Free CompTIA CS0-004 Practice Test Questions and Answers (2026)

To investigate potential data exfiltration via DNS, the analyst must filter the packet capture for DNS traffic associated with the compromised host. The tcpdump command with the -r flag reads from a saved pcap file. Appending the Berkeley Packet Filter (BPF) syntax port 53 and host 10.213.4.27 accurately isolates all DNS queries and responses involving the specific file server. This allows the analyst to inspect the DNS payloads for encoded exfiltrated data without being overwhelmed by unrelated network traffic.

A. The strings command extracts printable characters from a binary file but cannot parse network protocols or accurately isolate traffic for a specific host and port.

B. Zeek generates specific logs like dns.log for DNS traffic; file.log is used for file extractions, which does not capture DNS query-based exfiltration.

C. Snort is an Intrusion Detection System. While it can read pcaps, eve.log is typically associated with Suricata, making this command syntax incorrect for standard Snort usage.

1. TCPDUMP/LIBPCAP public repository. tcpdump(1) manual page. Section: pcap-filter - packet filter syntax.

2. SANS Institute. (2020). SEC503: Intrusion Detection In-Depth. Courseware covering Berkeley Packet Filter (BPF) syntax and tcpdump usage for traffic analysis.

Usage policies, specifically Acceptable Use Policies (AUPs) tailored for emerging technologies, establish the mandatory rules and governance frameworks for how employees interact with Artificial Intelligence (AI) tools. By defining strict boundaries on what types of corporate data can be inputted into AI models and how AI-generated outputs can be utilized, these policies protect sensitive intellectual property and customer data from unauthorized exposure. This administrative control ensures that an organization can safely leverage AI's productivity benefits while maintaining strict alignment with business objectives, data privacy laws, and regulatory compliance requirements.

B. Prompt engineering is a technical skill used to optimize inputs for AI models to get better outputs, not a governance control for protecting business data.

C. Non-disclosure agreements (NDAs) are legal contracts establishing confidentiality between external parties, not internal governance frameworks for employee technology usage.

D. Incident response policies dictate the procedures for handling and recovering from security breaches after they occur, rather than proactively governing daily AI usage.

1. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST.AI.100-1). Section 3.1 (Govern Function), pp. 20-22. https://doi.org/10.6028/NIST.AI.100-1

2. CompTIA CySA+ CS0-004 Official Certification Guide. (2023). Domain 1: Security Operations, Section: Organizational Security Policies.

The organization cannot completely block the malicious URL because it is strictly tied to a required business process. Instead, the security team implements alternative measures—such as restrictive firewall rules, enhanced monitoring, and aggressive patching—to mitigate the risk. These alternative measures are known as compensating controls. Compensating controls are deployed when a primary security control (in this case, outright blocking the malicious domain) cannot be implemented due to legitimate business or technical constraints, ensuring the residual risk remains at an acceptable level.

A. Patching is only one component of the response; it does not encompass the firewall restrictions and monitoring implemented to offset the inability to block the URL.

B. Configuration management refers to maintaining systems in a desired, consistent state, not the specific act of applying alternative security measures to mitigate an unblockable threat.

D. Attack surface management involves the continuous discovery and reduction of organizational vulnerabilities, whereas this scenario describes targeted incident response using alternative risk mitigation.

1. NIST Special Publication 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations", Appendix A (Compensating Controls).

2. ISACA CISA Review Manual, 27th Edition, Section 1 (Information Systems Auditing Process - Compensating Controls).

In enterprise vulnerability management, the inability to immediately remediate critical vulnerabilities is most commonly caused by systemic inhibitors rather than administrative oversights. Legacy and proprietary systems often lack modern update mechanisms, are no longer supported, or are too fragile to patch without causing operational outages. A lack of patch availability occurs when vendors have not yet released a fix (e.g., zero-day vulnerabilities) or the product is end-of-life. Vendor dependencies further delay remediation, as organizations must wait for third-party suppliers to develop, test, and distribute patches before they can be applied. These factors represent standard remediation inhibitors explicitly defined in the CompTIA CySA+ framework.

A. The scenario states all addressable assets were scanned, implying an existing inventory. Lack of technical skills is a resource issue, not a primary technical inhibitor for immediate patching.

B. Enterprise patching is typically performed remotely via centralized management tools; physical access challenges are rarely the primary reason for widespread remediation delays.

C. An inaccurate asset inventory contradicts the premise that the analyst successfully scanned the addressable enterprise assets to discover these specific vulnerabilities.

1. CompTIA CySA+ CS0-004 Certification Exam Objectives. Domain 3.0 Vulnerability Management, Objective 3.2: "Explain vulnerability management activities" - specifically lists "Inhibitors to remediation" including legacy systems, proprietary systems, and vendor dependencies.

2. NIST Special Publication 800-40 Revision 4, "Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology," Section 2.2 (Patching Challenges), pp. 5-7. (Details challenges regarding vendor dependencies, legacy systems, and lack of patch availability).

3. NIST Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations," Control SI-2 (Flaw Remediation), p. 263. (Discusses remediation timeframes, exceptions, and dependencies on vendor patch releases).

The scan results identify two systems exposing services that permit communications without transport

encryption, making B the correct count. The analyst must examine each discovered service rather than merely

count open ports, because the security property being evaluated is whether the identified protocol transmits its

session or application data without adequate encryption.

Common examples include HTTP instead of HTTPS, Telnet instead of SSH, and legacy FTP rather than protected

file-transfer alternatives. The presence of an unencrypted service does not automatically prove that sensitive

information is currently being transmitted, but it identifies a configuration that can expose credentials,

commands, session content, or application data to interception when used.

The correct vulnerability-management workflow is to map discovered ports to services, determine the security

characteristics of those protocols, verify whether encryption is available and enforced, and then prioritize

remediation according to asset exposure and business requirements. Where possible, administrators should

disable unnecessary cleartext services or replace them with cryptographically protected equivalents.

This question therefore tests interpretation of vulnerability or port-scan output, not simple arithmetic. The two

affected systems are those whose discovered services permit cleartext communications.

Study Guide Reference: Vulnerability Management Scan Result Interpretation Ports and Protocols Cleartext

Services Encryption in Transit Remediation and Secure Configuration.

The correct answer is Medium or High (accept either as they demonstrate understanding of risk-based

prioritization). This scenario tests whether candidates understand that CVSS base scores must be

contextualized against business impact and environmental factors. While the CVSS base score is 9.8 (Critical),

the environmental score should be significantly lowered because the vulnerable system lacks access to

sensitive data, production systems, or external networks. Risk-based vulnerability prioritization (a core CS0-004

objective) means that a vulnerability on an isolated development system poses much lower actual risk than its

base CVSS score suggests.

Many organizations use CVSS environmental factors or apply their own risk scoring to downgrade these from

Critical to Medium or High based on context. Candidates should recognize that blindly remediating by CVSS

base score alone leads to poor resource allocation. The two vulnerabilities would be deprioritized below the 45

vulnerabilities (7.0-8.9) that likely exist on internet-facing or production systems, even though their base

scores are higher.

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Comptia_CS0-004/page_119_img_1.jpg

The correct answer is MITRE ATT&CK.

MITRE ATT&CK is the industry-standard knowledge base of adversary tactics and techniques based on real-

world observations. The framework organizes techniques by tactic (e.g., Initial Access, Persistence, Privilege

Escalation, Lateral Movement, Exfiltration, Impact) and platform (Windows, Linux, macOS, cloud, network,

containers). In this scenario, the indicators map to multiple tactics: the failed login attempts and credential

compromise relate to Initial Access and Credential Access; the successful logins from unusual locations and

times relate to Initial Access and Lateral Movement; EDR detections indicate Execution and Lateral Movement;

and data access patterns suggest Exfiltration or Impact. Using ATT&CK enables SOC teams to document

findings in a standardized way, improves threat intelligence sharing with external partners, and supports

defense planning by identifying which techniques the organization is most vulnerable to.

The term 'chain of custody' refers to the documented record of who has handled evidence, when, and how it

was handled. In incident response, maintaining a strict chain of custody is critical for both technical

investigations and potential legal proceedings. This ensures evidence integrity and admissibility if the incident

results in disciplinary action, litigation, or law enforcement involvement. The CySA+ exam requires candidates

to understand key incident response techniques including evidence handling, which is a foundational practice

in the eradication and recovery phases of the incident response process. This question tests knowledge of

formal incident response procedures and terminology used in professional security operations.