CompTIA CS0-004 Practice Test 2026

Explanation:

To determine what the attacker is trying to perform, the activity should be mapped to the appropriate MITRE ATT&CK tactic. The attacker has already compromised a user role within one isolated cloud subscription and is attempting to gain access from that subscription to another isolated cloud subscription. This activity focuses on expanding access across environments rather than gaining higher privile
ges, maintaining access, executing code, or stealing credentials.

B. Lateral movement
– Lateral movement (TA0008) includes techniques adversaries use to move from one compromised system, environment, or network segment to another. By using a compromised user role to move between isolated cloud subscriptions, the attacker is attempting to reach additional resources or targets. Therefore, Option B is correct

Why Other Options Are Incorrect:

A. Privilege escalation
– Privilege escalation (TA0004) involves obtaining higher-level permissions than those already available. The scenario describes movement between cloud subscriptions rather than increasing the privileges of the compromised account.

C. Persistence
– Persistence (TA0003) involves techniques that allow an attacker to maintain access over time, such as creating accounts or modifying authentication mechanisms. The described activity is focused on moving to another environment, not maintaining access.

D. Execution
– Execution (TA0002) involves running malicious commands, scripts, or programs. The scenario concerns access between cloud subscriptions rather than the execution of code.

E. Credential access
– Credential access (TA0006) focuses on obtaining passwords, tokens, keys, or other authentication material. Although the attacker is using a compromised identity, the activity described is movement between environments rather than credential theft.

References:

MITRE ATT&CK – Lateral Movement (TA0008) – Describes the adversary behaviors associated with moving through or between environments to reach additional resources.

CompTIA CySA+ CS0-004 Exam Objectives – Covers analyzing attack activity, identifying attack vectors, and applying security frameworks such as MITRE ATT&CK.

Explanation:

The analyst is dealing with a binary file on an isolated machine that may contain malicious code. The important factor is that the machine has limited or no network connectivity. The analyst therefore needs a tool that can quickly analyze the file locally without depending on an internet-based service or external lookup.

D. Yet Another Recursive Acronym (YARA)
– YARA is a pattern-matching tool widely used for identifying and classifying malware. Analysts can create YARA rules containing strings, hexadecimal patterns, and other characteristics associated with known malware. YARA can scan files directly on a local machine, making it suitable for an isolated environment. Therefore, Option D is correct.

Why Other Options Are Incorrect:

A. strings
– Thestrings utility extracts readable text from binary files. It can reveal useful indicators such as URLs, IP addresses, file paths, or suspicious messages, but it does not automatically determine whether a file is malicious. The analyst would need to manually interpret the extracted information.

B. VirusTotal
– VirusTotal is an online service that provides file and threat intelligence analysis. Because it relies on network access for submitting files or querying results, it is not appropriate for directly analyzing a file on an isolated machine with no internet connectivity.


C. WHOIS
– WHOIS provides registration and ownership information for domains and IP-related resources. It can support threat intelligence investigations, but it does not analyze binary files or detect malicious code within them.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers analyzing indicators of compromise and using appropriate security tools for malware analysis.

YARA Documentation – Describes YARA as a tool for identifying and classifying malware through pattern-based rules.

Explanation:

The users are reporting unexpected mouse movements and terminal windows opening which are common signs of interactive remote-control activity. The analyst should examine the network traffic logs to determine which remote-access protocol is responsible for the behavior.

D. Virtual Network Computing is being used to connect to systems.
– VNC provides graphical remote desktop access and commonly uses TCP port 5900 The logs show multiple connections from 192.168.12.11 to other internal systems using port 5900, indicating that VNC sessions are being established. This makes VNC the most likely explanation for the reported interactive mouse and desktop activity. Therefore, Option D is correct.

Why Other Options Are Incorrect:

A. Activity is on an internally addressable network.
– The addresses shown are private RFC 1918 addresses, so the traffic is internal. However, this only describes the network addressing and does not explain the unexpected mouse movements or terminal windows.

B. A reverse tunnel is being used to send commands.
– A reverse tunnel generally allows an internal system to establish an outbound connection that can provide remote access or bypass network restrictions. The provided traffic shows internal-to-internal connections and does not provide sufficient evidence of a reverse tunnel.

C. Remote Desktop Protocol (RDP) is being used to remotely control the impacted computers.
– RDP commonl port 5900 are more consistent with VNC activity and better explain the reported interactive desktop behavior.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers analysis of network traffic, security events, and common network protocols and ports.

CompTIA CySA+ CS0-004 Exam Objectives – Covers identifying and analyzing remote-access technologies and their associated security implications.

Explanation:

The Pyramid of Pain is a threat intelligence model developed by David Bianco. It illustrates how different types of indicators affect an adversary when defenders identify and block them. The pyramid contains six levels, progressing from indicators that are easiest for attackers to change to those that are most difficult to change:

Hash values – Trivial
IP addresses – Easy
Domain names – Simple
Network and host artifacts – Annoying
Tools – Challenging
Tactics, techniques, and procedures (TTPs) – Hardest

A. Tactics, techniques, and procedures
– TTPs are at the top of the Pyramid of Pain and are the most difficult indicators for adversaries to change. They describe how attackers operate, including their methods, behaviors, and procedures. Changing established TTPs can require significant changes to an attacker's skills, tools, infrastructure, and operational methods. Therefore, Option A is correct.

Why Other Options Are Incorrect:

B. Tools
– Tools are below TTPs in the Pyramid of Pain. Replacing or modifying tools can require effort, but attackers can often obtain alternative tools or develop replacements. Therefore, tools are less difficult to change than TTPs.

C. Domain names
– Domain names are relatively easy for attackers to replace. An adversary can register or configure another domain when an existing domain is identified and blocked. Therefore, domain names create less pain than tools or TTPs.

D. Internet Protocol addresses – IP addresses are near the bottom of the pyramid and are relatively easy to change. Attackers can move infrastructure, use different hosting providers, or change network addresses. Blocking an IP address therefore generally causes limited disruption to an attacker.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers threat intelligence concepts and the use of frameworks for analyzing and prioritizing indicators.

David Bianco – Pyramid of Pain – Defines the relationship between indicators and the level of difficulty attackers face when changing them.

Explanation:

The analyst must examine the network logs for patterns, anomalies, and protocol usage. The entries show ws-57 (192.168.1.57)connecting todc-1 (192.168.1.2) on multiple ports, including 22, 23, 80, 139, 443, and 445, within only a few seconds. Rapidly probing several ports on a single host is a strong indicator ofnetwork scanning or service enumeration.

A. Host ws-57 is performing a network scan against dc-1. – The logs show ws-57 connecting to dc-1 across six different destination ports in a very short period. This pattern is characteristic of a port scan because the source system is testing multiple services on the target to determine which ports are accessible. Therefore, Option A is correct.

F. Domain Controller dc-1 is communicating using a non-standard port. – The log entry involving port 3389 is associated with RDP, while the source port is a high-numbered ephemeral port. The hostname and IP information appear inconsistent because the source IP belongs to ws-57 while the hostname is listed as dc-1. This anomaly can indicate incorrect host identification or configuration and should be investigated further.

Why Other Options Are Incorrect:

B. Domain Controller dc-1 is performing a network scan against ws-57. – The traffic pattern shows ws-57 as the source communicating with dc-1 as the destination. There is no corresponding evidence that dc-1 is scanning ws-57 across multiple ports. Therefore, the direction of activity does not support this conclusion.

C. Host ws-57 delivered a phishing email via Simple Mail Transfer Protocol. – Port 25 is associated with SMTP, but a connection to an SMTP service does not prove that a phishing email was delivered. The logs do not provide information about message contents, recipients, spoofing, or social-engineering activity.

D. Host ws-57 is communicating on a service using a non-standard port. – The listed destination ports correspond to commonly used services, including SSH, Telnet, HTTP, HTTPS, SMB-related services, DNS, and SMTP. High-numbered source ports are commonly used as ephemeral client ports and do not by themselves indicate non-standard service communication.

E. Domain Controller dc-1 is infected with ransomware and initiating connections with ws-57. – The logs do not provide evidence of ransomware activity such as file encryption, ransom notes, or ransomware-related command-and-control communication. The available evidence is insufficient to make this conclusion.

References:
CompTIA CySA+ CS0-004 Exam Objectives – Covers analyzing network traffic and identifying suspicious activity such as port scanning, service enumeration, and anomalous communication patterns.

Explanation:

The analyst needs to extract DNS traffic from a pcap file specifically associated with the file server at 10.213.4.27 to investigate potential data exfiltration. DNS exfiltration works by encoding stolen data into DNS queries or responses sent to an attacker-controlled DNS server. The correct command must read the pcap file (-r suspicious.pcap) and filter exclusively for DNS traffic on port 53 to and from the suspect IP.

D. tcpdump -r suspicious.pcap port 53 and host 10.213.4.27
– This command correctly reads the existing pcap file and applies a filter that captures all DNS traffic on port 53 where 10.213.4.27 is either the source or destination . This isolates the exact packets needed to analyze DNS queries and responses for encoded exfiltration data, allowing the analyst to inspect the traffic for signs of data leakage.

Why Other Options Are Incorrect:

A. strings suspicious.pcap | grep 10.213.4.27
–strings extracts human-readable text from binary files but does not understand pcap structure or packet boundaries. Piping the output to grep only searches for visible occurrences of the IP address. It does not filter DNS traffic or reliably identify encoded DNS payloads, making it unsuitable for this investigation.

B. zeek -r suspicious.pcap; grep 10.213.4.27 file.log
– Zeek can analyze pcap files and generate logs, but this command does not correctly identify a standard Zeek log for the required DNS analysis. Zeek commonly produces files such as dns.log and conn.log . The command also processes all traffic rather than applying a focused DNS and host filter during packet analysis.

C. snort -r suspicious.pcap; grep eve.log 10.213.4.27
– Snort is primarily an IDS/IPS tool and is not designed as a simple packet extraction utility. The command also uses an incorrect grep syntax and would search generated alert data rather than directly filtering the pcap for DNS packets. It therefore does not provide the focused DNS traffic required for the investigation.

References:
CompTIA CySA+ CS0-004 Exam Objectives – Covers the use of appropriate tools and commands to analyze network traffic, including tcpdump, strings, Zeek, and Snort.

Explanation:

Encryption at rest refers to protecting data stored on physical media, such as laptop hard drives, by rendering it unreadable without the correct decryption key. Laptops are portable and susceptible to physical theft, loss, or unauthorized access. When a laptop is stolen, an attacker may attempt to remove the storage drive and access its contents directly. Full-disk encryption, such as BitLocker or FileVault, ensures that even if the storage media is removed and connected to another system, the data remains encrypted and cannot be accessed without the proper credentials or recovery key. This primarily supports the confidentiality pillar of the CIA triad by preventing unauthorized disclosure of sensitive information.

B. To protect disclosure of information if physical devices are stolen – This is the most accurate reason for encrypting data at rest on laptops. It mitigates the risk of physical theft by ensuring that stored data remains inaccessible to anyone who does not possess the required decryption key. Therefore, Option B is correct.

Why Other Options Are Incorrect:

A. To prevent end users from copying data to other systems
– Encryption at rest does not prevent users from copying, emailing, or uploading files. It protects data while it is stored on the device. Controls such as Data Loss Prevention (DLP)are better suited to restricting unauthorized data transfers or copying.

C. To comply with regulatory and legal requirements
– Compliance requirements can be a valid reason for an organization to implement encryption. However, compliance describes a business or legal driver rather than the primary security purpose of encryption at rest. The technical purpose is to protect stored data from unauthorized access or disclosure.

D. To ensure the integrity of the data on the company network
– Data integrity involves preventing or detecting unauthorized modification of information. Encryption at rest primarily provides confidentiality by preventing unauthorized parties from reading stored data. It also protects locally stored information rather than specifically protecting data while it is transmitted across a company network.

References:
CompTIA CySA+ CS0-004 Exam Objectives – Covers data protection controls and the use of encryption to protect sensitive information.

Explanation:

The analyst used grep -rail ActiveMime * to search for the plaintext string "ActiveMime" across all files, but it returned no results. This strongly indicates that the ActiveMime payloads may be encoded or obfuscated rather than stored as plain ASCII text. Attackers commonly use encoding techniques such as Base64 to represent data in a different format. To detect an encoded version of the string, the YARA rule must use a modifier that supports Base64 matching.

C. Option C – This YARA rule includes the base64 modifier after the string $a="ActiveMime" The base64 modifier instructs YARA to search for the Base64-encoded representation of the specified string. This is the appropriate choice because the initial search did not identify the plaintext string, suggesting that the content may be encoded or represented differently.

Why Other Options Are Incorrect:

A. Option A – This rule uses the fullword modifier, which requires the string to appear as a complete word rather than as part of another string. However, it still searches for the plaintext "ActiveMime" and does not address encoded content. Therefore, it does not solve the problem identified by the failed plaintext search.

B. Option B – The nocase modifier makes the search case-insensitive, allowing YARA to match different combinations of uppercase and lowercase letters. However, it still searches for the plaintext string. If capitalization were the only issue, a case-insensitive search would likely identify the string. It does not address Base64 encoding.

D. Option D – The ascii modifier specifies ASCII string matching. It does not decode the content or search for an encoded representation of the string. Since the initial search did not find the plaintext ASCII value, using ascii would not address the suspected encoding issue.

References:
CompTIA CySA+ CS0-004 Exam Objectives – Covers using YARA rules to identify and classify malware or suspicious files, including string modifiers such as base64 nocase , fullword , and ascii

Explanation:

A perimeter-less network topology, also associated with zero-trust and boundary-less architectures, moves away from the traditional model where a firewall creates a hardened outer boundary around trusted internal resources. Instead, security controls are distributed closer to users, devices, applications, and data. This approach assumes that threats can originate from inside or outside the network, so access should not be trusted automatically based only on network location.

B. Secure access service edge (SASE)
– SASE is a cloud-delivered architecture that combines network security, such as Secure Web Gateway, Cloud Access Security Broker, and Firewall-as-a-Service, with WAN connectivity, such as SD-WAN. It applies security policies based on factors such as user identity, device posture, and context instead of relying only on IP addresses or physical network location. This supports a perimeter-less architecture because security controls can follow users and data across branches, home networks, cloud environments, and mobile locations.

Why Other Options Are Incorrect:

A. Hybrid cloud networks
– A hybrid cloud combines on-premises infrastructure with public cloud services. Although this extends resources beyond the traditional data center, it does not automatically eliminate the network perimeter. Organizations may still use VPNs, firewalls, gateways, and other traditional security controls. Therefore, hybrid cloud networking alone does not define a perimeter-less security architecture.

C. Cloud-native computing
– Cloud-native computing focuses on developing and operating applications using technologies such as microservices, containers, and orchestration platforms. Although these environments are distributed, cloud-native computing primarily addresses application development and deployment. It does not itself define a network security architecture based on perimeter-less or zero-trust principles.

D. Content delivery networks (CDNs)
– CDNs use geographically distributed servers to deliver web content closer to users, improving performance, availability, and scalability. Although CDNs can include security features, their primary purpose is content delivery rather than providing a comprehensive identity-based security architecture. Therefore, a CDN does not by itself establish a perimeter-less network topology.

References:

* CompTIA CySA+ CS0-004 Exam Objectives – Covers modern network architectures, security concepts, and technologies relevant to security operations.

Explanation:

The security architect wants to ensure accurate log correlation and investigation activities across the infrastructure. Log correlation combines events from multiple sources, such as firewalls, servers, endpoints, and cloud services, to create a reliable timeline of activity. For this to work correctly, devices must report events using synchronized timestamps . Without synchronized time, events may appear out of order, making it difficult for analysts to understand attack sequences, connect related alerts, or reconstruct an incident accurately.

A. Network Time Protocol (NTP)
– NTP is a standard protocol used to synchronize system clocks across network devices, servers, and endpoints. Implementing NTP ensures that different log sources use a consistent time reference. Accurate time synchronization is essential for effective SIEM correlation, log analysis, incident response, and forensic investigations Therefore, Option A is correct .

Why Other Options Are Incorrect:

B. Zero Trust Network Access (ZTNA)
– ZTNA uses identity, authentication, device posture, and access policies to control access to applications and resources. Although it improves access security, it does not synchronize system clocks or resolve differences between timestamps in logs.

C. Account federation
– Account federation enables identity and authentication services to work across multiple applications or domains. Technologies such as SAML and OAuth can support single sign-on and centralized identity management, but they do not synchronize system clocks or improve timestamp consistency between log sources.

D. Secure access service edge (SASE)
– SASE combines networking and security services, such as SD-WAN, Secure Web Gateway, and Cloud Access Security Broker capabilities, into a cloud-delivered architecture. It improves secure connectivity and access control but does not directly provide time synchronization between infrastructure components.

E. Application programming interfaces (APIs)
– APIs allow applications and systems to exchange information programmatically and can be used to send logs to centralized platforms. However, APIs do not correct differences between system clocks. Time synchronization must be handled separately, commonly through NTP or another reliable time synchronization mechanism.


References:
CompTIA CySA+ CS0-004 Exam Objectives – Covers security operations activities involving log analysis, event correlation, and incident investigation.