Free CS0-004 practice questions: 20 with answers
Twenty questions across the four CS0-004 domains, weighted as the published percentages are: seven on Security Operations, five on Vulnerability Management, five on Incident Response and Management and three on Reporting and Communication. These are original scenario questions written at objective level, and they are not taken from the real exam. Read the scenario for the clue (the evidence, the audience, the phase) before the options, and aim for 16 or more correct. The study plan shows how to turn missed questions into review time.
Security Operations
Question 1. A SIEM shows one user account signing in from two countries within ten minutes, followed by the creation of a mailbox forwarding rule. Which conclusion is best supported?
- A. A scheduled vulnerability scan
- B. A compromised account being abused
- C. A normal user on a VPN
- D. A false positive to be closed without review
Show answer
Answer: B
Impossible travel plus a new forwarding rule is a classic sign of a compromised account being used for mailbox abuse. A routine VPN login would not usually add a forwarding rule, a vulnerability scan does not create mailbox rules, and a false positive cannot be assumed when two indicators agree.
Want more questions like this? Full CS0-004 practice tests →
Question 2. An analyst needs to see the exact content of a suspicious conversation between a server and an external host. Which data source provides the payload?
- A. Flow records
- B. DNS query logs
- C. Authentication logs
- D. A full packet capture
Show answer
Answer: D
A full packet capture records the content of the traffic. Flow records show who talked to whom and how much but not content, DNS logs show lookups, and an authentication log shows sign-ins.
Want more questions like this? Full CS0-004 practice tests →
Question 3. A vendor-neutral intelligence report lists an adversary's tactics and techniques so a team can test whether its detections cover them. Which framework is the report most likely using?
- A. MITRE ATT&CK
- B. CVSS
- C. The CIA triad
- D. The Diamond Model
Show answer
Answer: A
MITRE ATT&CK catalogues adversary tactics and techniques and is used to map and test detection coverage. CVSS scores vulnerability severity, the CIA triad describes security properties, and the Diamond Model relates adversary, capability, infrastructure and victim rather than listing techniques.
Want more questions like this? Full CS0-004 practice tests →
Question 4. Which log source is most useful for confirming that a process on one endpoint spawned a command shell and then wrote a file to a startup folder?
- A. Firewall logs
- B. Web proxy logs
- C. EDR process and file telemetry
- D. A vulnerability scan report
Show answer
Answer: C
EDR telemetry records process creation and file activity on the endpoint. A firewall log sees only network connections, a web proxy log sees web requests, and a vulnerability scan report lists weaknesses rather than runtime behaviour.
Want more questions like this? Full CS0-004 practice tests →
Question 5. A SOC spends hours each day enriching alerts by hand: looking up the IP reputation, the user's department and the host owner. Which improvement gives the most benefit with the least risk?
- A. Disable the alert rule
- B. Automate the enrichment steps with a playbook
- C. Auto-close every low-confidence alert
- D. Add staff to do the same lookups
Show answer
Answer: B
Automating enrichment through a SOAR playbook removes repetitive lookups while analysts still make the decision. Disabling alerts loses visibility, auto-closing low-confidence alerts without review risks missed attacks, and hiring more staff does not remove the repetitive task.
Want more questions like this? Full CS0-004 practice tests →
Question 6. Analysts begin pasting full incident reports containing customer data into a public AI chatbot to speed up summaries. What is the main risk to address in AI governance?
- A. The chatbot may respond too slowly
- B. The reports will become too long
- C. Token costs will increase
- D. Sensitive data may leave the organisation’s control
Show answer
Answer: D
Sending sensitive data to an external AI service can expose it outside the organisation, so policy, approved tools and data handling rules are needed. Model speed, token cost and report length are not the main governance concern here.
Want more questions like this? Full CS0-004 practice tests →
Question 7. Threat hunters begin with the idea that an attacker who gained access might be using a built-in administration tool to move between servers, then search logs for that behaviour without any alert. What is this approach called?
- A. Hypothesis-driven threat hunting
- B. Alert triage
- C. Vulnerability scanning
- D. Patch validation
Show answer
Answer: A
Starting from a hypothesis about attacker behaviour and searching for evidence is hypothesis-driven threat hunting. Alert triage starts from a fired alert, vulnerability scanning looks for weaknesses, and patch validation checks fixes.
Want more questions like this? Full CS0-004 practice tests →
Vulnerability Management
Question 8. A team wants scan results that show missing patches and local configuration issues on servers, not just what an outside attacker can see. Which scan type fits?
- A. An unauthenticated external scan
- B. A port-only scan
- C. A credentialed scan
- D. A passive network capture
Show answer
Answer: C
A credentialed scan logs in to the host and can see installed software, patch level and local settings. An unauthenticated scan sees only what is exposed to the network, and a passive or port-only scan gives even less detail.
Want more questions like this? Full CS0-004 practice tests →
Question 9. A scan reports a critical remote code execution flaw, but the vulnerable service is on an isolated lab host with no sensitive data. Which action best reflects risk-based prioritisation?
- A. Schedule it after exposed and high-value assets, and track it
- B. Patch it before everything else because it is critical
- C. Mark it as a false positive
- D. Remove it from the scan scope
Show answer
Answer: A
Context matters: an isolated host with no sensitive data lowers business risk, so it can be scheduled behind exposed, high-value assets. Ignoring it entirely is wrong because the flaw remains, and treating raw CVSS as the only factor or patching it before internet-facing assets ignores exposure.
Want more questions like this? Full CS0-004 practice tests →
Question 10. Scan output flags a vulnerability on a server, but the administrator shows the affected feature is not installed. What should the analyst conclude and record?
- A. False negative
- B. True positive
- C. Compensating control
- D. False positive
Show answer
Answer: D
A finding that does not apply is a false positive, which should be verified and documented so it can be suppressed with justification. A false negative is a real issue the scanner missed, a true positive is a real finding, and a compensating control is a different mitigation.
Want more questions like this? Full CS0-004 practice tests →
Question 11. A critical patch cannot be applied to a legacy system for six months because of vendor limits. Which response is most appropriate?
- A. Leave it unrecorded until the vendor is ready
- B. Apply compensating controls and document an approved exception with an expiry date
- C. Exclude the system from future scans
- D. Lower the severity in the report
Show answer
Answer: B
A documented compensating control, such as segmentation or restricted access, with approved risk acceptance and an expiry date manages the gap. Leaving it undocumented, turning off scanning, or removing the finding hides the risk rather than managing it.
Want more questions like this? Full CS0-004 practice tests →
Question 12. Two vulnerabilities have the same CVSS base score. One is listed in the CISA Known Exploited Vulnerabilities catalog and the other is not. Which should be fixed first, all else equal?
- A. The one that is not catalogued
- B. Whichever was found first
- C. The one listed in the Known Exploited Vulnerabilities catalog
- D. Whichever has the shorter name
Show answer
Answer: C
Evidence of exploitation in the wild raises real-world risk, so the catalogued one comes first. Equal base scores do not mean equal risk, and alphabetical or age order is not a risk factor.
Want more questions like this? Full CS0-004 practice tests →
Incident Response and Management
Question 13. During an investigation, a server is confirmed to be exfiltrating data to an unknown address. The business owner asks for it to stay online. What should the analyst do first?
- A. Contain the activity, for example by blocking the destination, and escalate
- B. Wait for the next maintenance window
- C. Wipe the server and rebuild it
- D. Close the ticket as low priority
Show answer
Answer: A
Ongoing exfiltration calls for containment, such as blocking the destination or isolating the server, with escalation to the decision makers. Waiting for the next maintenance window leaves data leaving, and wiping the server first destroys evidence.
Want more questions like this? Full CS0-004 practice tests →
Question 14. The Cyber Kill Chain stage in which an attacker sends a malicious attachment to a target is called what?
- A. Reconnaissance
- B. Exploitation
- C. Delivery
- D. Installation
Show answer
Answer: C
Transmitting the weapon to the target is delivery. Reconnaissance is research beforehand, exploitation is triggering the vulnerability, and installation is placing the malware afterwards.
Want more questions like this? Full CS0-004 practice tests →
Question 15. After removing malware and resetting credentials, a team restores the affected servers from clean images. Which activity should continue after the servers are back in service?
- A. Deleting the logs for the incident
- B. Heightened monitoring for signs of reinfection
- C. Skipping the review to save time
- D. Removing the incident documentation
Show answer
Answer: B
Recovery includes monitoring for reinfection or attacker return. Deleting logs or incident documentation destroys evidence, and skipping the review loses the lessons.
Want more questions like this? Full CS0-004 practice tests →
Question 16. An analyst plans to hand a disk image to the legal team for possible court use. Which practice best preserves its value as evidence?
- A. Email the image to the legal team
- B. Analyse the original drive directly
- C. Hand it over without documentation
- D. Hash the image and keep a chain of custody log
Show answer
Answer: D
Hashing the image and recording every transfer in a chain of custody shows the evidence is unchanged and who held it. Email attachments, working on the original and unsigned handovers weaken its integrity.
Want more questions like this? Full CS0-004 practice tests →
Question 17. A post-incident review concludes that ransomware entered through an internet-facing remote desktop service with a reused password and no MFA. What has the review identified?
- A. The symptom
- B. The root cause
- C. The recovery action
- D. A false positive
Show answer
Answer: B
The weak, exposed access path that made the incident possible is the root cause. The encryption is the symptom, the ransom note is an artefact, and the backup restore is a recovery action.
Want more questions like this? Full CS0-004 practice tests →
Reporting and Communication
Question 18. A security manager wants a view that shows open critical vulnerabilities by business unit and how long each has been open, refreshed daily. Which deliverable fits best?
- A. A one-time scan export
- B. A lessons-learned document
- C. A policy statement
- D. A dashboard
Show answer
Answer: D
A dashboard gives a refreshed, filterable view of ageing and ownership. A one-time scan export, a lessons-learned document and a policy statement do not provide a continuously updated view.
Want more questions like this? Full CS0-004 practice tests →
Question 19. During an active incident, who should decide whether customers and regulators are notified?
- A. Management with legal and compliance input
- B. The analyst who found the alert
- C. A journalist who asked
- D. The affected user
Show answer
Answer: A
Notification has legal and business consequences, so it is decided by management with legal and compliance input through the escalation path. The first analyst on the alert, an external reporter or the affected user should not decide alone.
Want more questions like this? Full CS0-004 practice tests →
Question 20. Which pair of measures best shows how quickly a SOC notices and then acts on incidents?
- A. Patch coverage and scan frequency
- B. Ticket count and staff headcount
- C. Mean time to detect and mean time to respond
- D. Number of rules and number of dashboards
Show answer
Answer: C
Mean time to detect and mean time to respond cover noticing and acting. Patch coverage and scan frequency describe vulnerability work, and ticket count and staff headcount are volume or capacity figures, not speed.
Want more questions like this? Full CS0-004 practice tests →
After the test
Count correct answers per domain, not only the total. Several misses in one domain point to the matching guide: security operations, vulnerability management, incident response or reporting. CompTIA publishes the exam as a maximum of 85 questions in 165 minutes, so this test is shorter than the real thing and is a diagnostic, not a prediction of the result.