An analyst reviewing SIEM alerts wants to reduce noise by suppressing repeated benign events from a known vulnerability scanner. Which action best preserves detection capability while cutting alert volume?

Create a tuning rule that excludes traffic from the scanner's known IP for that specific signature

Delete all log sources associated with the scanner's subnet

Disable the correlation rule entirely across all hosts

Lower the SIEM's overall logging retention to 7 days

During endpoint analysis, an EDR agent flags a signed PowerShell process spawning encoded commands that reach out to a rare external domain. What behavior does this most likely represent?

Living-off-the-land activity using a legitimate binary for malicious purposes

A routine Windows update download

A false positive caused by an expired code-signing certificate

Normal administrative scripting requiring no review

A SOC receives a threat intelligence feed listing IP addresses, file hashes, and domains tied to an active campaign. How are these data points best categorized?

Indicators of compromise (IoCs)

Tactics, techniques, and procedures (TTPs)

Common Vulnerabilities and Exposures (CVEs)

A critical patch cannot be deployed immediately because it requires a maintenance window two weeks out. Which interim measure best reduces risk in the meantime?

Apply a compensating control such as network segmentation or a WAF rule

Ignore the finding until the patch window

Increase the CVSS score manually

Delete the vulnerability record from the tracker

After remediating a vulnerability, what step best confirms the fix was effective and did not introduce regressions?

Perform a validation rescan of the affected asset

Close the ticket immediately based on the vendor's release notes

Wait for the next quarterly scan only

Remove the asset from the scan scope

After an incident is fully resolved, the team meets to document what happened, what worked, and what to improve. Which phase of the lifecycle is this?

Lessons learned (post-incident activity)

During eradication after a malware incident, which action most directly addresses the goal of this phase?

Removing malicious artifacts and closing the exploited vulnerability

Notifying the public relations team

Drafting the final executive summary

Restoring service-level agreements with vendors

A SOC manager wants a metric that shows how quickly the team resolves incidents from detection to closure. Which key performance indicator best fits?

Mean time to respond/resolve (MTTR)

Total lines in the SIEM ruleset

Practice Tests

Test your knowledge with questions from all 4 exam topics.

Browse all questions →

Know your pass rate before the real exam

Take a full timed mock exam and walk in with confidence — don't waste money and time on a retake.

Take the mock exam →

All topics Security Operations Vulnerability Management Incident Response & Management Reporting & Communication 🧠 Smart Review 🎯 Focus weak ⭐ Saved 🔁 My mistakes

Round:

Loading questions…

Full Mock Exam

115 questions · 3.5 hours · Mirrors the real exam

Start Mock Exam

CompTIA CySA+ (CS0-004) Practice Test

Frequently asked questions

How many CompTIA CySA+ (CS0-004) practice questions are here?+

A full bank of original CompTIA CySA+ (CS0-004) practice questions across the official content areas, weighted like the real exam, with explanations. Free, no signup.

What is the CompTIA CySA+ (CS0-004) exam like?+

About 85 questions, 165 minutes, and you need 750 / 900% to pass. Practice by topic here, then take the full timed mock exam to gauge readiness.

Are these the real exam questions?+

No. Every question is 100% original, written from public primary sources with explanations. We never copy real exam questions or paid prep material.

Can I study in Chinese or Spanish?+

PrepPass practice is in English, 中文 and Español. The official exam is in English — switch the question language to English any time to rehearse the exact terminology you'll see on test day.

Sample practice questions

A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.

1. Security Operations
An analyst reviewing SIEM alerts wants to reduce noise by suppressing repeated benign events from a known vulnerability scanner. Which action best preserves detection capability while cutting alert volume?
- a.Delete all log sources associated with the scanner's subnet
- b.Create a tuning rule that excludes traffic from the scanner's known IP for that specific signature
- c.Disable the correlation rule entirely across all hosts
- d.Lower the SIEM's overall logging retention to 7 days
Answer: b
Explanation: Tuning to exclude a known-good source for one signature removes false positives without blinding the SIEM to real threats. Deleting log sources or disabling the rule globally would create blind spots, and shortening retention harms investigations. Targeted allow-listing keeps fidelity high while reducing analyst fatigue.
2. Security Operations
During endpoint analysis, an EDR agent flags a signed PowerShell process spawning encoded commands that reach out to a rare external domain. What behavior does this most likely represent?
- a.Living-off-the-land activity using a legitimate binary for malicious purposes
- b.A routine Windows update download
- c.A false positive caused by an expired code-signing certificate
- d.Normal administrative scripting requiring no review
Answer: a
Explanation: Adversaries frequently abuse trusted, signed utilities such as PowerShell to blend in, a technique known as living off the land (LOLBins). Encoded commands and beaconing to rare domains are strong indicators of command-and-control activity. Because the binary is legitimately signed, signature-based tools may miss it, making behavioral EDR analysis essential.
3. Security Operations
A SOC receives a threat intelligence feed listing IP addresses, file hashes, and domains tied to an active campaign. How are these data points best categorized?
- a.Tactics, techniques, and procedures (TTPs)
- b.Indicators of compromise (IoCs)
- c.Common Vulnerabilities and Exposures (CVEs)
- d.Security control baselines
Answer: b
Explanation: Atomic artifacts such as IPs, hashes, and domains are indicators of compromise used to detect known-bad activity. TTPs describe higher-level adversary behavior, which is more durable but harder to detect. IoCs sit low on the Pyramid of Pain because attackers can change them easily, but they remain useful for rapid matching in a SIEM or EDR.
4. Security Operations
An analyst correlates authentication logs and finds a user account successfully logging in from two countries within five minutes. What analytical concept identifies this anomaly?
- a.Data enrichment
- b.Sandbox detonation
- c.Signature-based detection
- d.Impossible travel detection
Answer: d
Explanation: Impossible travel flags logins from geographically distant locations within a timeframe too short to physically travel, suggesting credential compromise or session hijacking. This behavioral analytics technique relies on correlating timestamps with geolocation data. It is a common UEBA use case that signature-based detection cannot catch because no known-bad indicator is present.
5. Vulnerability Management
A scan of a Linux server reports a critical vulnerability, but manual verification shows the affected package is not installed. How should the analyst classify this result?
- a.False positive
- b.True positive
- c.False negative
- d.Zero-day
Answer: a
Explanation: A false positive occurs when a scanner reports a vulnerability that does not actually exist on the target. Verifying findings before remediation prevents wasted effort and preserves credibility with system owners. Documenting the false positive and tuning the scan policy helps reduce recurrence in future assessments.
6. Vulnerability Management
A critical patch cannot be deployed immediately because it requires a maintenance window two weeks out. Which interim measure best reduces risk in the meantime?
- a.Ignore the finding until the patch window
- b.Apply a compensating control such as network segmentation or a WAF rule
- c.Increase the CVSS score manually
- d.Delete the vulnerability record from the tracker
Answer: b
Explanation: When a patch cannot be applied right away, compensating controls like segmentation, virtual patching, or firewall rules reduce exploitability until remediation occurs. This risk-based approach maintains protection without waiting for the maintenance window. Documenting the interim control and the plan to patch keeps the exception auditable.
7. Vulnerability Management
After remediating a vulnerability, what step best confirms the fix was effective and did not introduce regressions?
- a.Close the ticket immediately based on the vendor's release notes
- b.Wait for the next quarterly scan only
- c.Perform a validation rescan of the affected asset
- d.Remove the asset from the scan scope
Answer: c
Explanation: A validation (verification) rescan confirms the vulnerability is actually resolved and detects any new issues the change may have introduced. Relying on release notes alone or waiting for the next scheduled scan leaves a gap in assurance. Verified remediation closes the loop in the vulnerability management lifecycle and supports accurate metrics.
8. Incident Response & Management
After an incident is fully resolved, the team meets to document what happened, what worked, and what to improve. Which phase of the lifecycle is this?
- a.Lessons learned (post-incident activity)
- b.Containment
- c.Eradication
- d.Detection and analysis
Answer: a
Explanation: The lessons-learned phase captures root cause, timeline, and improvement actions to strengthen future response. Conducting it promptly while details are fresh maximizes value and feeds updates to playbooks and controls. Skipping this phase means the organization repeats avoidable mistakes.
9. Incident Response & Management
During eradication after a malware incident, which action most directly addresses the goal of this phase?
- a.Notifying the public relations team
- b.Drafting the final executive summary
- c.Restoring service-level agreements with vendors
- d.Removing malicious artifacts and closing the exploited vulnerability
Answer: d
Explanation: Eradication removes the threat, including malware, persistence mechanisms, and the root-cause vulnerability, from the environment. It ensures the adversary cannot simply re-enter through the same path. Only after thorough eradication should the team move to recovery and restore systems to normal operations.
10. Reporting & Communication
A SOC manager wants a metric that shows how quickly the team resolves incidents from detection to closure. Which key performance indicator best fits?
- a.CVSS base score
- b.Mean time to respond/resolve (MTTR)
- c.Number of open firewall ports
- d.Total lines in the SIEM ruleset
Answer: b
Explanation: MTTR measures the average time to respond to and resolve incidents, directly reflecting response efficiency. Tracking it over time reveals whether process improvements are working and where bottlenecks remain. Pairing MTTR with mean time to detect (MTTD) gives a fuller picture of program performance for stakeholders.