CompTIA CySA+ CS0-004 Exam 2026 – 195 Practice Questions with
Answers & Detailed Rationales, Security Operations, Vulnerability
Management, Incident Response, Threat Analysis, Reporting &
Communication
Domain 1: Security Operations (Questions 1–66)
Question 1
A security analyst receives a SIEM alert indicating a workstation initiated a connection to a
known command-and-control server. The workstation belongs to a finance employee who
reports no unusual activity. Which action should the analyst take first?
A. Immediately isolate the workstation from the network
B. Validate the alert by reviewing proxy logs, DNS queries, and endpoint process telemetry
C. Send an email to the user asking if they visited a suspicious website
D. Escalate to the incident response team without further investigation
Correct Answer: B
Explanation: Validating alerts through multiple data sources prevents false positives before
taking disruptive action. Reviewing proxy, DNS, and endpoint data confirms whether the
connection is malicious.
Question 2
Which MITRE ATT&CK tactic describes an adversary attempting to maintain persistent access
to a compromised system?
,A. Initial Access
B. Execution
C. Persistence
D. Exfiltration
Correct Answer: C
Explanation: The Persistence tactic encompasses techniques adversaries use to keep access
to systems across restarts, changed credentials, and other interruptions.
Question 3
An analyst observes the following Zeek log entry: Connections: 192.168.1.50 ->
203.0.113.45:4444. The internal host has no business relationship with the external IP.
Which indicator type does this represent?
A. Indicator of Attack (IOA)
B. Indicator of Compromise (IOC)
C. Vulnerability signature
D. Configuration drift
Correct Answer: B
Explanation: An IOC represents evidence of past or present compromise, such as suspicious
network connections, whereas IOAs describe adversary behavior in progress.
Question 4
,A security team wants to proactively search for threats that existing detections have not
caught. Which methodology is most appropriate?
A. Vulnerability scanning
B. Penetration testing
C. Threat hunting with hypothesis-driven queries
D. Compliance auditing
Correct Answer: C
Explanation: Threat hunting begins with a hypothesis about adversary behavior and uses
proactive searches to uncover hidden threats beyond automated detection capabilities.
Question 5
An analyst discovers suspicious encoded PowerShell commands in process telemetry. Which
data source would best reveal the full command-line arguments?
A. Windows Security Event Log
B. Sysmon Event ID 1 (Process Creation)
C. Firewall connection logs
D. DNS query logs
Correct Answer: B
Explanation: Sysmon Event ID 1 captures process creation with full command-line
arguments, essential for analyzing encoded or obfuscated PowerShell execution.
Question 6
, A user account authenticates successfully from New York and then from London within 15
minutes. Which identity-based anomaly does this represent?
A. Credential stuffing
B. Impossible travel
C. Brute force attack
D. Password spraying
Correct Answer: B
Explanation: Impossible travel occurs when authentication events originate from
geographically distant locations within a timeframe that makes physical travel impossible.
Question 7
Which tool is specifically designed for network security monitoring and capturing full packet
data for retrospective analysis?
A. Nessus
B. Wireshark
C. Metasploit
D. OpenVAS
Correct Answer: B
Explanation: Wireshark captures and analyzes network traffic at the packet level, enabling
deep inspection of protocols and payloads for security investigations.
Answers & Detailed Rationales, Security Operations, Vulnerability
Management, Incident Response, Threat Analysis, Reporting &
Communication
Domain 1: Security Operations (Questions 1–66)
Question 1
A security analyst receives a SIEM alert indicating a workstation initiated a connection to a
known command-and-control server. The workstation belongs to a finance employee who
reports no unusual activity. Which action should the analyst take first?
A. Immediately isolate the workstation from the network
B. Validate the alert by reviewing proxy logs, DNS queries, and endpoint process telemetry
C. Send an email to the user asking if they visited a suspicious website
D. Escalate to the incident response team without further investigation
Correct Answer: B
Explanation: Validating alerts through multiple data sources prevents false positives before
taking disruptive action. Reviewing proxy, DNS, and endpoint data confirms whether the
connection is malicious.
Question 2
Which MITRE ATT&CK tactic describes an adversary attempting to maintain persistent access
to a compromised system?
,A. Initial Access
B. Execution
C. Persistence
D. Exfiltration
Correct Answer: C
Explanation: The Persistence tactic encompasses techniques adversaries use to keep access
to systems across restarts, changed credentials, and other interruptions.
Question 3
An analyst observes the following Zeek log entry: Connections: 192.168.1.50 ->
203.0.113.45:4444. The internal host has no business relationship with the external IP.
Which indicator type does this represent?
A. Indicator of Attack (IOA)
B. Indicator of Compromise (IOC)
C. Vulnerability signature
D. Configuration drift
Correct Answer: B
Explanation: An IOC represents evidence of past or present compromise, such as suspicious
network connections, whereas IOAs describe adversary behavior in progress.
Question 4
,A security team wants to proactively search for threats that existing detections have not
caught. Which methodology is most appropriate?
A. Vulnerability scanning
B. Penetration testing
C. Threat hunting with hypothesis-driven queries
D. Compliance auditing
Correct Answer: C
Explanation: Threat hunting begins with a hypothesis about adversary behavior and uses
proactive searches to uncover hidden threats beyond automated detection capabilities.
Question 5
An analyst discovers suspicious encoded PowerShell commands in process telemetry. Which
data source would best reveal the full command-line arguments?
A. Windows Security Event Log
B. Sysmon Event ID 1 (Process Creation)
C. Firewall connection logs
D. DNS query logs
Correct Answer: B
Explanation: Sysmon Event ID 1 captures process creation with full command-line
arguments, essential for analyzing encoded or obfuscated PowerShell execution.
Question 6
, A user account authenticates successfully from New York and then from London within 15
minutes. Which identity-based anomaly does this represent?
A. Credential stuffing
B. Impossible travel
C. Brute force attack
D. Password spraying
Correct Answer: B
Explanation: Impossible travel occurs when authentication events originate from
geographically distant locations within a timeframe that makes physical travel impossible.
Question 7
Which tool is specifically designed for network security monitoring and capturing full packet
data for retrospective analysis?
A. Nessus
B. Wireshark
C. Metasploit
D. OpenVAS
Correct Answer: B
Explanation: Wireshark captures and analyzes network traffic at the packet level, enabling
deep inspection of protocols and payloads for security investigations.
