Free Practice Questions for the CompTIA CySA+ CS0-004 Exam (2026 Updated)

The organization remains in the eradication phase because malicious artifacts are still being removed from affected systems and the environment has not yet reached a trusted state suitable for complete restoration. The phrase “removing malware from some of the affected hosts” indicates that responders are actively eliminating the threat across the compromised estate rather than merely observing or documenting it.

Eradication addresses malware, attacker persistence, exploited vulnerabilities, unauthorized accounts, malicious configurations, compromised credentials, and other mechanisms that could permit reinfection or renewed access. Only after responders have sufficiently eliminated those causes should affected resources progress fully into recovery and return to normal operation. NIST's current incident-response model identifies containment, eradication, and recovery as related but distinct activities and emphasizes restoring assets only after appropriate incident handling has occurred.

Detection would have occurred when the incident was initially discovered. Analysis determines scope, cause, and impact. Preparation takes place before incidents by establishing plans, tools, procedures, and capabilities. Post-incident activities occur after response and restoration and focus on organizational improvement.

The two-week duration does not determine the phase. The activity being performed does : continued removal of malware indicates eradication.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Malware Removal → Persistence Removal → System Validation → Recovery.

Encryption at rest primarily protects the confidentiality of stored information when an unauthorized party obtains physical or logical access to the storage medium. This is particularly important for laptops because portable devices can be lost or stolen, giving an attacker possession of the disk outside the organization's normal network and endpoint protections.

NIST guidance on storage encryption specifically addresses laptops and other end-user devices and explains that storage encryption combines encryption and authentication to restrict unauthorized access to stored information. NIST further notes that threats involving lost or stolen end-user devices can expose information to unauthorized parties.

Encryption does not inherently prevent an authenticated and authorized user from copying information while the system is unlocked; data loss prevention controls are more directly suited to that objective. Regulatory requirements may mandate encryption in some environments, but compliance is an external requirement rather than the fundamental security reason encryption at rest exists. Option D confuses confidentiality with integrity and network protection. Encryption of data stored on a laptop is not primarily intended to validate whether network data has been modified.

The examination concept is the CIA triad: encryption primarily supports confidentiality , especially when physical possession of the storage device is lost.

Study Guide Reference: Security Operations → Data Protection → Encryption at Rest → Full-Disk Encryption → Confidentiality → Lost/Stolen Endpoint Protection.

Windows Security Event ID 4624 records a successful logon session. Therefore, querying the Security log for event 4624 provides the analyst with historical evidence of successful logins to the affected workstation.

Get-WinEvent is the appropriate PowerShell cmdlet for retrieving Windows event records. The FilterHashtable parameter allows efficient server-side filtering using attributes such as LogName and ID, rather than retrieving an entire event log and filtering the results afterward. Microsoft specifically documents LogName and ID as valid FilterHashtable keys and recommends this approach for efficient event-log querying.

The command then uses Sort-Object TimeCreated -Descending so the newest login events appear first, and Export-Csv preserves the resulting records for investigation.

Option A does not use the correct PowerShell event-query syntax shown. Options C and D search inappropriate log channels and unrelated event IDs. The evidence needed is authentication history, making the Windows Security log and successful-logon identifier 4624 the correct combination.

Study Guide Reference: Incident Response and Management → Evidence Collection → Windows Event Logs → PowerShell → Get-WinEvent → Security Event ID 4624 → Timeline Reconstruction.

Secure access service edge is specifically designed for environments in which users, devices, applications, and workloads are distributed beyond a traditional enterprise network perimeter. SASE integrates networking and security functions into a service-oriented architecture so policy enforcement can follow the user or workload rather than depend solely on traffic traversing a centralized corporate boundary.

This makes SASE particularly suitable for a perimeter-less topology , where employees may work remotely, applications may reside in multiple cloud providers, and services may be accessed directly over the internet. Typical SASE implementations combine software-defined wide-area networking with cloud-delivered security controls such as secure web gateways, cloud access security brokerage, firewall-as-a-service, and Zero Trust-oriented access controls.

A hybrid cloud network connects private and public cloud resources but can still operate using conventional network boundaries. Cloud-native computing describes an application and infrastructure design approach based on cloud technologies such as containers, microservices, and automation; it does not inherently define perimeter-less access security. A content delivery network distributes content geographically for performance and availability and is not an enterprise access-security architecture.

The CS0-004 Security Operations objectives explicitly identify SASE, Zero Trust Network Architecture, and hybrid cloud as network architecture concepts analysts must understand.

Study Guide Reference: Security Operations → Network Architecture Concepts → SASE → Zero Trust Network Architecture → Distributed/Cloud Security.

The analyst should prioritize 10.203.10.11 because the scan output identifies that host as presenting the Windows SMB exposure relevant to the critical vulnerability. Vulnerability prioritization requires matching the vulnerability's technical prerequisites against the characteristics discovered on each host rather than simply patching every responding system indiscriminately.

Modern SMB services commonly use TCP port 445 . Microsoft documents TCP 445 as a required port for SMB-based file services, with port 139 associated with older NetBIOS-based implementations. Therefore, a Windows host exposing the affected SMB service satisfies an essential condition for applicability and should be prioritized when the vulnerability specifically targets open SMB ports.

The -Pn option is also significant operationally because it instructs Nmap to treat targets as online without relying on normal host-discovery probes. The analyst can consequently inspect reachable service ports even when systems do not respond to standard discovery methods.

The remaining hosts either do not expose the vulnerable SMB service or do not match the required Windows/service profile described by the scenario. Priority should follow confirmed applicability, exposure, severity, and exploitability.

Study Guide Reference: Vulnerability Management → Nmap → Port Scanning → SMB → TCP 445/139 → Vulnerability Applicability → Remediation Prioritization.

Option D applies the correct packet-filtering logic to isolate DNS-related traffic associated with the suspected server . The -r suspicious.pcap option directs tcpdump to read packets from the existing PCAP rather than capture live traffic. The expression port 53 and host 10.213.4.27 then limits output to packets involving the specified system and DNS's conventional port 53.

This is directly relevant to suspected DNS exfiltration. Attackers can encode data within DNS queries or responses, including unusually long subdomains or other manipulated DNS fields. Isolating the target's port 53 traffic dramatically reduces the dataset and allows the analyst to examine relevant queries and responses for encoded or anomalous information.

strings suspicious.pcap | grep treats the capture primarily as raw printable data and does not accurately perform protocol-aware packet filtering. The Zeek option searches file.log, which is focused on files observed in network traffic and is not the most direct location for DNS-query analysis. The Snort syntax shown is also inappropriate for the required extraction workflow.

The essential skill is translating an investigative hypothesis— possible DNS exfiltration by a known host —into a precise PCAP filter.

Study Guide Reference: Security Operations → Network Traffic Analysis → Full Packet Capture → tcpdump → BPF Filters → DNS Analysis → Data Exfiltration Detection.

Eradication addresses the root causes and malicious mechanisms that allow an attacker to remain inside the environment. Typical eradication actions include deleting malware, removing persistence mechanisms, disabling unauthorized accounts, resetting compromised credentials, eliminating malicious scheduled tasks or services, correcting exploited vulnerabilities, and rebuilding systems when trust cannot be restored.

This differs fundamentally from containment. Containment is intended to limit immediate damage or prevent further spread , such as isolating an infected workstation, blocking an IP address, disabling a network segment, or temporarily suspending an account. These measures can interrupt attacker activity, but they do not necessarily remove the underlying foothold. Microsoft security architecture guidance similarly distinguishes containment from eradication and describes eradication procedures as completely removing the threat from the environment.

Detection identifies that suspicious or malicious activity exists; it does not remove access. Denial of service is an attack or availability condition rather than a recognized incident-response phase.

Therefore, if the examination asks which phase permanently removes the adversary's access , the correct answer is eradication because this is where attacker persistence and the enabling compromise are eliminated before normal operations are fully restored.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Persistence Removal → Credential Reset → Malware Removal → Vulnerability Remediation.

Application programming interfaces (APIs) provide the most direct mechanism for retrieving, exchanging, and integrating information between separate security technologies. A product console normally exposes only the information and workflows chosen by the vendor for its graphical interface. An API can provide programmatic access to underlying alerts, events, asset information, telemetry, configuration objects, or investigation data, allowing an analyst to combine information from multiple systems into a richer analytical view.

CISA describes security-analysis workflows in which integration enables defenders to connect existing analytical tools and automate data-handling processes, while modern security platforms commonly expose APIs specifically to ingest or exchange telemetry.

SOAR can certainly integrate multiple tools, but its primary purpose is orchestration and automation of security workflows. If the requirement is specifically to access and combine information not readily exposed in individual consoles , APIs are the underlying capability most directly suited to retrieving that data. Infrastructure as code defines and provisions infrastructure through machine-readable templates; it does not primarily aggregate security telemetry. Playbooks establish standardized investigation or response procedures but do not themselves provide interfaces into external product data.

The key phrase is “enhanced view into data.” This requires programmatic access and integration rather than merely workflow documentation or automation.

Study Guide Reference: Security Operations → Security Tool Integration → APIs → Data Enrichment → Automation/Orchestration → SOC Process Improvement.

A SIEM alert is an indication requiring validation; it is not automatically a confirmed security incident. The analyst must therefore begin with triage . Triage establishes whether the activity is legitimate or malicious, determines the affected systems or accounts, evaluates severity and business impact, and establishes the appropriate investigative and escalation path.

Typical triage activities include reviewing the underlying events, checking source and destination information, identifying affected assets, correlating supporting telemetry, evaluating detection confidence, examining threat intelligence, and determining whether the alert represents a true positive. Only after this assessment can the incident be assigned an appropriate priority and routed to the correct responders.

Contacting an incident coordinator before establishing whether the alert represents meaningful risk may create unnecessary escalation. Recovery activities occur substantially later, after detection, analysis, containment, and eradication activities have established what happened and controlled the threat. Escalating directly to the help desk is similarly premature and may be inappropriate for a security event.

NIST's current incident-response model places detection and analysis before response and recovery actions and emphasizes determining event characteristics so appropriate response actions can follow.

Study Guide Reference: Incident Response and Management → Detection → Alert Validation → Triage → Analysis → Severity Determination → Escalation.

Zero Trust is based on the principle that access should not be implicitly trusted merely because a user, workload, or device has already entered the enterprise environment. Access decisions are continuously evaluated using identity, authentication state, device posture, authorization, contextual information, and resource sensitivity. The scenario's emphasis on continuously validating and verifying access therefore directly describes Zero Trust.

Traditional perimeter-oriented models tend to treat internal network position as a degree of trust. Zero Trust removes that assumption and requires explicit verification before granting access to protected resources. It also supports least privilege, granular authorization, segmentation, and ongoing assessment of sessions or identities.

Secure access service edge combines networking and security capabilities delivered through a distributed service architecture and can support Zero Trust implementations, but SASE itself is not the fundamental principle described. A next-generation firewall provides application-aware traffic inspection and policy enforcement but does not by itself establish continuous identity-centric verification. Privileged access management specifically controls elevated or administrative accounts; it is an important component of access security but addresses a narrower scope than Zero Trust.

The CS0-004 objectives explicitly identify Zero Trust Network Architecture , SASE, hybrid cloud, IAM, PAM, authentication, and authorization as Security Operations architecture concepts.

Study Guide Reference: Security Operations → Network Architecture → Zero Trust Network Architecture → IAM → Authentication and Authorization → Least Privilege.

The analyst should first establish a legal hold because the suspected breach involves personnel records and evidence that may become relevant to regulatory, disciplinary, civil, or other legal proceedings. A legal hold prevents potentially relevant information from being deleted, overwritten, modified, rotated out under normal retention schedules, or otherwise destroyed before the organization's legal and investigative obligations are understood.

Preservation must precede destructive or potentially evidence-altering actions. NIST describes digital forensics as retrieving, storing, and analyzing electronic information while ensuring that evidence is captured reliably without alteration. RFC 3227 similarly emphasizes preserving evidence, following proper collection procedures, documenting handling, and maintaining chain of custody.

Log correlation and timeline construction are important investigative activities, but they should occur after preservation requirements have been established. Resetting credentials may subsequently be required for containment, but the scenario first raises an evidence-preservation obligation. Restoring files from backup would be especially premature because it could alter timestamps, overwrite artifacts, or otherwise complicate forensic analysis.

The examination principle is therefore preserve first when legal implications are reasonably foreseeable; analyze and remediate afterward under controlled procedures .

Study Guide Reference: Incident Response and Management → Evidence Acquisition → Legal Hold → Evidence Preservation → Chain of Custody → Timeline Analysis → Regulatory/Legal Considerations.

192.168.76.5 — Patch; upgrade IIS to the current release

The correct remediation target is 192.168.76.5 , which is associated with an unsupported Microsoft IIS version and a CVSS score of 9.2 in the matching hotspot data. The remediation standard assigns vulnerabilities above 9.0 to the shortest remediation window, meaning the system requires action in seven days and therefore necessarily falls within the requested fourteen-day maximum. The corresponding remediation is to patch or upgrade IIS to a currently supported release .

The key vulnerability-management principle is that remediation priority is not determined exclusively by the existence of a vulnerability. Analysts must consider severity, asset context, exposure, business importance, exploitability, available remediation, and organizational service-level requirements. A product that has reached an unsupported state represents additional risk because standard security updates may no longer be supplied.

Upgrading the affected IIS installation directly removes the unsupported software condition rather than merely reducing exposure around it. A compensating control would be appropriate when remediation cannot immediately be performed, but it would not supersede a supported upgrade when that upgrade is operationally available.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization → CVSS → Remediation Timeframes → End-of-Life/Unsupported Software → Patching and Upgrading.

A lessons learned review evaluates how the incident was handled and identifies improvements that should be incorporated into future response activities. It examines what worked well, what created delays, where communications or escalation failed, whether tools and playbooks were effective, and which corrective actions should be assigned to reduce the likelihood or impact of similar incidents.

NIST's current incident-response guidance places strong emphasis on continuous improvement. It states that lessons identified during incident-response activities should feed into organizational improvement so policies, processes, practices, and security capabilities can be adjusted as necessary. NIST also notes that traditional post-incident activities identify required improvements and return them to preparation and broader cybersecurity risk management.

KPIs quantify operational performance but do not themselves provide the qualitative review necessary to identify process efficiencies and corrective actions. An executive summary communicates major incident facts and outcomes to leadership. Root cause analysis focuses on identifying the fundamental technical or organizational cause of the incident; it can contribute to lessons learned but is narrower in scope.

Therefore, the broader mechanism for reviewing the entire response process and developing improvement actions is the lessons-learned process.

Study Guide Reference: Reporting and Communication → Post-Incident Reporting → Lessons Learned → Corrective Actions → Process Improvement → Stakeholder Feedback.

Chain of custody is the formal process used to document the collection, possession, transfer, handling, analysis, and disposition of evidentiary artifacts. Its purpose is to establish an auditable history demonstrating who controlled the evidence, when custody changed, why it was transferred, and what actions were performed on it.

NIST defines chain of custody as tracking evidence throughout its collection, safeguarding, and analysis lifecycle while documenting each individual who handled it, relevant timestamps, and the purpose of transfers. This is critical when multiple systems, analysts, forensic teams, or external parties participate in an investigation because undocumented handling could undermine confidence in the evidence's integrity or admissibility.

Packaging and labeling are important evidence-preservation procedures, but they represent only individual activities within the broader evidence-management process. Storage and containment protect artifacts from alteration or unauthorized access but do not provide the complete historical record of possession. Post-incident reporting documents investigation conclusions and response actions after the incident rather than tracking evidence throughout its lifecycle.

The decisive phrase is “properly recorded.” A defensible record of every evidence transfer and handler is specifically the function of chain of custody.

Study Guide Reference: Incident Response and Management → Digital Forensics → Evidence Acquisition → Chain of Custody → Evidence Integrity → Documentation and Preservation.

Category 2 represents hosts whose RDP authentication characteristics indicate NTLM without Active Directory domain membership , making option C the correct interpretation. The Nmap command targets TCP port 3389 and executes RDP-related NSE scripts. Nmap's RDP scripts include rdp-ntlm-info, which obtains information through RDP services configured for CredSSP/Network Level Authentication, as well as rdp-enum-encryption, which evaluates supported RDP security layers and encryption.

Kerberos normally relies on a domain-based authentication infrastructure and a Key Distribution Center. A non-domain-joined workstation will typically rely on local authentication mechanisms and can use NTLM challenge-response authentication where appropriate. The absence of Active Directory domain characteristics, together with NTLM-specific RDP information, therefore distinguishes Category 2 from domain-integrated Kerberos authentication.

It is important operationally not to infer that every NTLM-capable system is necessarily outside Active Directory; domain members can fall back to NTLM under certain conditions. The examination conclusion depends on the combined evidence shown in the category output rather than NTLM alone.

Study Guide Reference: Vulnerability Management → Service Enumeration → Nmap NSE → RDP/3389 → NTLM → Kerberos → Active Directory Authentication Assessment.

ScoutSuite is specifically designed for security posture assessment of cloud environments, making it the best tool for establishing a cloud-security baseline. NCC Group describes ScoutSuite as an open-source, multi-cloud security-auditing tool that uses cloud-provider APIs to collect configuration information and identify risk areas across cloud environments.

This capability is fundamentally different from conventional host or web vulnerability scanning. A cloud baseline requires evaluation of configurations such as identity permissions, storage exposure, network controls, encryption settings, logging, cloud-native security services, and resource policies. ScoutSuite queries the cloud control plane and produces an organized view of configuration weaknesses that can be compared with security expectations.

OpenVAS is primarily a general-purpose vulnerability-assessment scanner for systems and network services. Nikto concentrates on web-server weaknesses and dangerous configurations. Metasploit is primarily an exploitation and penetration-testing framework. Although each has legitimate assessment uses, none is as directly suited to broad cloud configuration posture assessment as ScoutSuite.

The critical examination distinction is cloud configuration auditing versus traditional vulnerability scanning or exploitation .

Study Guide Reference: Vulnerability Management → Cloud Vulnerability Assessment → Configuration Baselines → ScoutSuite → Cloud APIs → Security Posture Assessment → Misconfiguration Identification.

Legacy systems present a significant security problem because they frequently cannot support current operating systems, security agents, encryption mechanisms, authentication controls, or vendor patches. When a business-critical legacy system cannot be remediated normally, strong network segmentation becomes an important compensating control. The objective is to reduce the system's reachable attack surface and restrict which users, hosts, protocols, and applications can communicate with it.

A segmented legacy asset might be placed in a dedicated VLAN or security zone and protected through restrictive firewall access-control rules, jump hosts, allowlisting, enhanced logging, and continuous monitoring. Even though segmentation does not remove the underlying vulnerability, it decreases exposure and makes exploitation or lateral movement considerably more difficult.

Degraded functionality is generally an effect or remediation constraint rather than the strongest reason for isolation. Asset obfuscation does not provide reliable security because hidden systems can still be discovered through enumeration or traffic analysis. A proprietary server is not automatically vulnerable merely because its implementation is proprietary; it may still support modern patches and security controls.

CS0-004 specifically covers segmentation as a vulnerability-scanning consideration, compensating controls as a mitigation strategy, and legacy systems as an important inhibitor to remediation.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization and Mitigation → Compensating Controls → Segmentation → Legacy-System Constraints.

The communication plan is the appropriate document because it establishes who must be contacted during an incident, how communications should occur, which channels are authorized, and how information should be escalated to internal and external stakeholders.

Incident-response communications may involve security personnel, executive leadership, legal counsel, privacy teams, public relations, human resources, business owners, vendors, regulators, law enforcement, customers, and other parties depending on incident severity. NIST's incident-response guidance emphasizes coordination with relevant stakeholders as part of an effective response capability. A communication plan operationalizes that requirement by maintaining contact information, responsibilities, escalation paths, notification requirements, and approved communication methods.

An organization chart identifies reporting relationships but may not contain emergency contact details, alternate channels, external contacts, or escalation procedures. A previous incident report documents a historical event and should not be treated as the authoritative contact source. Standard operating procedures can describe technical or administrative steps, but stakeholder communications are more appropriately centralized in the incident communication plan.

Maintaining this information in advance is critical because incident response frequently occurs under time pressure and may involve unavailable or compromised normal communication systems.

Study Guide Reference: Reporting and Communication → Communication Plan → Stakeholder Contacts → Escalation Paths → Internal/External Notifications → Out-of-Band Communications.

The original scan fails because Nmap's host-discovery process concludes that the target appears offline before conducting the intended full port scan. Option C adds -Pn , instructing Nmap to skip normal host discovery and proceed with scanning the target as though it is online. The -p- option then instructs Nmap to test the complete TCP port range rather than only its default set.

This is appropriate when a live host does not respond to discovery probes because ICMP echo traffic or other discovery packets may be filtered by firewalls, host-based controls, or network policy. A system can therefore appear “down” to Nmap's discovery phase while still exposing reachable TCP services.

Option B uses -sn, which performs host discovery without a port scan and therefore contradicts the requirement. Option A scans only a limited set of explicitly identified ports and includes unrelated functionality. Option D unnecessarily changes the scope to an entire /24, performs operating-system detection and DNS resolution, and invokes an SSL cipher script; none of those modifications addresses the immediate host-discovery problem.

Study Guide Reference: Vulnerability Management → Nmap → Host Discovery → -Pn → Full Port Scanning -p- → Firewall/ICMP Filtering → Scan Troubleshooting.