Questions & answers (free, no sign-in needed)
- View
10 beginner questions on the CySA+ CS0-004 domains: security operations (SIEM, indicators of compromise, brute-force patterns), vulnerability management (CVSS, the CISA KEV catalog, compensating controls), incident response (containment, MITRE ATT&CK) and reporting and communication (lessons learned, media inquiries).
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
An analyst needs one platform that collects and correlates logs from firewalls, servers and cloud services. Which tool fits best?
- A. EDR agent
- B. SIEM ✔ correct
- C. DLP gateway
- D. Web application firewall
Answer: B. A security information and event management (SIEM) system centralizes logs from many sources and correlates them. EDR focuses on endpoint activity, DLP on data leaving the organization and a WAF on web traffic.
Source: csrc.nist.gov/glossary/term/security_information_and_event_management · Domain: Security Operations
An analyst sees hundreds of failed sign-ins for one account within a few minutes, all from the same external IP address, followed by one successful sign-in. What does this most likely indicate?
- A. A DNS cache poisoning attack
- B. A routine password expiry
- C. A brute-force password attack ✔ correct
- D. A cross-site scripting attack
Answer: C. Many rapid failed attempts followed by a success is the typical pattern of brute-force password guessing (MITRE ATT&CK T1110). Treat the account as compromised: reset the password and review its activity.
Source: attack.mitre.org/techniques/T1110/ · Domain: Security Operations
An indicator of compromise (IoC), such as a known malicious file hash or IP address, is an artifact that suggests a system may have been compromised.
- A. True ✔ correct
- B. False
Answer: A. True. IoCs are technical artifacts or observables suggesting that an attack is imminent, underway or has already happened. Analysts search logs and endpoints for them and share them as threat intelligence.
Source: csrc.nist.gov/glossary/term/indicator_of_compromise · Domain: Security Operations
Which standard produces a numerical score that reflects the severity of a vulnerability?
- A. CVSS ✔ correct
- B. CVE
- C. CWE
- D. STIX
Answer: A. The Common Vulnerability Scoring System (CVSS) produces a 0-10 severity score. CVE gives each disclosed vulnerability an identifier, CWE lists weakness types and STIX is a format for sharing threat intelligence.
Source: www.first.org/cvss/ · Domain: Vulnerability Management
A team has too many open vulnerabilities to fix at once and wants to start with flaws that attackers are known to exploit in the wild. Which free source should it check?
- A. The OWASP Top 10 list
- B. The MITRE CWE list
- C. The NIST password guidelines
- D. The CISA KEV catalog ✔ correct
Answer: D. The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with evidence of active exploitation, which makes it a strong input for patch prioritization alongside CVSS and business context.
Source: www.cisa.gov/known-exploited-vulnerabilities-catalog · Domain: Vulnerability Management
A critical server has a known vulnerability, but the vendor patch cannot be installed until next month. Which two actions reduce the risk in the meantime? (Select TWO)
- A. Move the server to an isolated network segment ✔ correct
- B. Turn off logging to improve server performance
- C. Restrict access to the vulnerable service with firewall rules ✔ correct
- D. Remove the finding from the scan report
- E. Give more users administrator rights on the server
Answer: A, C. When a patch must wait, compensating controls reduce exposure: segmenting the asset and limiting access with firewall rules shrink the attack surface. Hiding the finding or weakening controls only adds risk.
Source: nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r4.pdf · Domain: Vulnerability Management
An analyst confirms malware on a workstation and wants to stop it from spreading while keeping evidence for analysis. What should be done first?
- A. Reimage the workstation right away
- B. Isolate the workstation from the network ✔ correct
- C. Delete the suspicious files by hand
- D. Wait for the next weekly scan to confirm
Answer: B. Containment comes first: isolating the host stops the spread and keeps its state for investigation. Reimaging or deleting files is eradication and would destroy evidence; waiting lets the malware spread.
Source: nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf · Domain: Incident Response and Management
Which framework is a knowledge base of adversary tactics and techniques based on real-world observations?
- A. Cyber Kill Chain
- B. Diamond Model
- C. MITRE ATT&CK ✔ correct
- D. OWASP ASVS
Answer: C. MITRE ATT&CK is a public knowledge base of adversary tactics and techniques built from real-world observations. The Cyber Kill Chain and Diamond Model are attack analysis models, and OWASP ASVS is an application security standard.
Source: attack.mitre.org/ · Domain: Incident Response and Management
After a ransomware incident is resolved, the team meets to discuss what went well, what failed and how to improve detection. What is this activity called?
- A. A lessons-learned review ✔ correct
- B. A tabletop exercise
- C. A vulnerability scan
- D. A change advisory board
Answer: A. A lessons-learned (post-incident) review captures what happened and what to improve, and feeds changes back into detection and response. A tabletop exercise is a discussion of a simulated incident, not a real one.
Source: nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf · Domain: Reporting and Communication
During an ongoing incident, a journalist calls a security analyst and asks for details. What should the analyst do?
- A. Share the technical details so the story is accurate
- B. Confirm the incident but refuse to give any details
- C. Refer the journalist to the designated media contact ✔ correct
- D. Post an update on social media to get ahead of it
Answer: C. Media and public communication should go through the people the incident response plan designates, such as public affairs. Analysts should not comment, because early or wrong statements can cause harm.
Source: nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf · Domain: Reporting and Communication
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public CompTIA exam objectives (CySA+ V4 (CS0-004) exam objectives, launched 2026-06-23 (V3 CS0-003 English exam retires 2026-12-22)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by CompTIA; exam names are trademarks of their owners. Official exam page: www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/.