Free CompTIA CS0-004 Practice Questions & Answers 2026 Part4

Question #1

During her forensic copy validation process, Danielle hashed the original, cloned the image files, and received the following MD5 sums. What is likely wrong? b49794e007e909c00a51ae208cacb169 original.img d9ff8a0cf6bc0ab066b6416e7e7abf35 clone.img

A. The original was modified

B. The clone was modified

C. dd failed

D. An unknown change or problem occurred

View answer

Correct Answer: D

Question #2

Patches for two highly exploited vulnerabilities were released on the same Friday afternoon. Information about the systems and vulnerabilities is shown in the tables below:Which of the following should the security analyst prioritize for remediation?

A. rogers

B. brady

C. brees

D. manning

View answer

Correct Answer: B

Question #3

An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed?

A. eaconing

B. ross-site scripting

C. uffer overflow

D. HP traversal

View answer

Correct Answer: A

Question #4

An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:Which of the following tuning recommendations should the security analyst share?

A. Set an HttpOnlvflaq to force communication by HTTPS

B. Block requests without an X - Frame - Options header

C. Configure an Access - Control - Allow - Origin header to authorized domains

D. Disable the cross - origin resource sharing header

View answer

Correct Answer: B

Question #5

A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts. The analyst is working with the respective system owners to help determine the best methodology that seeks to promote confidentiality, availability, and integrity of the data being hosted. Which of the following should the security analyst perform first to categorize and prioritize the respective systems?

A. Interview the users who access these systems

B. Scan the systems to see which vulnerabilities currently exist

C. Configure alerts for vendor-specific zero-day exploits

D. Determine the asset value of each system

View answer

Correct Answer: D

Question #6

A security analyst is performing an investigation involving multiple targeted Windows malware binaries. Theanalyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?

A. Upload the binary to an air gapped sandbox for analysis

B. Send the binaries to the antivirus vendor

C. Execute the binaries on an environment with internet connectivity

D. Query the file hashes using VirusTotal

View answer

Correct Answer: A

Question #7

Security analysts review logs on multiple servers on a daily basis. Which of the following implementations will give the best central visibility into the events occurring throughout the corporate environment without logging in to the servers individually?

A. Deploy a database to aggregate the logging

B. Configure the servers to forward logs to a SIEM-

C. Share the log directory on each server to allow local access,

D. Automate the emailing of logs to the analysts

E. Reveal Answer

View answer

Correct Answer: B

Question #8

A Chief Information Security Officer wants to lock down the users' ability to change applications that are installed on their Windows systems. Which of the following is the best enterprise-level solution?

A. HIPS

B. GPO

C. Registry

D. DLP

View answer

Correct Answer: B

Question #9

An analyst finds that an IP address outside of the company network that is being used to run networkand vulnerability scans across external-facing assets. Which of the following steps of an attackframework is the analyst witnessing?

A. xploitation

B. econnaissance

C. ommand and control

D. ctions on objectives

View answer

Correct Answer: B

Question #10

A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?

A. External

B. Agent-based

C. Non-credentialed

D. Credentialed

View answer

Correct Answer: B

Question #11

A technician identifies a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process?

A. Testing

B. Implementation

C. Validation

D. Rollback

View answer

Correct Answer: C

Question #12

A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?

A. hange the display filter to ftp

B. hange the display filter to tcp

C. hange the display filter to ftp-data and follow the TCP streams

D. avigate to the File menu and select FTP from the Export objects option

View answer

Correct Answer: C

Question #13

An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

A. Access rights

B. Network segmentation

C. Time synchronization

D. Invalid playbook

View answer

Correct Answer: C

Question #14

The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks?

A. Reduce the administrator and privileged access accounts

B. Employ a network-based IDS

C. Conduct thorough incident response

D. Enable SSO to enterprise applications

View answer

Correct Answer: A

Question #15

A cybersecurity analyst is reviewing SIEM logs and observes consistent requests originating from an internal host to a blocklisted external server. Which of the following best describes the activity that is taking place?

A. Data exfiltration

B. Rogue device

C. Scanning

D. Beaconing

View answer

Correct Answer: D

Question #16

A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

A. Weaponization

B. Reconnaissance

C. Delivery

D. Exploitation

View answer

Correct Answer: D

Question #17

A SOC manager is establishing a reporting process to manage vulnerabilities. Which of the following would be the best solution to identify potential loss incurred by an issue?

A. rioritization

B. rends

C. isk score

D. itigation

View answer

Correct Answer: C

Question #18

A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the briefing?

A. Firewall logs

B. Indicators of compromise

C. Risk assessment

D. Access control lists

View answer

Correct Answer: C

Question #19

An employee received a phishing email that contained malware targeting the company. Which of the following is the best way for a security analyst to get more details about the malware and avoid disclosing information?

A. hare the malware with the EDR provider

B. ire an external consultant to perform the analysis

C. pload the malware to the VirusTotal website

D. se a local sandbox in a microsegmented environment

View answer

Correct Answer: D

Question #20

In the Diamond Model of Intrusion Analysis, which element represents the target of the attacker?

A. Victim

B. Capability

C. Infrastructure

D. Adversary

View answer

Correct Answer: A

Question #21

A web application team notifies a SOC analyst that there are thousands of HTTP/404 events on the public-facing web server. Which of the following is the next step for the analyst to take?

A. Instruct the firewall engineer that a rule needs to be added to block this external server

B. Escalate the event to an incident and notify the SOC manager of the activity

C. Notify the incident response team that a DDoS attack is occurring

D. Identify the IP/hostname for the requests and look at the related activity

E. Reveal Answer

View answer

Correct Answer: D

Question #22

Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

A. Identify any improvements or changes in the incident response plan or procedures

B. Determine if an internal mistake was made and who did it so they do not repeat the error

C. Present all legal evidence collected and turn it over to iaw enforcement

D. Discuss the financial impact of the incident to determine if security controls are well spent

View answer

Correct Answer: A

Question #23

A systems administrator receives several reports about emails containing phishing links. The hosting domain is always different, but the URL follows a specific pattern of characters.

A. Search email logs for a regular expression

B. Open a support ticket with the email hosting provider

C. Send a memo to all staff asking them to report suspicious emails

D. Query firewall logs for any traffic with a suspicious website

View answer

Correct Answer: A

Question #24

A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?

A. here is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access

B. n on-path attack is being performed by someone with internal access that forces users into port 80

C. he web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80

D. n error was caused by BGP due to new rules applied over the company's internal routers

View answer

Correct Answer: B

Question #25

A systems analyst is limiting user access to system configuration keys and values in a Windows environment. Which of the following describes where the analyst can find these configuration items?

A. config

B. ntds

C. Master boot record

D. Registry

View answer

Correct Answer: D

Question #26

A company is in the process of implementing a vulnerability management program. Which of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

A. Non-credentialed scanning

B. Passive scanning

C. Agent-based scanning

D. Credentialed scanning

View answer

Correct Answer: B

Question #27

A junior security analyst opened ports on the company's firewall, and the company experienced a data breach.

A. Environmental hacktivist

B. Accidental insider threat

C. Nation-state

D. Organized crime group

View answer

Correct Answer: B

Question #28

When starting an investigation, which of the following must be done first?

A. otify law enforcement

B. ecure the scene

C. eize all related evidence

D. nterview the witnesses

View answer

Correct Answer: B

Question #29

A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

A. Operating system version

B. Registry key values

C. Open ports

D. IP address

View answer

Correct Answer: B

Question #30

A security analyst is trying to identify anomalies on the network routing.

A. function x() { info=$(geoiplookup $1) && echo "$1 | $info" }

B. function x() { info=$(ping -c 1 $1 | awk -F "/" 'END{print $5}') && echo "$1 | $info" }

C. function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F "

D. function x() { info=$(traceroute -m 40 $1 | awk `END{print $1}') && echo "$1 | $info" }

View answer

Correct Answer: D

Question #31

Which of the following can be used to learn more about TTPs used by cybercriminals?

A. ZenMAP

B. MITRE ATT&CK

C. National Institute of Standards and Technology

D. theHarvester

View answer

Correct Answer: B

Question #32

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

A. SOAR

B. SIEM

C. SLA

D. IoC

View answer

Correct Answer: A

Question #33

Which of the following tools would work best to prevent the exposure of PII outside of an organization?

A. PAM

B. IDS

C. PKI

D. DLP

View answer

Correct Answer: D

Question #34

A company is in the process of implementing a vulnerability management program. Which of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

A. Non-credentialed scanning

B. Passive scanning

C. Agent-based scanning

D. Credentialed scanning

View answer

Correct Answer: B

Question #35

A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment:Which of the following should be completed first to remediate the findings?

A. Ask the web development team to update the page contents

B. Add the IP address allow listing for control panel access

C. Purchase an appropriate certificate from a trusted root CA

D. Perform proper sanitization on all fields

View answer

Correct Answer: D

Question #36

The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results?

A. Single pane of glass

B. Single sign-on

C. Data enrichment

D. Deduplication

View answer

Correct Answer: A

Question #37

A company discovers that its proprietary information is being sold on the dark web. A security analyst uses threat hunting to search for signs of compromise. After running a network packet capture tool, the analyst identifies millions of packets similar to the following:Internet Protocol Version 4, src: 192.168.1.2, dst: 104.21.75.76Internet Control Message ProtocolType: 8 Echo requestCode: 0Checksum: 0x34db [correct]Sequence number: 3362No response seenData: 64 bytesData payload: 0e1b586f3568s51578a2054af4459865b34857a05924b45824...The analyst does not detect or identify any other abnormalities. Which of the following is most likely the malicious activity in this scenario?

A. machine was infected with a virus that is trying to propagate

B. hacktivist is conducting an ICMP DDoS attack against the company

C. n insider is using an IP command-and-control channel to sell proprietary information

D. threat actor is performing exfiltration over an alternative protocol

View answer

Correct Answer: D

Question #38

Which of the following is a KPI that is used to monitor or report on the effectiveness of an incident response reporting and communication program?

A. ncident volume

B. ean time to detect

C. verage time to patch

D. emediated incidents

View answer

Correct Answer: B

Question #39

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

A. SOAR

B. SIEM

C. SLA

D. IoC

View answer

Correct Answer: A

Question #40

An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign?

A. Information sharing organization

B. Blogs/forums

C. Cybersecurity incident response team

D. Deep/dark web

View answer

Correct Answer: A

Question #41

A security analyst is reviewing the following alert that was triggered by FIM on a critical system:Which of the following best describes the suspicious activity that is occurring?

A. A fake antivirus program was installed by the user

B. A network drive was added to allow exfiltration of data

C. A new program has been set to execute on system start

D. The host firewall on 192

View answer

Correct Answer: C

Question #42

Which of the following describes the best reason for conducting a root cause analysis?

A. The root cause analysis ensures that proper timelines were documented

B. The root cause analysis allows the incident to be properly documented for reporting

C. The root cause analysis develops recommendations to improve the process

D. The root cause analysis identifies the contributing items that facilitated the event

View answer

Correct Answer: D

Question #43

A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

A. /etc/shadow

B. curl localhost

C. ; printenv

D. cat /proc/self/

View answer

Correct Answer: A

Question #44

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

A. Take a snapshot of the compromised server and verify its integrity

B. Restore the affected server to remove any malware

C. Contact the appropriate government agency to investigate

D. Research the malware strain to perform attribution

View answer

Correct Answer: A

Question #45

A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:Security Policy 1006: Vulnerability Management1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.According to the security policy, which of the following vulnerabilities should be the highest priority to patch?

A. Name: THOR

B. Name: CAP

C. Name: LOKI

D. Name: THANOS

View answer

Correct Answer: B

Question #46

An incident response analyst notices multiple emails traversing the network that target only theadministrators of the company. The email contains a concealed URL that leads to an unknownwebsite in another country. Which of the following best describes what is happening? (Choose two.)

A. eaconinq

B. omain Name System hijacking

C. ocial engineering attack

D. n-path attack

E. bfuscated links

F. ddress Resolution Protocol poisoning

View answer

Correct Answer: CE

Question #47

Who is the best facilitator for a post-incident lessons learned session?

A. CEO

B. CSIRT leader

C. Independent facilitator

D. First responder

View answer

Correct Answer: C

Question #48

The security team reviews a web server for XSS and runs the following Nmap scan:Which of the following most accurately describes the result of the scan?

A. An output of characters > and " as the parameters used in the attempt

B. The vulnerable parameter ID http://172

C. The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe

D. The vulnerable parameter and characters > and " with a reflected XSS attempt

View answer

Correct Answer: D

Question #49

Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

A. he lead should review what is documented in the incident response policy or plan

B. anagement level members of the CSIRT should make that decision

C. he lead has the authority to decide who to communicate with at any t me

D. ubject matter experts on the team should communicate with others within the specified area of expertise

View answer

Correct Answer: A

Question #50

A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

A. /etc/shadow

B. curl localhost

C. ; printenv

D. cat /proc/self/

View answer

Correct Answer: A

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free CompTIA CS0-004 Practice Questions & Answers 2026 Part4 | CompTIA CySA+

View The Updated CS0-003 Exam Questions

View The Updated CompTIA Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free CompTIA CS0-004 Practice Questions & Answers 2026 Part4 | CompTIA CySA+

View The Updated CS0-003 Exam Questions

View The Updated CompTIA Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now