10 free CompTIA CySA+ CS0-004 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 82 questions. Work through them, then open each answer to check your reasoning.
Get all 82 questions (US$39) · Download these 10 as a PDF
Question 1
Which of the following is the most important reason why tactics, techniques, and procedures (TTP) are beneficial to a defensive strategy?
Show answer and explanation
Correct answer: D. TTP provides useful insights on the strategy and behavior of an attacker.
Tactics, techniques and procedures describe how an adversary operates rather than what artefacts they happened to leave behind. Hashes and IP addresses change the moment an attacker rebuilds their infrastructure, but the strategy and behaviour behind an intrusion is costly to change and tends to persist across campaigns. Defending against behaviour therefore keeps working after the indicators have rotated.
Why the other options are wrong
- A. Hash values and IP addresses are the most disposable indicators an attacker has; they are trivially changed.
- B. Indicators of compromise are the artefacts left by an attack, not the behaviour that produced it.
- C. Tooling can be swapped for an equivalent utility without changing how the adversary operates.
Question 2
Which of the following is the best reason to heavily segment business-critical assets from within the network?
Show answer and explanation
Correct answer: A. Legacy systems
Legacy systems are the reason segmentation has to be heavy rather than nominal. They frequently cannot be patched, cannot run modern endpoint controls and cannot be replaced without breaking a business process, so the only control left is to restrict what can reach them. Segmentation compensates for protections the asset itself cannot carry.
Why the other options are wrong
- B. Degraded functionality is a consequence of segmenting, not a reason to do it.
- C. Asset obfuscation hides an asset's identity and is a side effect rather than the driver.
- D. A proprietary server describes what the asset is, not why it needs isolating.
Question 3
A cybersecurity analyst receives an unstructured text document that contains advanced persistent threat (APT)-related indicators of compromise (IoCs). The analyst needs to extract the IPv4 addresses.
Which of the following is the best tool to accomplish this task?
Show answer and explanation
Correct answer: A. CyberChef
CyberChef is built for exactly this: transforming and extracting data from unstructured text through chained operations, including a recipe that pulls IPv4 addresses out of arbitrary content. The document is text rather than captured traffic, so a parsing and extraction tool is the right instrument.
Why the other options are wrong
- B. Wireshark analyses packet captures and cannot process a text document.
- C. Zeek generates logs from live or captured network traffic, not from prose.
- D. OpenCTI stores and relates threat intelligence once it is structured; it is not an extraction tool.
Question 4
Which of the following best describes why operational technology (OT) devices use compensating controls?
Show answer and explanation
Correct answer: C. Traditional IT security solutions may not be compatible.
Operational technology runs on real-time and often decades-old platforms that cannot host an agent, cannot tolerate a scan and cannot be taken offline to patch. Because the standard controls simply will not run there, the organisation applies compensating controls – segmentation, monitoring, strict access – that achieve the security objective by another route.
Why the other options are wrong
- A. Bandwidth consumption is a performance consideration, not the reason a control cannot be applied.
- B. Scheduled outage windows make maintenance easier, which argues against needing compensation.
- D. Lack of encryption is one specific gap rather than the general incompatibility that drives the approach.
Question 5
The Chief Information Security Officer (CISO) reviews the following security operations metrics from the last month:
Which of the following is the best action to improve overall security operations efficiency?
Show answer and explanation
Correct answer: B. Analyze and tune the detections that are causing non-actionable alerts.
Non-actionable alerts consume analyst time without producing any security outcome, and they are the direct cause of backlog and missed genuine detections. Tuning the detections that generate them removes the work at its source, which improves efficiency far more than adding context or training around a volume problem that should not exist.
Why the other options are wrong
- A. Adding asset context makes each alert faster to judge but does not reduce how many arrive.
- C. Playbooks standardise handling and still require an analyst to work every alert.
- D. Training helps analysts process alerts; it does not stop the useless ones being raised.
Question 6
A public threat intelligence report includes indicators of compromise (IoCs) for threat actors. The threat actors are exploiting a zero-day vulnerability that the vendor has not fixed.
Which of the following techniques should be used until a patch is available?
Show answer and explanation
Correct answer: C. Continuous monitoring
No patch exists, so the flaw itself cannot be closed and the realistic interim goal is to know at once if it is exploited. Feeding the published IoCs into continuous monitoring gives that early warning across the environment and holds the risk until the vendor ships a fix, which is why it is the stated technique.
Why the other options are wrong
- A. Sinkholing only redirects traffic to known malicious domains that actors rotate; it leaves the unpatched flaw exploitable.
- B. Eradication removes an attacker who is already present; nothing indicates a compromise yet.
- D. Evidence acquisition is a forensic activity performed after an incident is confirmed.
Question 7
The Chief Information Security Officer wants to improve internal security measures by continuously validating and verifying access to the production environment.
Which of the following concepts best describes this practice?
Show answer and explanation
Correct answer: C. Zero Trust
Zero Trust removes any notion of implicit trust based on location or prior authentication. Every request to the production environment is authenticated and authorised afresh against current context, which is exactly the continuous validation and verification the CISO is describing.
Why the other options are wrong
- A. Secure access service edge converges networking and security delivery at the edge; it is a delivery model rather than the trust principle.
- B. A next-generation firewall inspects traffic at a boundary and does not continuously r-erify a session's authorisation.
- D. Privileged access management governs elevated accounts specifically, a narrower scope than all access to production.
Question 8
Which of the following allows an organization to leverage AI in various forms while protecting business objectives and data?
Show answer and explanation
Correct answer: A. Usage policies
A usage policy is what allows an organisation to adopt AI deliberately rather than by accident. It defines which tools are permitted, what data may be entered into them and what outputs may be relied on, which is how the business gets the benefit while keeping data and objectives protected.
Why the other options are wrong
- B. Prompt engineering improves the quality of results and provides no protection.
- C. A non-disclosure agreement binds a party contractually but does not govern day-t-ay use of a tool.
- D. An incident response policy applies once something has gone wrong.
Question 9
A security operations center analyst is using the command line to display specific traffic. The analyst uses the following command:
$tshark -r file.pcap -Y "http or udp"
Which of the following will the command line display?
Show answer and explanation
Correct answer: B. Unencrypted web requests and DNS traffic
The display filter selects frames Wireshark's dissectors have identified as HTTP together with all UDP traffic. HTTP is web traffic in the clear, and DNS runs over UDP, so the output is unencrypted web requests alongside DNS. Encrypted web traffic is HTTPS over TCP and matches neither term.
Why the other options are wrong
- A. Encrypted web requests are dissected as TLS, not HTTP, so the filter excludes them.
- C. The filter matches a great deal of traffic; it does not exclude everything.
- D. Encrypted web traffic is not matched, so the result cannot include both.
Question 10
Which of the following network architectures would best implement a perimeter-less network topology?
Show answer and explanation
Correct answer: B. Secure access service edge
Secure access service edge dissolves the perimeter by moving security enforcement into a distributed cloud fabric and applying it to the user and the session wherever they are. Access no longer depends on being inside a network boundary, which is what makes the topology perimeter-less.
Why the other options are wrong
- A. A hybrid cloud connects environments and still relies on boundaries between them.
- C. Cloud-native computing describes how applications are built and packaged.
- D. Content delivery networks distribute content geographically to improve performance.
That was 10 of 82.
The full CompTIA CySA+ CS0-004 pack has all 82 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.