CS0-004 sample questions: 5 worked examples
Five scenario questions follow, covering each CS0-004 domain and the new AI objective. Decide on an answer before you open the explanation, because the reasoning behind the wrong options is where most of the learning is. All five are written from CompTIA’s published objective summary; none comes from a real exam.
Question 1. A SIEM shows a workstation sending small HTTPS requests to the same external address every 60 seconds, around the clock, with nearly identical packet sizes. Which activity does this pattern most likely indicate?
- A. Data exfiltration over a bulk transfer
- B. Horizontal port scan
- C. Command-and-control beaconing
- D. Password brute-force attack
Show answer
Answer: C
Regular, low-volume connections at a fixed interval are the classic sign of command-and-control beaconing. Data exfiltration normally shows large or bursty outbound transfers, a port scan shows many destinations or ports in a short time, and a brute-force attack shows repeated failed authentications.
Want more questions like this? Full CS0-004 practice tests →
Question 2. Two servers have the same CVSS base score of 8.8. Server A hosts a public payment portal and the flaw is listed as exploited in the wild. Server B is an isolated lab host with no sensitive data. Which action is best?
- A. Remediate Server A first because of exploitation and exposure
- B. Remediate both at the same time because the scores are equal
- C. Remediate Server B first because it is easier to patch
- D. Wait for the next scheduled scan before acting on either
Show answer
Answer: A
Prioritization combines the score with exploit status, exposure and business context. Server A is exposed, critical to the business and under active exploitation, so it goes first. Treating equal scores as equal risk ignores context, the lab host is the lowest priority, and delaying all work until a re-scan wastes the window in which exploitation is happening.
Want more questions like this? Full CS0-004 practice tests →
Question 3. An analyst confirms that a file server is encrypting data and spreading to other shares. Which action should come first in the response?
- A. Restore all files from backup immediately
- B. Write the final incident report
- C. Remove the malware from every host
- D. Isolate the affected systems from the network
Show answer
Answer: D
Once the incident is confirmed and spreading, containment limits the damage, for example by isolating the affected hosts from the network while preserving evidence. Eradication and recovery come after containment, and writing the final report is a later post-incident activity.
Want more questions like this? Full CS0-004 practice tests →
Question 4. A SOC team adopts an AI assistant that summarizes alerts and suggests severity ratings. Which control best addresses the risk that analysts accept wrong summaries without question?
- A. Disable logging of the assistant’s outputs to save storage
- B. Require analyst review of the underlying evidence for high-severity decisions
- C. Allow the assistant to close low-severity alerts automatically with no review
- D. Paste raw alerts into a public chatbot for a second opinion
Show answer
Answer: B
AI output can be confident and wrong, so a governance control keeps a human reviewing the evidence behind high-impact decisions, and tracks accuracy over time. Disabling logging removes the audit trail, letting the model auto-close alerts removes the human check entirely, and sending raw alerts to any public service adds a data-exposure risk.
Want more questions like this? Full CS0-004 practice tests →
Question 5. After a phishing incident is closed, management wants a metric showing how quickly the SOC identified the compromise after it began. Which metric fits?
- A. Mean time to detect
- B. Mean time to respond
- C. Remediation effectiveness
- D. Count of open tickets
Show answer
Answer: A
Time to detect measures the gap between the start of the compromise and its discovery. Time to respond starts at detection and measures how long containment and response take, remediation effectiveness measures whether the fix worked, and the number of open tickets is a workload figure, not a detection speed.
Want more questions like this? Full CS0-004 practice tests →
Keep going
The 20-question practice test gives a longer run, and the domain pages start with security operations. A weak spot can be placed in the study plan.