Which of the following best explains the purpose of the Pyramid of Pain in threat intelligence?
Show answer and explanation
Correct answer: A. To show that changing to different types of indicators and behaviors is difficult for an adversary
The Pyramid of Pain expresses how much it hurts an adversary when a defender detects and blocks a given kind of indicator. Its point is that the higher indicators - behaviours and methods - are costly and disruptive for the attacker to change, so defending against those imposes real friction rather than a moment's inconvenience.
Why the other options are wrong
- B. It does not measure damage or dwell time.
- C. It makes no comparison between intelligence sources or their cost.
- D. Categorising activity as spoofing or tampering describes STRIDE, a different model.
Question 15
An analyst is configuring a security information and event management system to capture fileless malware execution events. Which of the following log files requires additional configuration to accomplish this task?
Show answer and explanation
Correct answer: B. Microsoft-Windows-PowerShell/Operational
Fileless malware runs in memory, and on Windows that overwhelmingly means PowerShell. Capturing it requires the PowerShell operational log with script block and module logging enabled, because the default configuration records that PowerShell ran without recording what it executed.
Why the other options are wrong
- A. The DPAPI log covers data protection API activity, not script execution.
- C. The device installation log records hardware and driver events.
- D. The terminal services log records remote session connections.
Question 16
An incident response team identifies a malicious uniform resource locator (URL) associated with a required business process and performs the following activities: • Access to the URL has been restricted only to the necessary users through firewall rules and Cloud Security Group rules. • Additional monitoring has been enabled for traffic related to that site and the allowed users. • All application servers that need to access that site have been patched with the latest security and software updates. • Application owners have been notified of the severity and need to remediate this reported issue. Which of the following best describes the overall mitigation the security team is performing?
Show answer and explanation
Correct answer: C. Compensating controls
The URL cannot be blocked because a business process depends on it, so the team has not remediated the risk; it has surrounded it. Restricting access, increasing monitoring and patching the systems that must reach it are alternative controls that reduce exposure while the underlying risk remains, which is the definition of compensating controls.
Why the other options are wrong
- A. Patching is one of the measures listed, not a description of the combined approach.
- B. Configuration management maintains consistent system state and does not describe this risk response.
- D. Attack surface management is the ongoing discovery of exposure, not this targeted set of mitigations.
Question 17
Which of the following is the most likely reason an organization might implement compensating controls?
Show answer and explanation
Correct answer: A. A vulnerability does not have a patch, and the system is mission critical.
A compensating control exists to satisfy a security requirement when the intended control cannot be used. That situation arises precisely when a vulnerability has no available fix and the affected system is too important to take out of service, leaving the organisation to reduce exposure by other means.
Why the other options are wrong
- B. A vulnerability that has been fixed and deployed needs no compensating measure.
- C. If the organisation does not use the affected system there is no exposure to compensate for.
- D. A confirmed false positive represents no real risk.
Question 18
A security architect works with a client on security operations center (SOC) capabilities. The security architect wants to ensure the log correlation and investigation activities are accurate across the infrastructure. Which of the following is the best for the client to implement?
Show answer and explanation
Correct answer: A. Network Time Protocol (NTP)
Correlating events across many systems depends on their timestamps meaning the same thing. Without synchronised clocks, records from different hosts cannot be reliably ordered and an investigation can reach the wrong conclusion about cause and sequence, so NTP is the foundation that makes correlation accurate.
Why the other options are wrong
- B. Zero Trust Network Access governs how access is granted.
- C. Account federation unifies identity across systems, not time.
- D. Secure access service edge delivers network security from the cloud.
- E. APIs move data between tools but do not make its timestamps comparable.
Question 19
The Chief Information Officer (CIO) is requiring users to phase out a legacy system that no longer receives security updates because the system will be decommissioned soon. Which of the following risk management strategies is the CIO using?
Show answer and explanation
Correct answer: A. Avoidance
Removing the system from the environment eliminates the risk rather than reducing it, and eliminating the activity that carries the risk is the definition of avoidance. Because the legacy system will no longer exist, no residual exposure remains to manage.
Why the other options are wrong
- B. Mitigation reduces likelihood or impact while keeping the system in service.
- C. Acceptance means continuing to run the system and tolerating the exposure.
- D. Transference shifts the consequence to another party, such as through insurance or a contract.
Question 20
A security team reviews a penetration testing report of a web application that contains multiple cross-site scripting (XSS) and Structured Query Language injection (SQLi) vulnerabilities. Which of the following is most likely causing these to occur?
Show answer and explanation
Correct answer: B. Lack of secure input validation
Cross-site scripting and SQL injection are both injection flaws with the same root cause: data supplied by a user is accepted and used without being validated or properly handled. Finding both classes in one application points at the shared defect rather than at two separate problems, and secure input validation is the control that addresses both.
Why the other options are wrong
- A. A misconfigured WAF fails to block the attacks but does not create the underlying flaws.
- C. HSTS forces the browser to use HTTPS and has no bearing on injection.
- D. Endpoint protection defends the workstation, not the web application's input handling.
Question 21
Which of the following is the most difficult for threat actors to change according to the Pyramid of Pain model?
Show answer and explanation
Correct answer: A. Tactics, techniques, and procedures
The Pyramid of Pain ranks indicators by how much it costs an adversary to change them. Tactics, techniques and procedures sit at the apex because they reflect how the group actually operates; altering them means retraining people and redesigning operations, which is far harder than reissuing an address or recompiling a tool.
Why the other options are wrong
- B. Tools sit below TTPs; an equivalent utility can be substituted with moderate effort.
- C. Domain names are cheap to register and rotate.
- D. IP addresses are the easiest of all to change and sit at the base of the pyramid.
Question 22
Before merging with a software company, the acquiring company's legal team requires a detailed software scan to determine if all code base is using open-source or paid licensed libraries. The vulnerability management analyst needs to provide this report. Which of the following scan methods will best meet this requirement?
Show answer and explanation
Correct answer: C. Software composition analysis (SCA)
Software composition analysis inventories the third-party and open-source components a codebase includes and reports the licence attached to each. That inventory is exactly what the legal team needs before an acquisition, and no other scan type in the list examines licensing at all.
Why the other options are wrong
- A. Static analysis inspects the organisation's own source for defects, not the licences of imported libraries.
- B. Dynamic testing exercises the running application from outside and cannot see component licensing.
- D. Runtime self-protection defends an application in production.
- E. A credentialed vulnerability scan finds missing patches and misconfigurations on hosts.
Question 23
A security analyst uses a full pcap solution to extract all traffic from the last two days associated with the 10.213.4.27 file server. This file server is under investigation due to concerns about potential data exfiltration using Domain Name System (DNS) traffic. Which of the following commands should the analyst use to extract any potentially leaked data from the suspicious.pcap file?
Show answer and explanation
Correct answer: D. tcpdump -r suspicious.pcap port 53 and host 10.213.4.27
DNS exfiltration hides data inside queries to port 53, so the analyst needs those packets and only those. A tcpdump read filter combining the port with the file server's address extracts exactly that subset from the capture, giving the DNS conversations the investigation is concerned with.
Why the other options are wrong
- A. strings pulls printable text from the whole file with no protocol awareness, discarding which packets it came from.
- B. Zeek generates its own log set and grepping file.log for the address does not isolate DNS traffic.
- C. The syntax is wrong and Snort is a detection engine rather than an extraction tool.
Question 24
A vendor releases details of a new vulnerability. When an analyst reviews the scheduled scans, no vulnerabilities are identified. The vulnerability is only discovered after a configuration change. Which of the following scan types did the analyst configure?
Show answer and explanation
Correct answer: C. Agent-based
An agent runs continuously on the host and evaluates it against current definitions, so it detects a condition introduced between scheduled scans as soon as the configuration changes. A scan that only runs on a schedule would have found nothing at its last execution, which matches what the analyst observed.
Why the other options are wrong
- A. An external scan assesses internet-facing exposure and would not observe an internal configuration change.
- B. A credentialed scan is more thorough but still only runs when scheduled.
- D. A network scan sees services from the network and runs on the same schedule.
That was 24 of 95.
The full CompTIA CySA+ CS0-004 pack has all 95 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 47 free as one PDF by email. Get the Half Pack →