CompTIA CySA+ (CS0-004) Practice Exam

What the CompTIA CySA+ (CS0-004) exam covers

• Security Operations311 questions
• Vulnerability Management234 questions
• Incident Response and Management216 questions
• Reporting and Communication146 questions

Free CS0-004 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 907.

1. Question 1Security Operations

   What is the primary purpose of a SIEM?

   • ATo aggregate and correlate logs/events from many sources for detection, alerting, and analysisCorrect
   • BTo route packets between VLANs and enforce spanning-tree topology across switches
   • CTo orchestrate container scheduling and scale microservice workloads on demand
   • DTo terminate TLS sessions and cache static web content at the network edge
   ✓ Correct answer: A

   A SIEM ingests logs from endpoints, firewalls, servers, and applications, normalizes them, and applies correlation rules to surface patterns like multiple failed logins or lateral movement that no single log source reveals alone. Analysts use these correlated alerts and dashboards to detect and investigate incidents faster than manually reviewing disparate logs. The other options describe networking (VLAN routing/STP), container orchestration, and edge caching/TLS termination - none involve log correlation.

   Why the other options are wrong

   • BDescribes Layer 2/3 switching and spanning-tree topology, a networking function unrelated to log correlation or detection.
   • CDescribes container orchestration platforms like Kubernetes, a workload-scheduling function, not security monitoring.
   • DDescribes a reverse proxy or CDN function (TLS termination, content caching), not a SIEM's detection role.
2. Question 2Security Operations

   Which tcpdump command captures only DNS traffic on interface eth0 and writes it to a file for later analysis?

   • Atcpdump --dns eth0 -o dns.pcap
   • Btcpdump -i eth0 port 53 -w dns.pcapCorrect
   • Ctcpdump -i eth0 host 53 > dns.pcap
   • Dtcpdump -i eth0 -r dns.pcap port 53
   ✓ Correct answer: B

   tcpdump's -i selects the capture interface, port 53 filters traffic to DNS's standard port across both TCP and UDP, and -w writes the raw captured packets to a pcap file for later analysis in tools such as Wireshark. This is the only option using tcpdump's real, correctly ordered flags; the alternatives invoke nonexistent options, misuse the host filter, or read from a file instead of capturing live traffic.

   Why the other options are wrong

   • Atcpdump has no --dns flag and -o is not a valid write option; this command would fail to parse.
   • CThe host filter matches an IP address or hostname, not a port number, so 'host 53' is a malformed filter; redirecting with > also captures text output, not a proper binary pcap file.
   • D-r reads packets from an existing capture file rather than capturing live traffic, so this command tries to replay dns.pcap instead of creating it, backwards from what's needed.
3. Question 3Security Operations

   What is the primary benefit of synchronizing all log sources to a common, authoritative time source via NTP?

   • AStronger cryptographic protection of log data while it is in transit
   • BLower disk consumption on the centralized log servers
   • CAutomatic detection and deletion of duplicate log events
   • DAccurate event correlation and reliable timeline reconstruction across systemsCorrect
   ✓ Correct answer: D

   When every host, firewall, and application derives its clock from the same authoritative time source, timestamps across disparate logs can be compared and sequenced with confidence, letting analysts build a precise attack timeline during incident investigation and SIEM correlation. Without synchronized time, clock drift between systems can make an attacker's actions appear out of order or unrelated. NTP synchronization has no bearing on log encryption, storage consumption, or automatic duplicate-event removal.

   Why the other options are wrong

   • AFalse - NTP synchronizes clock time only; it provides no cryptographic protection or encryption for log data in transit.
   • BFalse - time synchronization does not reduce the volume or size of log data being stored; disk consumption is unrelated to clock accuracy.
   • CFalse - NTP has no deduplication function; detecting and removing duplicate log events requires separate log-processing or SIEM normalization logic.
4. Question 4Security Operations

   What is the primary security benefit of the principle of least privilege?

   • AIt reduces the time required to complete user authentication
   • BIt eliminates the organization's need to maintain any logging or audit trails at all
   • CIt automatically encrypts all stored account credentials
   • DIt limits the damage from compromised accounts by granting only the access needed for a roleCorrect
   ✓ Correct answer: D

   By constraining every account to the minimum permissions required for its job function, least privilege shrinks the blast radius when credentials are stolen or an insider account is compromised, since the attacker inherits only that limited access rather than broad rights. It does not speed up authentication, does not remove the need for logging and monitoring, and has no relationship to how credentials are encrypted at rest.

   Why the other options are wrong

   • ALeast privilege governs access scope, it does not speed up authentication.
   • BRestricting privileges does not remove the need to log activity or maintain audit trails at all - logging and least privilege are independent controls.
   • CLeast privilege limits access rights, it does not encrypt stored credentials.
5. Question 5Incident Response and Management

   During a ransomware incident, the IR team needs to determine the initial access vector. Which artifact would MOST likely reveal whether a malicious email attachment was opened as the initial vector?

   • ADNS query logs from the recursive resolver showing outbound lookups to the C2 domain and NXDOMAIN response bursts
   • BEmail gateway logs combined with endpoint process creation logs showing a child process spawned by the mail clientCorrect
   • CDHCP lease assignment logs correlating the affected host to its IP over time
   • DFirewall session logs recording the outbound HTTPS flows from the victim host
   ✓ Correct answer: B

   When a user opens a malicious email attachment, the email client (Outlook, Thunderbird, etc.) launches a child process - such as a macro-enabled Office document executing cmd.exe or PowerShell. Correlating email gateway delivery logs (showing message receipt, sender, and attachment) with endpoint process creation logs (Event ID 4688) that show a parent-child relationship from the mail client confirms phishing as the initial access vector.

   Why the other options are wrong

   • ADNS query logs may show later C2 lookups and NXDOMAIN bursts but do not tie an opened attachment to initial access.
   • CDHCP lease logs only map hosts to addresses and reveal nothing about an opened attachment.
   • DFirewall session logs show network flows, not whether a mail-client attachment was opened.
6. Question 6Security Operations

   A junior analyst asks why the SOC tracks the percentage of alerts closed as false positives over time. What is the primary operational value of this metric?

   • AIt directly measures the financial loss from breaches
   • BIt indicates detection-rule quality and signals where tuning is neededCorrect
   • CIt replaces the need for an incident-response plan
   • DIt certifies regulatory compliance automatically
   ✓ Correct answer: B

   A rising false-positive percentage shows analysts are spending effort on non-incidents, which drives alert fatigue. Tracking it per rule lets the SOC tune or retire low-fidelity detections and reallocate analyst time to genuine threats.

   Why the other options are wrong

   • AFalse-positive rate reflects alert quality, not the monetary impact of actual breaches.
   • CA metric cannot substitute for a documented IR plan; the two serve different purposes.
   • DNo single metric automatically certifies compliance with any regulatory framework.
7. Question 7Vulnerability Management

   A vulnerability scan must run against a PCI cardholder data environment that is on an isolated network segment with no inbound route from the main scanner. Which architectural component best enables scanning that segment?

   • AA scan engine/sensor deployed inside the isolated segment that reports back to the central consoleCorrect
   • BA single external scanner positioned on the internet edge of the network
   • CTemporarily removing the network segmentation for the duration of the scan window
   • DIncreasing the central scanner's connection timeout values for that segment
   ✓ Correct answer: A

   Network-segmented or air-gapped zones cannot be reached by a single central scanner. Deploying a local scan engine/sensor within the segment that securely communicates results to the console preserves segmentation while achieving coverage, a common requirement for PCI CDE assessments.

   Why the other options are wrong

   • BAn edge scanner still has no inbound route into the isolated CDE and cannot reach the hosts.
   • CDropping segmentation to scan violates PCI isolation requirements and exposes the CDE.
   • DLonger timeouts do not create a route where none exists into the isolated segment.
8. Question 8Reporting and Communication

   An analyst uses awk to print the second column (the source IP) from a space-delimited firewall log named deny.log for an incident report. Which command is correct?

   • Aawk '{print $2}' deny.logCorrect
   • Bawk '{print 2}' deny.log
   • Cawk -F2 deny.log
   • Dawk 'print $2' deny.log
   ✓ Correct answer: A

   In awk, fields are referenced with a dollar sign and number, so $2 is the second column, and the action must be enclosed in braces within single quotes. With the default field separator (whitespace), this prints the source IP column for every record in deny.log.

   Why the other options are wrong

   • Bprint 2 outputs the literal number 2 on every line, not the field value, because $ is missing.
   • C-F sets the field separator, not a column to print, and provides no print action.
   • DThe action must be wrapped in braces; awk treats an unbraced expression as a pattern and errors.
9. Question 9Vulnerability Management

   An organization is building its asset inventory to drive vulnerability prioritization. Two systems both have a critical, internet-reachable vulnerability: a public marketing microsite with no sensitive data, and the payment-processing application that handles cardholder data. Both share the same CVSS base score. Which factor MOST justifies remediating the payment application first?

   • AAsset criticality and data sensitivity, which make the business impact of compromise far higher for the payment applicationCorrect
   • BThe payment application has more lines of code, so it is statistically more likely to be exploited
   • CThe marketing microsite is newer, so its vulnerability is less mature
   • DCVSS base score is the only valid prioritization input, so the two are tied and remediation order does not matter at all
   ✓ Correct answer: A

   CVSS base score measures technical severity in isolation and is the same for both systems here. Prioritization must layer on business context: the payment application processes regulated cardholder data and is mission critical, so a compromise carries far greater financial, regulatory, and reputational impact than a static marketing page. Asset criticality and data classification are exactly the inputs that resolve ties between findings of equal CVSS severity.

   Why the other options are wrong

   • BLines of code is not a recognized exploitation-likelihood metric and does not drive remediation order.
   • CAsset age does not change a shared CVSS score or the business value of the data each system handles.
   • DCVSS alone is insufficient for prioritization; asset criticality, data sensitivity, exposure, and exploitability all matter for ordering work.
10. Question 10Incident Response and Management

    An analyst maps observed adversary techniques onto the MITRE ATT&CK matrix and produces a heat map highlighting which techniques the organization can currently detect and which it cannot. What is the primary value of this exercise to the IR program?

    • AIt reveals detection coverage gaps so the team can prioritize new analytics against likely attacker behaviorsCorrect
    • BIt ranks the organization's currently open vulnerabilities strictly by CVSS score for patch sequencing
    • CIt documents the recovery time objective for each business-critical system
    • DIt measures which security tools generate the most alert volume each month
    ✓ Correct answer: A

    Overlaying detection capability on the ATT&CK matrix shows which tactics and techniques are covered and which are blind spots. This drives prioritized investment in new detections and data sources aligned to adversary behavior, improving the odds of catching real intrusions earlier in the kill chain.

    Why the other options are wrong

    • BCVSS-based vulnerability ranking is a separate activity from mapping detection coverage of ATT&CK techniques.
    • CRecovery time objectives are a continuity-planning metric, not what a detection-coverage heat map shows.
    • DTallying alert volume by tool measures noise, not which adversary techniques the team can or cannot detect.

Who this CompTIA CySA+ (CS0-004) practice exam is for

This practice set is for anyone preparing for the CompTIA CySA+ (CS0-004) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CompTIA CySA+ (CS0-004) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real CompTIA CySA+ (CS0-004) exam.

Related Security resources

• CompTIA CySA+ (CS0-004) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Best Security+ Practice Exams (2026)Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• CompTIA PenTest+ (PT0-003) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated

CompTIA CySA+ (CS0-004) practice exam FAQ