CompTIA CySA+ (CS0-004) — All Questions

An analyst reviewing SIEM alerts wants to reduce noise by suppressing repeated benign events from a known vulnerability scanner. Which action best preserves detection capability while cutting alert volume?

• a.Delete all log sources associated with the scanner's subnet
• b.Create a tuning rule that excludes traffic from the scanner's known IP for that specific signature✓
• c.Disable the correlation rule entirely across all hosts
• d.Lower the SIEM's overall logging retention to 7 days

Tuning to exclude a known-good source for one signature removes false positives without blinding the SIEM to real threats. Deleting log sources or disabling the rule globally would create blind spots, and shortening retention harms investigations. Targeted allow-listing keeps fidelity high while reducing analyst fatigue.

A threat hunter maps observed adversary behavior to the MITRE ATT&CK framework. Which element of ATT&CK describes the specific method an adversary uses to achieve a tactical goal such as credential access?

• a.Tactic
• b.Mitigation
• c.Technique✓
• d.Data source

In MITRE ATT&CK, tactics represent the adversary's goal (the 'why'), while techniques describe the specific method used to accomplish it (the 'how'). Credential Access is a tactic, and methods like OS Credential Dumping are techniques. Mapping observations to techniques enables precise detection engineering and gap analysis.

During endpoint analysis, an EDR agent flags a signed PowerShell process spawning encoded commands that reach out to a rare external domain. What behavior does this most likely represent?

• a.Living-off-the-land activity using a legitimate binary for malicious purposes✓
• b.A routine Windows update download
• c.A false positive caused by an expired code-signing certificate
• d.Normal administrative scripting requiring no review

Adversaries frequently abuse trusted, signed utilities such as PowerShell to blend in, a technique known as living off the land (LOLBins). Encoded commands and beaconing to rare domains are strong indicators of command-and-control activity. Because the binary is legitimately signed, signature-based tools may miss it, making behavioral EDR analysis essential.

An analyst wants to safely detonate a suspicious email attachment to observe its behavior without risking production systems. Which capability is most appropriate?

• a.A credentialed vulnerability scan of the mail server
• b.A packet capture on the perimeter firewall
• c.A static string analysis of the file only
• d.A network-isolated sandbox environment✓

A sandbox provides an isolated, instrumented environment to detonate and observe malware behavior dynamically, capturing file, registry, and network activity. Static analysis alone cannot reveal runtime behavior, and scanning or packet capture does not execute the sample. Network isolation prevents the malware from spreading or contacting live infrastructure.

A SOC receives a threat intelligence feed listing IP addresses, file hashes, and domains tied to an active campaign. How are these data points best categorized?

• a.Tactics, techniques, and procedures (TTPs)
• b.Indicators of compromise (IoCs)✓
• c.Common Vulnerabilities and Exposures (CVEs)
• d.Security control baselines

Atomic artifacts such as IPs, hashes, and domains are indicators of compromise used to detect known-bad activity. TTPs describe higher-level adversary behavior, which is more durable but harder to detect. IoCs sit low on the Pyramid of Pain because attackers can change them easily, but they remain useful for rapid matching in a SIEM or EDR.

While analyzing network flow data, an analyst notices a single internal host making consistent, small outbound connections to one external IP every 60 seconds. What technique should the analyst apply to characterize this?

• a.CVSS base scoring
• b.Credentialed scanning
• c.Beaconing detection through traffic pattern analysis✓
• d.Chain-of-custody documentation

Regular, low-volume connections at fixed intervals are a classic signature of C2 beaconing, and analyzing traffic periodicity helps distinguish it from normal traffic. Threat hunters look at connection frequency, jitter, and destination reputation. CVSS scoring and credentialed scanning address vulnerabilities, not active communications, and chain of custody applies to evidence handling.

An organization wants to proactively search its environment for undetected threats based on a hypothesis derived from recent intelligence. Which activity does this describe?

• a.Threat hunting✓
• b.Vulnerability remediation
• c.Patch management
• d.Chain-of-custody transfer

Threat hunting is a proactive, hypothesis-driven search for adversaries that have evaded automated detections. It leverages intelligence, ATT&CK techniques, and analyst intuition to uncover hidden compromise. Unlike reactive alerting, hunting assumes a breach may already exist and seeks evidence of it across logs, endpoints, and network data.

An analyst correlates authentication logs and finds a user account successfully logging in from two countries within five minutes. What analytical concept identifies this anomaly?

• a.Data enrichment
• b.Sandbox detonation
• c.Signature-based detection
• d.Impossible travel detection✓

Impossible travel flags logins from geographically distant locations within a timeframe too short to physically travel, suggesting credential compromise or session hijacking. This behavioral analytics technique relies on correlating timestamps with geolocation data. It is a common UEBA use case that signature-based detection cannot catch because no known-bad indicator is present.

An analyst must prioritize remediation for a vulnerability with a CVSS base score of 9.8. Before escalating, which additional factor most improves prioritization accuracy?

• a.The alphabetical order of the affected hostname
• b.Environmental and threat context such as asset exposure and active exploitation✓
• c.The vendor's marketing severity label only
• d.The number of characters in the CVE identifier

A CVSS base score reflects intrinsic severity but ignores your environment; adding environmental metrics and threat intelligence (like known active exploitation) sharpens real-world risk. A 9.8 on an isolated, non-critical asset may rank below a 7.0 on an internet-facing crown-jewel system. Context-driven prioritization prevents wasting effort on theoretically severe but practically low-risk findings.

A scan of a Linux server reports a critical vulnerability, but manual verification shows the affected package is not installed. How should the analyst classify this result?

• a.False positive✓
• b.True positive
• c.False negative
• d.Zero-day

A false positive occurs when a scanner reports a vulnerability that does not actually exist on the target. Verifying findings before remediation prevents wasted effort and preserves credibility with system owners. Documenting the false positive and tuning the scan policy helps reduce recurrence in future assessments.

An organization wants deeper, more accurate vulnerability results including missing patches and insecure configurations on its servers. Which scan approach best achieves this?

• a.An uncredentialed external scan only
• b.A passive network sniff
• c.A credentialed (authenticated) scan✓
• d.A single ping sweep

Credentialed scans log into the target with valid credentials, allowing the scanner to inspect installed packages, patch levels, and configuration files directly. This yields far more accurate results and fewer false positives than uncredentialed scans, which only see the external surface. The tradeoff is credential management and slightly higher load on scanned systems.

A security team maintains an ongoing inventory of all internet-facing assets, including shadow IT and forgotten cloud instances, to reduce exposure. What discipline does this describe?

• a.Chain of custody
• b.Static malware analysis
• c.Sandboxing
• d.Attack surface management✓

Attack surface management continuously discovers, inventories, and monitors all externally reachable assets to minimize exploitable exposure. It is especially important for catching unmanaged or shadow IT resources that traditional scanning may miss. Reducing the attack surface lowers the number of entry points an adversary can target.

A critical patch cannot be deployed immediately because it requires a maintenance window two weeks out. Which interim measure best reduces risk in the meantime?

• a.Ignore the finding until the patch window
• b.Apply a compensating control such as network segmentation or a WAF rule✓
• c.Increase the CVSS score manually
• d.Delete the vulnerability record from the tracker

When a patch cannot be applied right away, compensating controls like segmentation, virtual patching, or firewall rules reduce exploitability until remediation occurs. This risk-based approach maintains protection without waiting for the maintenance window. Documenting the interim control and the plan to patch keeps the exception auditable.

An analyst is asked to explain why one vulnerability was patched before another with an identical CVSS base score. Which factor most justifies the difference?

• a.One had a public, weaponized exploit and was on an internet-facing asset✓
• b.One CVE was published on an earlier date
• c.One vendor's name comes first alphabetically
• d.One had a longer description in the advisory

Identical base scores can carry very different real-world risk once exploit availability and asset exposure are considered. A weaponized exploit on an internet-facing system dramatically raises the likelihood and impact of compromise. Threat context and exploitability, often reflected in CVSS temporal metrics or exploit prediction scoring, drive rational prioritization.

After remediating a vulnerability, what step best confirms the fix was effective and did not introduce regressions?

• a.Close the ticket immediately based on the vendor's release notes
• b.Wait for the next quarterly scan only
• c.Perform a validation rescan of the affected asset✓
• d.Remove the asset from the scan scope

A validation (verification) rescan confirms the vulnerability is actually resolved and detects any new issues the change may have introduced. Relying on release notes alone or waiting for the next scheduled scan leaves a gap in assurance. Verified remediation closes the loop in the vulnerability management lifecycle and supports accurate metrics.

An incident responder isolates a compromised host from the network to stop lateral movement while preserving it for analysis. Which incident response phase does this action belong to?

• a.Preparation
• b.Lessons learned
• c.Detection and analysis
• d.Containment✓

Isolating an affected system to halt the spread of an attack is a core containment activity. Containment buys time to investigate and plan eradication without allowing further damage. Preserving the host rather than immediately wiping it also protects evidence needed for later forensic analysis.

After an incident is fully resolved, the team meets to document what happened, what worked, and what to improve. Which phase of the lifecycle is this?

• a.Lessons learned (post-incident activity)✓
• b.Containment
• c.Eradication
• d.Detection and analysis

The lessons-learned phase captures root cause, timeline, and improvement actions to strengthen future response. Conducting it promptly while details are fresh maximizes value and feeds updates to playbooks and controls. Skipping this phase means the organization repeats avoidable mistakes.

During evidence collection, an analyst records who handled a seized hard drive, when, and for what purpose at every transfer. What forensic principle is being upheld?

• a.Data enrichment
• b.Chain of custody✓
• c.Threat hunting
• d.Sandbox isolation

Chain of custody documents every person who handled evidence and each transfer to prove it was not altered or tampered with. Maintaining an unbroken, well-documented chain is essential for evidence to be admissible in legal proceedings. Gaps in custody can render otherwise valuable evidence useless in court.

To preserve volatile evidence during forensic acquisition, which data should be collected first based on the order of volatility?

• a.Data archived on backup tapes
• b.Files on a powered-off disk
• c.CPU registers, cache, and RAM contents✓
• d.Router configuration stored in NVRAM

The order of volatility dictates collecting the most ephemeral data first, since it disappears quickly. CPU cache, registers, and RAM vanish when power is lost, so they are captured before disk or archival media. Following this order prevents loss of transient artifacts such as running processes, network connections, and encryption keys.

During eradication after a malware incident, which action most directly addresses the goal of this phase?

• a.Notifying the public relations team
• b.Drafting the final executive summary
• c.Restoring service-level agreements with vendors
• d.Removing malicious artifacts and closing the exploited vulnerability✓

Eradication removes the threat, including malware, persistence mechanisms, and the root-cause vulnerability, from the environment. It ensures the adversary cannot simply re-enter through the same path. Only after thorough eradication should the team move to recovery and restore systems to normal operations.

An analyst identifies a specific file hash and registry key left behind by an attacker and adds them to detection rules across all endpoints. What is the analyst primarily doing?

• a.Operationalizing indicators of compromise for detection✓
• b.Calculating a CVSS environmental score
• c.Performing a credentialed vulnerability scan
• d.Establishing chain of custody

Extracting IoCs like file hashes and registry keys and deploying them as detection content helps identify other compromised hosts quickly. This turns incident findings into proactive detection across the environment. Sharing these IoCs internally and with trusted communities strengthens collective defense.

A SOC manager wants a metric that shows how quickly the team resolves incidents from detection to closure. Which key performance indicator best fits?

• a.CVSS base score
• b.Mean time to respond/resolve (MTTR)✓
• c.Number of open firewall ports
• d.Total lines in the SIEM ruleset

MTTR measures the average time to respond to and resolve incidents, directly reflecting response efficiency. Tracking it over time reveals whether process improvements are working and where bottlenecks remain. Pairing MTTR with mean time to detect (MTTD) gives a fuller picture of program performance for stakeholders.

When reporting a major incident to executive leadership, which communication approach is most effective?

• a.Provide raw packet captures and full log exports
• b.Use highly technical jargon to demonstrate depth
• c.Summarize business impact, risk, and recommended actions in clear language✓
• d.Withhold information until every detail is confirmed weeks later

Executives need concise, business-focused communication that explains impact, risk, and decisions required, not raw technical artifacts. Tailoring the message to the audience ensures leadership can make informed, timely decisions. Reserving deep technical detail for appendices or technical stakeholders keeps the report actionable.

A vulnerability report is being prepared for both engineers and management. What is the best practice for structuring it?

• a.Include an executive summary for leaders and detailed technical findings for remediation teams✓
• b.Send only the CVSS numbers with no context
• c.Combine everything into one dense paragraph
• d.Report findings verbally with no written record

Effective reports serve multiple audiences by pairing a concise executive summary with detailed technical findings and remediation guidance. Leaders get risk and business context, while engineers get the specifics needed to act. A clear written record also supports accountability, tracking, and compliance evidence.