CompTIA CS0-004: CompTIA CySA+ (V4)

Last checked October 22, 2026 against the official CompTIA exam page.

1. Question 1Security Operations

   A SOC analyst notices repeated failed logons for many accounts from a single source IP, followed by one successful logon. Which detection approach best matches this pattern?

   1. AChecking the certificate expiry dates of internet-facing web servers in the DMZ
   2. BCorrelating authentication logs over time to find brute force followed by a successful login
   3. CScanning the host for open TCP ports and service banners to map running software
   4. DReviewing the printer spooler logs on the floor network for recurring paper jams
   Show answer and explanationHide answer

   Correct answer: B

   Correlating failed and successful authentication events over time reveals password spraying or brute force that ends in a compromise. A port scan or unrelated logs do not show the authentication sequence, and certificate dates are not relevant.

2. Question 2Vulnerability Management

   A vulnerability scanner reports a critical finding on a server that is not reachable from the internet. Which factor should most influence the prioritization decision?

   1. AThe vendor logo and color scheme shown in the scanner dashboard header on login
   2. BThe date the scan was run and how long ago the previous scan completed for this host
   3. CExploitability in the environment, asset value, and whether compensating controls reduce exposure
   4. DThe character length of the vulnerability title and how many words it contains in the scanner report table
   Show answer and explanationHide answer

   Correct answer: C

   Risk-based prioritization weighs exploitability, business impact and existing controls, and an unreachable asset may be lower risk than its raw severity suggests. Logos, name lengths and scan dates do not measure risk.

3. Question 3Incident Response and Management

   During an incident, an analyst must preserve evidence on a compromised laptop before it is reimaged. Which action should come first?

   1. ACreate a forensic image or memory capture with chain-of-custody documentation before changing the system
   2. BReimage the laptop immediately to restore service for the user, then return it to the general asset pool with a clean golden image
   3. CDelete the suspicious files from the temp and startup folders, clear the event logs, and reboot the laptop to remove the threat
   4. DPost the laptop's hostname and a description of the incident on public social media
   Show answer and explanationHide answer

   Correct answer: A

   Capturing memory and a disk image before changes preserves volatile and persistent evidence, and chain-of-custody records keep it admissible. Reimaging or deleting files destroys evidence, and public posting is inappropriate.

4. Question 4Reporting and Communication

   Executives want a monthly summary of security operations that shows whether the team is improving. Which metric best demonstrates trend in detection performance?

   1. AThe count of unused software licenses assigned to employees who have left the company
   2. BThe number of pages in the policy document and its revision history
   3. CThe number of coffee cups consumed by the team during each weekly stand-up meeting
   4. DMean time to detect, trended over several months with context on attack volume
   Show answer and explanationHide answer

   Correct answer: D

   Mean time to detect trended over time, with volume context, shows whether detection is getting faster. Coffee counts, license tallies and policy page counts say nothing about detection performance.

5. Question 5Security Operations

   Which SIEM capability reduces alert fatigue by grouping related events into a single incident for analysts?

   1. ACorrelation rules with aggregation and deduplication
   2. BIncreasing the log retention period on SIEM indexes for audits
   3. CDisabling low-severity alerts without triage
   4. DForwarding raw events to a shared spreadsheet
   Show answer and explanationHide answer

   Correct answer: A

   Correlation and aggregation combine related events into one alert or case, which lowers the volume analysts must triage. Longer retention does not reduce noise, disabling alerts without review hides real activity, and spreadsheets do not scale.