CompTIA CS0-004 Practice Test 2026

A security analyst responds to an alert regarding identity and access management activity within the cloud environment. The attacker is currently trying to gain access from one isolated cloud subscription to another via a compromised user role. Which of the following aspects of the MITRE ATT & CK framework is the attacker trying to perform?

A. Privilege escalation

B. Lateral movement

C. Persistence

D. Execution

E. Credential access

A binary file that might contain malicious code is hosted on an isolated machine. An analyst wants to quickly detect the malicious code. Which of the following should the analyst use?

A. strings

B. VirusTotal

C. WHOIS

D. Yet Another Recursive Acronym (YARA)

Multiple users report unexpected mouse movements and terminal windows opening.
An analyst reviewing the network traffic logs observes the following:

Which of the following is the most likely reason for the reported symptoms?

A. Activity is on an internally addressable network.

B. A reverse tunnel is being used to send commands.

C. Remote Desktop Protocol (RDP) is being used to remotely control the impacted computers.

D. Virtual Network Computing is being used to connect to systems.

Which of the following is the most difficult for threat actors to change according to the Pyramid of Pain model?

A. Tactics, techniques, and procedures

B. Tools

C. Domain names

D. Internet Protocol addresses

An analyst reviews the following log entries:

Which of the following conclusions should the analyst reach? (Choose two.)

A. Host ws-57 is performing a network scan against dc-1.

B. Domain Controller dc-1 is performing a network scan against ws-57.

C. Host ws-57 delivered a phishing email via Simple Mail Transfer Protocol.

D. Host ws-57 is communicating on a service using a non-standard port.

E. Domain Controller dc-1 is infected with ransomware and initiating connections with ws-57.

F. Domain Controller dc-1 is communicating using a non-standard port.

A security analyst uses a full pcap solution to extract all traffic from the last two days associated with the 10.213.4.27 file server.
This file server is under investigation due to concerns about potential data exfiltration using Domain Name System (DNS) traffic.
Which of the following commands should the analyst use to extract any potentially leaked data from the suspicious.pcap file?

A. strings suspicious.pcap | grep 10.213.4.27

B. zeek -r suspicious.pcap; grep 10.213.4.27 file.log

C. snort -r suspicious.pcap; grep eve.log 10.213.4.27

D. tcpdump -r suspicious.pcap port 53 and host 10.213.4.27

Which of the following best explains why sensitive data should be encrypted at rest on laptops?

A. To prevent end users from copying data to other systems

B. To protect disclosure of information if physical devices are stolen

C. To comply with regulatory and legal requirements

D. To ensure the integrity of the data on the company network

A security analyst must identify documents that contain encoded ActiveMime payloads in a directory containing thousands of files. The analyst runs the following command: grep -rail ActiveMime *
The command returns no output.
Which of the following Yet Another Recursive Acronym (YARA) rules should the analyst use to find the suspicious files?

A. Option A

B. Option B

C. Option C

D. Option D

Which of the following network architectures would best implement a perimeter-less network topology?

A. Hybrid cloud networks

B. Secure access service edge

C. Cloud-native computing

D. Content delivery networks

A security architect works with a client on security operations center (SOC) capabilities. The security architect wants to ensure the log correlation and investigation activities are accurate across the infrastructure. Which of the following is the best for the client to implement?

A. Network Time Protocol (NTP)

B. Zero Trust Network Access (ZTNA)

C. Account federation

D. Secure access service edge (SASE)

E. Application programming interfaces (APIs)