Try 10 Real Questions From CompTIA CySA+ Cybersecurity Analyst (CS0-004 V4)
These are unedited questions from the full 800-question set, pulled from across every exam domain. Click a question to reveal the answer and the full rationale for every option, exactly as it appears in the PDF.
A Linux server keeps recreating a shell script in a startup directory after the file is deleted. The script opens outbound connections to an unknown host. What is the strongest conclusion?
Show answer & full rationale
A: Hardening activity does not usually recreate suspicious startup scripts with unknown outbound connectivity.
B (Correct): Reappearing startup-linked scripts plus suspicious outbound traffic strongly indicate persistence and likely malicious execution.
C: Legitimate user environment customization would not normally behave this way.
D: Clock drift would not explain file recreation or outbound sessions.
A security manager wants analysts to receive alerts that are already enriched with WHOIS data, IP reputation, and internal ticket context before triage begins. Which technology best enables this?
Show answer & full rationale
A: PKI manages certificates and trust relationships, not alert enrichment workflows.
B: DLP protects data from unauthorized movement, not alert enrichment.
C: MFA strengthens authentication but does not automate enrichment.
D (Correct): SOAR platforms are designed to automate enrichment, routing, and response workflows.
A biotech research lab's SOC uses an AI-assisted copilot to help correlate alerts and draft investigation summaries. During a shift, the copilot automatically linked two unrelated alerts and recommended isolating a research server. An analyst noticed the recommendation didn't match the underlying log data before approving it. What should the analyst do FIRST upon noticing this?
Show answer & full rationale
A (Correct): Independently verifying AI-generated recommendations against actual evidence before acting is essential — AI tools can produce confident-sounding but inaccurate (“hallucinated”) correlations.
B: Approving an unverified recommendation risks an unnecessary and disruptive containment action based on inaccurate correlation.
C: Disregarding the tool entirely, without investigating this specific case, wastes an opportunity to understand and fix the underlying issue.
D: Escalating before verifying basic facts is premature and skips the appropriate first step.
A developer fixes an XSS issue by escaping untrusted data before rendering it in HTML. Which secure coding best practice is this?
Show answer & full rationale
A: Input validation helps at a different stage; the control described is specifically about safe rendering.
B (Correct): Output encoding reduces XSS risk when displaying untrusted content.
C: Authentication controls access, not output rendering.
D: Edge discovery is an attack surface management concept, unrelated to rendering untrusted data safely.
At a payment processor, the vulnerability management team is triaging two findings on a legacy print server. Vulnerability A: CVSS base score 4.3, on an internet-facing legacy print server. Vulnerability B: CVSS base score 7.6, on an internally isolated system of similar criticality. Using a risk-based approach that accounts for both severity and exposure, which vulnerability should be remediated FIRST?
Show answer & full rationale
A: This reverses which finding actually carries the greater combined severity and exposure risk.
B: Treating both findings identically ignores the meaningful difference in combined risk between them.
C (Correct): Risk-based prioritization weighs both CVSS severity and real-world exposure. Vulnerability B's significantly higher CVSS score (7.6 vs. 4.3) outweighs Vulnerability A's internet-facing exposure, making it the greater actual risk here.
D: Ignoring CVSS and exposure context abandons risk-based prioritization entirely.
An operations team plans to power off a compromised system in five minutes. The responder needs to preserve active processes, in-memory malware artifacts, and open network sessions. What should be collected first?
Show answer & full rationale
A: Browser cache may matter later, but it is not the highest-priority time-sensitive evidence here.
B (Correct): Volatile memory and active system state can be lost at shutdown and should be captured first.
C: Historical scan reports are not the priority in this moment.
D: Archived emails are not the most time-sensitive evidence facing imminent loss.
A responder uploads forensic evidence to an unapproved personal storage location and does not document the transfer. What is the main issue?
Show answer & full rationale
A: Incidents do not close automatically because of evidence mishandling.
B (Correct): Undocumented, unauthorized evidence handling can compromise chain of custody and the credibility of the evidence.
C: Rebuild capability is not automatically affected by evidence mishandling.
D: Mishandling evidence does not remove persistence from the affected system.
A clean server image is restored from backup, validated, and returned to production after malware removal. Which phase is this?
Show answer & full rationale
A: Evidence acquisition is part of the investigation, not restoration.
B (Correct): Recovery includes restoration, validation, and return to business operations.
C: Initial analysis happens earlier in the incident lifecycle.
D: Scope identification is part of detection and analysis, not restoration.
An incident may require legally mandated disclosure to an external authority. Which communication path is most directly involved?
Show answer & full rationale
A (Correct): Regulatory reporting is the communication path for legally mandated disclosure obligations.
B: Hardware refresh review is unrelated to disclosure obligations.
C: Conference scheduling does not address disclosure obligations.
D: Wallpaper approval is irrelevant to incident communication.
Leadership at a defense contractor asks the security team to summarize the organization's exposure to AI-related risks (e.g., model risk, data poisoning, adversarial inputs) for a quarterly business review. What should they do?
Show answer & full rationale
A: Omitting AI-specific risks fails to give leadership the structured risk picture they need, however new the risk category is.
B: AI risk can be summarized in business terms like any other risk category; declining to try leaves leadership without the summary they asked for.
C (Correct): AI governance reporting needs the same structured, business-relevant framing as any other risk reporting — current risk categories, existing controls, and what residual exposure remains.
D: A purely technical deep-dive without business framing doesn't give leadership what they need for a quarterly business review.
CompTIA CySA+ Cybersecurity Analyst (CS0-004 V4) — $24.99, instant PDF download with full rationale on every answer.
View the practice questions →