CompTIA CySA+ (CS0-004) Practice Questions with Explanations

Correct answer: D

YARA matches files against rules describing strings and byte patterns characteristic of malicious code, and it runs locally against the file in place. That makes it the right choice for a quick determination on an isolated machine, where uploading the sample is neither possible nor desirable.

Why the other options are wrong:

• A. strings lists printable text and leaves the analyst to interpret it manually.
• B. VirusTotal requires uploading the file to a third party, which an isolated machine cannot do and which may disclose the sample.
• C. WHOIS queries domain registration data and has nothing to do with a binary.

Correct answer: B

Secure access service edge dissolves the perimeter by moving security enforcement into a distributed cloud fabric and applying it to the user and the session wherever they are. Access no longer depends on being inside a network boundary, which is what makes the topology perimeter-less.

Why the other options are wrong:

• A. A hybrid cloud connects environments and still relies on boundaries between them.
• C. Cloud-native computing describes how applications are built and packaged.
• D. Content delivery networks distribute content geographically to improve performance.

Correct answer: A

A hallucination is a model producing output that is fluent and plausible but not grounded in its input - here, events that never occurred. The defining feature is that the fabrication originates in the model's generation rather than in tampered data or a hostile instruction.

Why the other options are wrong:

• B. Data exposure is the unintended disclosure of information, not the invention of it.
• C. Malicious prompts would require an attacker crafting input to steer the model.
• D. Model poisoning corrupts training data to change behaviour, which is a deliberate attack rather than this failure mode.

Correct answer: A

A honeypot in a separate environment invites the attacker to interact with a system that has no production value, and every action taken against it is observable and safe to study. That yields the tooling, commands and objectives behind the scanning activity, which is the depth of information needed to prioritise mitigations.

Why the other options are wrong:

• B. Canary tokens signal that something was touched but capture almost nothing about how.
• C. Industry reports describe threats to others rather than the activity aimed at this company.
• D. A web application firewall logs attacks against web applications only, and blocks them rather than letting them develop.

Correct answer: A

The Pyramid of Pain expresses how much it hurts an adversary when a defender detects and blocks a given kind of indicator. Its point is that the higher indicators - behaviours and methods - are costly and disruptive for the attacker to change, so defending against those imposes real friction rather than a moment's inconvenience.

Why the other options are wrong:

• B. It does not measure damage or dwell time.
• C. It makes no comparison between intelligence sources or their cost.
• D. Categorising activity as spoofing or tampering describes STRIDE, a different model.

Correct answer: D

An inaccurate notification is a detection producing results that do not reflect reality, and alert tuning is the practice of adjusting that detection's logic and thresholds so it stops doing so. It fixes the rule rather than repeatedly handling its output.

Why the other options are wrong:

• A. Data enrichment adds context to an alert; an enriched inaccurate alert is still inaccurate.
• B. Dashboard creation changes how results are displayed.
• C. Threat hunting proactively searches for undetected activity and does not correct a faulty rule.

Correct answer: D

Closed-source intelligence is produced and sold by a vendor to paying subscribers rather than published openly. The defining characteristics are the commercial relationship and the restricted distribution, both of which apply to a paid, industry-specific feed.

Why the other options are wrong:

• A. Open-source intelligence is drawn from publicly available material at no cost.
• B. Threat mapping relates threats to assets or techniques and is an activity, not a feed type.
• C. Threat modelling is a design-time analysis method.

Correct answer: A

A usage policy is what allows an organisation to adopt AI deliberately rather than by accident. It defines which tools are permitted, what data may be entered into them and what outputs may be relied on, which is how the business gets the benefit while keeping data and objectives protected.

Why the other options are wrong:

• B. Prompt engineering improves the quality of results and provides no protection.
• C. A non-disclosure agreement binds a party contractually but does not govern day-to- day use of a tool.
• D. An incident response policy applies once something has gone wrong.

Correct answer: D

Tactics, techniques and procedures describe how an adversary operates rather than what artefacts they happened to leave behind. Hashes and IP addresses change the moment an attacker rebuilds their infrastructure, but the strategy and behaviour behind an intrusion is costly to change and tends to persist across campaigns. Defending against behaviour therefore keeps working after the indicators have rotated.

Why the other options are wrong:

• A. Hash values and IP addresses are the most disposable indicators an attacker has; they are trivially changed.
• B. Indicators of compromise are the artefacts left by an attack, not the behaviour that produced it.
• C. Tooling can be swapped for an equivalent utility without changing how the adversary operates.

Correct answer: B

A growing backlog against fixed service levels is a throughput problem in how alerts are assessed and prioritised. Improving triage is what increases the rate at which alerts are correctly dispositioned, so it addresses the cause rather than moving the queue elsewhere.

Why the other options are wrong:

• A. Automating escalation moves alerts up the chain faster without reducing the volume needing judgement.
• C. Better threat intelligence improves detection quality over time but does not clear a backlog.
• D. Customer service response addresses perception rather than the work itself.

Correct answer: B

The display filter selects frames Wireshark's dissectors have identified as HTTP together with all UDP traffic. HTTP is web traffic in the clear, and DNS runs over UDP, so the output is unencrypted web requests alongside DNS. Encrypted web traffic is HTTPS over TCP and matches neither term.

Why the other options are wrong:

• A. Encrypted web requests are dissected as TLS, not HTTP, so the filter excludes them.
• C. The filter matches a great deal of traffic; it does not exclude everything.
• D. Encrypted web traffic is not matched, so the result cannot include both.

Correct answer: A

Legacy systems are the reason segmentation has to be heavy rather than nominal. They frequently cannot be patched, cannot run modern endpoint controls and cannot be replaced without breaking a business process, so the only control left is to restrict what can reach them. Segmentation compensates for protections the asset itself cannot carry.

Why the other options are wrong:

• B. Degraded functionality is a consequence of segmenting, not a reason to do it.
• C. Asset obfuscation hides an asset's identity and is a side effect rather than the driver.
• D. A proprietary server describes what the asset is, not why it needs isolating.

Correct answer: A

CyberChef is built for exactly this: transforming and extracting data from unstructured text through chained operations, including a recipe that pulls IPv4 addresses out of arbitrary content. The document is text rather than captured traffic, so a parsing and extraction tool is the right instrument.

Why the other options are wrong:

• B. Wireshark analyses packet captures and cannot process a text document.
• C. Zeek generates logs from live or captured network traffic, not from prose.
• D. OpenCTI stores and relates threat intelligence once it is structured; it is not an extraction tool.

Correct answer: A

Correlating events across many systems depends on their timestamps meaning the same thing. Without synchronised clocks, records from different hosts cannot be reliably ordered and an investigation can reach the wrong conclusion about cause and sequence, so NTP is the foundation that makes correlation accurate.

Why the other options are wrong:

• B. Zero Trust Network Access governs how access is granted.
• C. Account federation unifies identity across systems, not time.
• D. Secure access service edge delivers network security from the cloud.
• E. APIs move data between tools but do not make its timestamps comparable.

Correct answer: C

Operational technology runs on real-time and often decades-old platforms that cannot host an agent, cannot tolerate a scan and cannot be taken offline to patch. Because the standard controls simply will not run there, the organisation applies compensating controls - segmentation, monitoring, strict access - that achieve the security objective by another route.

Why the other options are wrong:

• A. Bandwidth consumption is a performance consideration, not the reason a control cannot be applied.
• B. Scheduled outage windows make maintenance easier, which argues against needing compensation.
• D. Lack of encryption is one specific gap rather than the general incompatibility that drives the approach.

Correct answer: A

The Pyramid of Pain ranks indicators by how much it costs an adversary to change them. Tactics, techniques and procedures sit at the apex because they reflect how the group actually operates; altering them means retraining people and redesigning operations, which is far harder than reissuing an address or recompiling a tool.

Why the other options are wrong:

• B. Tools sit below TTPs; an equivalent utility can be substituted with moderate effort.
• C. Domain names are cheap to register and rotate.
• D. IP addresses are the easiest of all to change and sit at the base of the pyramid.

Correct answer: C

With no patch available the vulnerability cannot be closed, so the practical objective becomes knowing immediately if it is exploited. Continuous monitoring against the published indicators gives that early warning and buys time until the vendor releases a fix, which is why it is the interim measure.

Why the other options are wrong:

• A. Sinkholing redirects traffic destined for known malicious infrastructure and does not address the vulnerable system.
• B. Eradication removes an attacker who is already present; nothing indicates a compromise yet.
• D. Evidence acquisition is a forensic activity performed after an incident is confirmed.

Correct answer: C

Zero Trust removes any notion of implicit trust based on location or prior authentication. Every request to the production environment is authenticated and authorised afresh against current context, which is exactly the continuous validation and verification the CISO is describing.

Why the other options are wrong:

• A. Secure access service edge converges networking and security delivery at the edge; it is a delivery model rather than the trust principle.
• B. A next-generation firewall inspects traffic at a boundary and does not continuously re- verify a session's authorisation.
• D. Privileged access management governs elevated accounts specifically, a narrower scope than all access to production.