CompTIA CySA+ (CS0-004) Practice Exam

What the CompTIA CySA+ (CS0-004) exam covers

• Security Operations313 questions
• Vulnerability Management229 questions
• Incident Response and Management188 questions
• Reporting and Communication157 questions

Free CompTIA CySA+ (CS0-004) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 887.

1. Question 1Security Operations

   What is the primary purpose of a SIEM?

   • ATo aggregate and correlate logs/events from many sources for detection, alerting, and analysisCorrect
   • BTo route packets between VLANs and enforce spanning-tree topology across switches
   • CTo orchestrate container scheduling and scale microservice workloads on demand
   • DTo terminate TLS sessions and cache static web content at the network edge
   ✓ Correct answer: A

   This is the correct answer. The explanation addresses the core security principles and practices required in the CySA+ domain.

   Why the other options are wrong

   • BInter-VLAN routing and spanning tree are switch/router functions, not what a SIEM does.
   • CContainer scheduling and scaling is the job of an orchestrator like Kubernetes, not a SIEM.
   • DTLS termination and content caching are reverse-proxy/CDN roles, unrelated to log correlation.
2. Question 2Incident Response and ManagementSelect all that apply

   Which TWO preparation investments most reduce the eventual cost and duration of incidents? (Choose TWO)

   • ALeaving roles and escalation undefined until an incident occurs
   • BTested IR playbooks and regular tabletop exercises so responders act quickly and consistentlyCorrect
   • CPre-provisioned tooling, access, and forensic capacity ready before an incidentCorrect
   • DNegotiating responder hourly rates only after a breach begins
   ✓ Correct answer: B, C

   Pre-provisioned tooling, access, and forensic capacity ready before an incident This is the correct answer. The explanation addresses the core security principles and practices required in the CySA+ domain.

   Why the other options are wrong

   • ALeaving roles and escalation undefined until an incident occurs is incorrect because it does not align with the primary security objective.
   • DNegotiating responder hourly rates only after a breach begins is incorrect because it does not align with the primary security objective.
3. Question 3Security Operations

   An organization mapping detections to MITRE ATT&CK finds heavy coverage of Execution but none of Defense Evasion. What does this gap analysis reveal?

   • AA blind spot where evasion techniques could succeed undetected, guiding new detection engineeringCorrect
   • BThat the organization is now fully protected against all adversary techniques
   • CThat Defense Evasion techniques are not catalogued anywhere in ATT&CK
   • DThat Execution coverage is redundant and those detections should be removed
   ✓ Correct answer: A

   This is the correct answer. The explanation addresses the core security principles and practices required in the CySA+ domain.

   Why the other options are wrong

   • BA single well-covered tactic does not equal full protection across the matrix.
   • CDefense Evasion is a defined tactic with many techniques in ATT&CK.
   • DExisting Execution coverage is valuable and removing it would create a new gap.
4. Question 4Reporting and Communication

   A breach affecting EU residents' personal data is confirmed. The privacy team flags a 72-hour clock. What does this MOST directly drive in the communication plan?

   • AThe schedule for rotating the corporate wireless network passwords
   • BThe publication date of the next quarterly financial results
   • CThe timing of the routine annual disaster-recovery drill
   • DRegulatory breach-notification timelines that must be met (e.g., GDPR)Correct
   ✓ Correct answer: D

   This is the correct answer. The explanation addresses the core security principles and practices required in the CySA+ domain.

   Why the other options are wrong

   • AWi-Fi password rotation is a routine security task, not a driver of the breach-notification clock.
   • BFinancial results publication is a business calendar item unrelated to a 72-hour breach deadline.
   • CAn annual DR drill is planned resilience testing, not a regulatory disclosure requirement.
5. Question 5Incident Response and Management

   A security analyst is reviewing an endpoint detection alert indicating a process injected code into a legitimate Windows binary. Which forensic artifact best confirms code injection occurred?

   • APrefetch files in C:\Windows\Prefetch
   • BMemory analysis showing foreign executable sections within a trusted processCorrect
   • CWindows Event Log ID 4688 showing process creation
   • DAppCompatCache (Shimcache) entries for the injected executable
   ✓ Correct answer: B

   Code injection places attacker-controlled shellcode or a DLL into the address space of a legitimate process. Memory forensics tools such as Volatility can detect this by finding executable memory regions within a trusted process that do not correspond to any mapped disk file (malfind plugin), confirming injection without requiring the injected code to exist as a standalone file on disk.

   Why the other options are wrong

   • APrefetch files record execution history of standalone executables; injected code that never runs as its own process will not create a prefetch entry, making this artifact unreliable for confirming injection.
   • CWindows Event ID 4688 captures process creation events, but injected code runs within an existing process's context and does not generate a new process creation event.
   • DAppCompatCache (Shimcache) tracks executable file metadata for compatibility purposes; code that is injected directly into memory without being loaded from a recognized executable path may not appear in Shimcache.
6. Question 6Security Operations

   An analyst reviewing authentication telemetry sees many successful logons immediately following a single failed logon across hundreds of accounts, one attempt per account. Which attack pattern does this BEST match?

   • ABrute-force against one account
   • BPassword sprayingCorrect
   • CGolden ticket forgery
   • DSQL injection
   ✓ Correct answer: B

   Password spraying tries one or a few common passwords against many usernames to avoid per-account lockout thresholds, producing a wide, shallow pattern rather than many failures on a single account. Detecting it requires correlating failed logons across the account population, not per-account thresholds. The broad fan-out is the distinguishing signal.

   Why the other options are wrong

   • ABrute force concentrates many attempts on a single account, the opposite of the observed fan-out.
   • CA golden ticket forges Kerberos TGTs and would not present as repeated username/password attempts.
   • DSQL injection targets databases via web inputs, not authentication logon events.
7. Question 7Vulnerability ManagementSelect all that apply

   Which TWO are accurate distinctions between an SBOM and a traditional vulnerability scan report? (Choose TWO)

   • AAn SBOM inventories software components and dependencies, enabling later matching against new advisoriesCorrect
   • BA vulnerability scan report identifies known weaknesses present at the time of the scanCorrect
   • CAn SBOM assigns CVSS scores and remediation deadlines to each component
   • DA vulnerability scan report is a machine-readable component inventory format like SPDX or CycloneDX
   ✓ Correct answer: A, B

   An SBOM (in formats like SPDX or CycloneDX) enumerates every component and dependency so that when a new CVE is disclosed, teams can instantly see which software is affected. A scan report, by contrast, is a point-in-time list of detected vulnerabilities. The two are complementary, not interchangeable.

   Why the other options are wrong

   • CAn SBOM lists components; it does not itself assign CVSS scores or deadlines, though those can be derived later.
   • DSPDX and CycloneDX are SBOM formats, not vulnerability-scan-report formats.
8. Question 8Reporting and CommunicationSelect all that apply

   A security team is designing an executive-facing risk register to accompany its quarterly report. Which TWO attributes should each register entry include to make it decision-useful for leadership? (Choose TWO)

   • AA risk owner accountable for the remediation or acceptance decisionCorrect
   • BA business-impact rating expressed in terms leadership understandsCorrect
   • CThe full packet capture supporting the underlying detection
   • DThe raw vulnerability scanner plugin output for each item
   ✓ Correct answer: A, B

   A risk register drives executive decisions, so every entry needs a named owner who is accountable for treatment and an impact rating framed in business consequences (financial, regulatory, operational). These let leadership prioritize and assign accountability.

   Why the other options are wrong

   • CPacket captures are forensic artifacts irrelevant to an executive risk register and would obscure the decision.
   • DRaw scanner plugin output is technical noise that does not help leadership prioritize risk.
9. Question 9Security Operations

   While reviewing a vendor threat report, an analyst sees the same campaign attributed differently by two firms. To reduce the chance of acting on a single biased source, the analyst cross-checks the claim against multiple independent feeds before raising confidence. Which intelligence practice is the analyst applying?

   • ACorroboration of indicators across multiple independent sourcesCorrect
   • BAccepting the first source as authoritative to save time
   • CIgnoring attribution because it is never useful
   • DLowering confidence whenever any source disagrees, regardless of evidence
   ✓ Correct answer: A

   Corroboration reduces reliance on any single, potentially biased source. When independent feeds agree on an indicator or attribution, the analyst can justifiably increase confidence; conflicting reports prompt further investigation rather than blind acceptance.

   Why the other options are wrong

   • BTreating the first source as authoritative is the bias-prone behavior corroboration is meant to prevent.
   • CAttribution can inform defensive priorities; dismissing it outright is not the practice described.
   • DAutomatically dropping confidence on any disagreement ignores the weight of evidence; corroboration weighs sources rather than reacting to one dissent.
10. Question 10Incident Response and Management

    After a phishing-driven compromise, the team applies a temporary email-gateway rule to block the malicious sender domain and isolates the impacted mailboxes for several days while a permanent filtering policy is engineered. The multi-day isolation step BEST represents which activity?

    • ALong-term containmentCorrect
    • BEradication
    • CDetection and analysis
    • DLessons learned
    ✓ Correct answer: A

    Long-term containment applies more stable, lasting controls that allow operations to continue safely while the team prepares full eradication and a permanent solution. Maintaining isolation of affected mailboxes for several days, and keeping interim blocking rules in place until a permanent filter is built, fits this phase. It bridges the gap between immediate short-term isolation and complete eradication.

    Why the other options are wrong

    • BEradication removes the threat and root cause entirely; here the team is still holding the threat at bay, not removing it.
    • CDetection and analysis identifies and scopes the incident, which has already occurred before this containment step.
    • DLessons learned is a post-incident review, not an ongoing technical containment measure.

Related Security resources

• CompTIA CySA+ (CS0-004) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

CompTIA CySA+ (CS0-004) practice exam FAQ