Free CompTIA CS0-004 Practice Questions & Answers 2026 Part3 | CompTIA CySA+

A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there areseveral RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?

A SOC analyst needs to inspect suspicious network packets and identify protocol anomalies during an incident investigation. Which TWO tools are MOST appropriate? (Choose two.)

Several reports of sensitive information are being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?

A virtual web server in a server pool was infected with malware after an analyst used the internet to research a system issue. After the server was rebuilt and added back into the server pool, users reported issues with the website, indicating the site could not be trusted. Which of the following is the most likely cause of the server issue?

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date. Which of the following best describes a security analyst's concern?

Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has:created the initial evidence log.disabled the wireless adapter on the device.interviewed the employee, who was unable to identify the website that was accessed.reviewed the web proxy traffic logs.Which of the following should the analyst do to remediate the infected device?

A company receives a penetration test report summary from a third party. The report summary indicates a proxy has some patches that need to be applied. The proxy is sitting in a rack and is not being used, as the company has replaced it with a new one. The CVE score of the vulnerability on the proxy is a 9.8. Which of the following best practices should the company follow with this proxy?

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

Which of the following entities must receive reports in a timely fashion according to data breach notification laws related to personally identifiable information?

A company is in the process of implementing a vulnerability management program. Which of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

Which of the following best describes the importance of implementing TAXII as part of a threat intelligence program? The correct answer is B. It proactively facilitates real-time information sharing between the public and private sectors. TAXII, or Trusted Automated eXchange of Intelligence Information, is a standard protocol for sharing cyber threat intelligence in a standardized, automated, and secure manner. TAXII defines how cyber threat information can be shared via services and message exchanges, such as discovery, collection management, inbox, and poll. TAXII is designed to support STIX, or Structured Threat Information eXpression, which is a standardized language for describing cyber threat information in a readable and consistent format. Together, STIX and TAXII form a framework for sharing and using threat intelligence, creating an open-source platform that allows users to search through records containing attack vectors details such as malicious IP addresses, malware signatures, and threat actors123. The importance of implementing TAXII as part of a threat intelligence program is that it proactively facilitates real-time information sharing between the public and private sectors. By using TAXII, organizations can exchange cyber threat information with various entities, such as security vendors, government agencies, industry associations, or trusted groups. TAXII enables different sharing models, such as hub and spoke, source/subscriber, or peer-to-peer, depending on the needs and preferences of the information producers and consumers. TAXII also supports different levels of access control, encryption, and authentication to ensure the security and privacy of the shared information123. By implementing TAXII as part of a threat intelligence program, organizations can benefit from the following advantages: They can receive timely and relevant information about the latest threats and vulnerabilities that may affect their systems or networks. They can leverage the collective knowledge and experience of other organizations that have faced similar or related threats. They can improve their situational awareness and threat detection capabilities by correlating and analyzing the shared information. They can enhance their incident response and mitigation strategies by applying the best practices and recommendations from the shared information. They can contribute to the overall improvement of cyber security by sharing their own insights and feedback with other organizations123. The other options are incorrect because they do not accurately describe the importance of implementing TAXII as part of a threat intelligence program. Option A is incorrect because TAXII does not provide a structured way to gain information about insider threats. Insider threats are malicious activities conducted by authorized users within an organization, such as employees, contractors, or partners. Insider threats can be detected by using various methods, such as user behavior analysis, data loss prevention, or anomaly detection. However, TAXII is not designed to collect or share information about insider threats specifically. TAXII is more focused on external threats that originate from outside sources, such as hackers, cybercriminals, or nation-states4. Option C is incorrect because TAXII does not exchange messages in the most cost-effective way and requires little maintenance once implemented. TAXII is a protocol that defines how messages are exchanged, but it does not specify the cost or maintenance of the exchange. The cost and maintenance of implementing TAXII depend on various factors, such as the type and number of services used, the volume and frequency of data exchanged, the security and reliability requirements of the exchange, and the availability and compatibility of existing tools and platforms. Implementing TAXII may require significant resources and efforts from both the information producers and consumers to ensure its functionality and performance5. Option D is incorrect because TAXII is not a semi-automated solution to gather threat intelligence about competitors in the same sector. TAXII is a fully automated solution that enables the exchange of threat intelligence among various entities across different sectors. TAXII does not target or collect information about specific competitors in the same sector. Rather, it aims to foster collaboration and cooperation among organizations that share common interests or goals in cyber security. Moreover, gathering threat intelligence about competitors in the same sector may raise ethical and legal issues that are beyond the scope of TAXII. 1 What is STIX/TAXII? | Cloudflare 2 What Are STIX/TAXII Standards? - Anomali Resources 3 What is STIX and TAXII? - EclecticIQ 4 What Is an Insider Threat? Definition & Examples | Varonis 5 Implementing STIX/TAXII - GitHub Pages [6] Cyber Threat Intelligence: Ethical Hacking vs Unethical Hacking | Infosec

A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?

A zero-day command injection vulnerability was published. A security administrator is analyzing the following logs for evidence of adversaries attempting to exploit the vulnerability:Which of the following log entries provides evidence of the attempted exploit?

Which of the following is the best framework for assessing how attackers use techniques over an infrastructure to exploit a target's information assets?

A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results?

An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?

A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?

An analyst has the following evidence sources: Firewall logs EDR alerts VPN authentication logs Database access logs The incident involves suspected unauthorized database access using stolen VPN credentials. Which TWO evidence sources should be correlated FIRST? (Choose two.)

A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

The security team reviews a web server for XSS and runs the following Nmap scan:Which of the following most accurately describes the result of the scan?

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed?

During security scanning, a security analyst regularly finds the same vulnerabilities in a criticalapplication. Which of the following recommendations would best mitigate this problem if appliedalong the SDLC phase?

A cybersecurity analyst notices unusual network scanning activity coming from a country that the company best mitigation technique?does not do business with. Which of the following is the

A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?

An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

How can Jim most effectively locate a wireless rogue access point that is causing complaints from employees in his building?

A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:Which of the following scripting languages was used in the script?

Which of the following is often used to keep the number of alerts to a manageable level when establishing a process to track and analyze violations?

An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet:/wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administratorWhich of the following controls would work best to mitigate the attack represented by this snippet?

A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results?

A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?

A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?

A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities:Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system?

Which of the following tools would work best to prevent the exposure of PII outside of an organization?

An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system.

Which TWO frameworks are commonly referenced during compliance baseline scanning? (Choose two.)

An analyst is reviewing a vulnerability report for a server environment with the following entries:Which of the following systems should be prioritized for patching first?

Organizations like Anonymous, which target governments and businesses for political reasons, are examples of what type of threat actor?

An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to?

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date. Which of the following best describes a security analyst's concern?

While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next? Determining what attack the odd characters are indicative of is the next step that should be taken after reviewing web server logs and noticing several entries with the same time stamps, but all contain odd characters in the request line. This step can help the analyst identify the type and severity of the attack, as well as the possible source and motive of the attacker. The odd characters in the request line may indicate that the attacker is trying to exploit a vulnerability or inject malicious code into the web server or application, such as SQL injection, cross-site scripting, buffer overflow, or command injection. The analyst can use tools and techniques such as log analysis, pattern matching, signature detection, or threat intelligence to determine what attack the odd characters are indicative of, and then proceed to the next steps of incident response, such as containment, eradication, recovery, and lessons learned. Official Reference: https://partners.comptia.org/docs/default-source/resources/comptia-cysa-cs0-002-exam-objectives https://www.comptia.org/certifications/cybersecurity-analyst https://www.comptia.org/blog/the-new-comptia-cybersecurity-analyst-your-questions-answered

A company receives a penetration test report summary from a third party. The report summary indicates a proxy has some patches that need to be applied. The proxy is sitting in a rack and is not being used, as the company has replaced it with a new one. The CVE score of the vulnerability on the proxy is a 9.8. Which of the following best practices should the company follow with this proxy?

A security analyst is assessing the security of a cloud environment. The following output is generated when the assessment runs:Authentication errorInstance not found on preset locationWhich of the following should the analyst use to fix the issue?