Free CompTIA CS0-004 Practice Questions 2026 - Page 2

✅ Explanation:

The analyst must prioritize users based on risk indicators from the web application access logs. The company is based in the United States, so any successful login from a Russian (RU) IP address is highly suspicious and warrants immediate investigation. Additionally, multiple failed authentication attempts followed by a successful login from a foreign country are strong indicators of a brute-force or credential-stuffing attack where the attacker eventually gained access.

A. jschott – This user exhibits the most concerning pattern. Between 09:03:00 and 09:19:00, jschott has six failed login attempts, all originating from Russian IP addresses (185.23.154.24, 185.23.154.22, 185.23.154.54, 185.23.127.21). Then at 09:23:00, jschott successfully logs in from a US IP address (63.102.4.78). This suggests that an attacker likely brute-forced jschott's credentials from Russia and then successfully authenticated, possibly from a compromised US-based system or VPN. This is a clear account compromise indicator and should be investigated first.

❌ Why Other Options Are Incorrect:

B. dmann
– dmann has a single failed login attempt from a Russian IP (185.23.127.21) at 09:23:00. However, there is no successful login for this user in the logs. A single failed attempt is suspicious but does not indicate confirmed compromise. Without a success event, this is lower priority than jschott, who successfully logged in after multiple failures.

C. mschultz
– The log shows mschottz and mschritz, but no user mschultz appears in the log. This option is likely a distractor with a misspelled name (possibly meant to be mschottz). Even if interpreted as mschottz, that user only shows successful logins from US IP addresses with no failed attempts, which is not suspicious.

D. tlindy
– The log shows tildy, not tlindy (another misspelled distractor). tildy has a failed attempt from a US IP followed immediately by a success from the same IP—this is a normal password typo correction, not suspicious. However, tildy also has a success from a Russian IP at 09:18:00. While this is suspicious, tildy has no failed attempts from Russia, meaning the login could be legitimate travel or VPN use. Compared to jschott, who shows a clear brute-force pattern followed by a success, jschott presents a stronger case for compromise and should be investigated first.

📚 References:

CompTIA CySA+ CS0-004 Exam Objectives – Domain 1.0 (Security Operations) – Given a scenario, analyze log data to identify security incidents, including brute-force attacks, account compromise, and anomalous geographic access patterns.

Explanation:

The analyst is using an AI platform to correlate security events, but the AI output contains events that did not actually happen, resulting in inaccurate correlations. This is a known limitation of generative AI and large language models (LLMs), where a model can generate plausible-sounding but fabricated or factually incorrect information that is not supported by the available data. This can mislead analysts and interfere with accurate security monitoring and incident investigation.

A. Hallucinations
– An AI hallucination occurs when a model generates information that appears plausible but is incorrect, fabricated, or unsupported by the provided data. In this scenario, the AI generated security events that never occurred, causing inaccurate event correlations. This directly matches the definition of an AI hallucination. Therefore, Option A is correct.

Why Other Options Are Incorrect:

B. Data exposure – Data exposure involves the unauthorized disclosure of sensitive information, such as personal, confidential, or proprietary data. Although data exposure is an important AI security concern, it does not describe the creation of events that never occurred. The issue in this scenario is inaccurate or fabricated output rather than disclosure of actual sensitive information.

C. Malicious prompts – Malicious prompts, including prompt injection, involve deliberately crafted input designed to manipulate an AI system into producing unintended results or bypassing controls. The scenario does not indicate that an attacker manipulated the AI through a malicious prompt. Instead, the AI generated false information during its normal operation.

D. Model poisoning – Model poisoning occurs when an attacker intentionally compromises training data or a model to influence its behavior or outputs. This is an attack against the model's integrity. The scenario provides no evidence that the model was deliberately poisoned. The generation of unsupported or fabricated information is more accurately described as hallucination.

References:
CompTIA CySA+ CS0-004 Exam Objectives – Covers the risks and limitations associated with using artificial intelligence and machine learning in security operations.

Explanation:

The analyst executes the top command on a Linux system and observes an unresponsive application. The output shows PID 7583 with the command name python , owned by the root user, consuming 91.2% of the CPU . This is extremely high CPU utilization for a single process. Other processes are using only small percentages of CPU, indicating that the Python process is consuming most of the available processing capacity and is likely contributing to the system's unresponsive behavior.

C. Resource exhaustion
– This is the most likely cause. The Python process is consuming more than 91% of the CPU , which is a strong indication of CPU resource exhaustion. When a process consumes most available CPU cycles, the operating system may have insufficient processing capacity for normal application and user requests. Resource exhaustion can result from a runaway process, infinite loop, software defect, misconfiguration, or potentially malicious activity such as cryptomining. Therefore, Option C is correct.

Why Other Options Are Incorrect:

A. Service disruption
– Service disruption describes the resulting impact, such as an application becoming unavailable or unresponsive, but it does not identify the technical cause. The available evidence specifically points to excessive CPU consumption as the immediate problem. Therefore, resource exhaustion provides a more precise explanation of the observed condition.

B. Unauthorized software
– The Python process could potentially be malicious or unauthorized, but the top output alone does not provide enough evidence to establish this. The process could also be a legitimate application, script, or poorly configured program. Additional evidence, such as process relationships, file information, hashes, or network connections, would be required to determine whether the software is unauthorized.

D. Filesystem changes
– The top output does not provide evidence of file creation, deletion, modification, or excessive disk activity. Filesystem-related issues would require supporting information such as file integrity alerts, disk I/O statistics, or filesystem activity. The available evidence instead clearly identifies unusually high CPU utilization.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers analyzing system performance data and identifying resource exhaustion and other indicators of suspicious or abnormal system activity.

Explanation:

The Pyramid of Pain is a threat intelligence model developed by David Bianco that ranks indicators of compromise (IoCs) based on the level of difficulty they create for an adversary when defenders detect and block them. The pyramid progresses from easier-to-change indicators, such as hashes and IP addresses, toward more difficult elements, such as tools and tactics, techniques, and procedures (TTPs). Its main purpose is to help defenders prioritize detections that are more difficult for attackers to change, increasing the operational cost of adapting to defensive actions.

A. To show that changing to different types of indicators and behaviors is difficult for an adversary
– This is the correct answer. The Pyramid of Pain demonstrates that different indicators create different levels of difficulty for attackers when they are detected and blocked. Lower-level indicators, such as hashes and IP addresses, can often be changed relatively easily. Higher-level indicators, especially TTPs, are much harder to change because doing so may require significant changes to attack methods, tools, and operational procedures. Therefore, Option A is correct.

Why Other Options Are Incorrect:

B. To measure how much operational damage a threat actor can cause before detection occurs
– The Pyramid of Pain does not measure the amount of damage an attacker causes or how long an attacker remains undetected. Instead, it describes how difficult different indicators and behaviors are for adversaries to change after defenders detect them. Metrics such as time to detect and incident impact are used for measuring other security outcomes.

C. To compare open-source intelligence (OSINT) with closed-source intelligence based on collection cost
– The Pyramid of Pain is not an intelligence-source classification model. It focuses on different types of indicators and the difficulty attackers face when changing them. Comparing OSINT with proprietary or closed intelligence involves different intelligence collection and analysis considerations.

D. To organize attack activity into categories such as spoofing, tampering, and repudiation – This describes the STRIDE threat modeling framework, which categorizes threats such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. The Pyramid of Pain instead focuses on IoCs and the difficulty attackers face when changing their indicators or behaviors.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers threat intelligence concepts and frameworks used to support defensive security operations.

Explanation:

The system logs show a sequence of commands executed by user Berry, followed by a switch to user Larry. The critical commands are sudo su (attempting to switch to root) and su Larry (switching to another user). After becoming Larry, the attacker executes sudo nano—attempting to run the nano text editor with root privileges via sudo. Additionally, the presence of ./linpeas.sh is highly significant: LinPEAS is a well-known Linux privilege escalation enumeration script used by attackers to identify misconfigurations, vulnerable services, weak permissions, and other vectors to elevate privileges from a standard user to root.

C. Privilege escalation – The attacker is actively attempting to move from a lower-privileged user (Berry) to a higher-privileged user (Larry) and then further elevate to root via sudo. The use of LinPEAS is a classic reconnaissance technique specifically designed to discover privilege escalation paths. The entire sequence of commands—sudo su, su Larry, sudo nano, and running linpeas.sh—points directly to a privilege escalation attempt..

Why Other Options Are Incorrect:

A. Exfiltration
– Exfiltration involves transferring data from a compromised system to an external or attacker-controlled destination. Typical indicators include file transfers, outbound network connections, DNS tunneling, or data compression before transmission. The commands shown do not provide evidence of data being transferred out of the system.

B. Remote code execution
– Remote code execution involves executing commands or code on a system remotely, usually by exploiting a vulnerable service or application. The commands in the logs are being executed locally after shell access has already been obtained. There is no evidence in the provided sequence of a network-based exploitation technique.

D. Spoofing
– Spoofing involves impersonating another user, system, device, or address to deceive a security control or gain unauthorized access. The commands su Larry and sudo indicate attempts to change or elevate privileges, not the forging of network or system identities. There is no evidence of IP, MAC, or identity spoofing in the logs.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers analyzing system logs and identifying attacker techniques, including privilege escalation.

Explanation:

Tactics, Techniques, and Procedures (TTPs) represent the highest level of threat intelligence in the Pyramid of Pain. TTPs describe how an adversary operates—their strategic goals (tactics), the specific methods they use to achieve those goals (techniques), and the detailed step-by-step implementation (procedures). Unlike low-level indicators such as hash values, IP addresses, or domain names, TTPs are behavioral and contextual. They are the most difficult for attackers to change because altering TTPs requires retraining personnel, redesigning campaigns, and investing significant resources. Understanding TTPs enables defenders to build robust, behavior-based detections, anticipate adversary actions, and implement proactive defenses that remain effective even as attackers change their infrastructure.

D. TTP provides useful insights on the strategy and behavior of an attacker – This is the most accurate answer. TTPs provide defenders with valuable information about an advThis is the most important reason TTPs are beneficial. TTPs give defenders a deep understanding of the adversary's mindset, objectives, and operational patterns. This allows security teams to move beyond reactive indicator-blocking to proactive threat hunting, informed risk assessment, and strategic defense planning. By knowing how attackers operate, defenders can implement controls that disrupt the entire attack chain rather than just blocking specific IoCs..

Why Other Options Are Incorrect:

A. TTP provides useful insights on the hash values and internet protocol addresses attributed to an attacker
– Hash values and IP addresses are lower-level indicators in the Pyramid of Pain. They can provide useful evidence of malicious activity, but they are generally easier for attackers to change. TTPs focus on the adversary's behavior and methods rather than specific, replaceable infrastructure indicators.

B. TTP provides useful insights on an attacker's indicators of compromise
– Indicators of compromise include artifacts such as file hashes, IP addresses, domains, and other evidence associated with malicious activity. TTPs can help defenders understand why and how those indicators are used, but TTPs themselves describe attacker behavior and operational methods rather than individual IoCs.

C. TTP provides useful insights on the tools used by an attacker
– Tools are an important level within the Pyramid of Pain, and TTPs can provide context about how those tools are used. However, TTPs cover a broader area, including the attacker's objectives, techniques, and procedures. Focusing only on tools does not capture the complete behavioral picture provided by TTP analysis.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers threat intelligence concepts and the use of TTPs to understand adversary behavior and support defensive security operations.

Explanation:

As organizations increasingly adopt AI platforms, including large language models, generative AI, and automated decision-making systems, they must balance innovation with security, privacy, and compliance. AI tools can expose sensitive information, produce inaccurate or biased results, or be manipulated through techniques such as prompt injection. To use AI safely while protecting business objectives and sensitive data, organizations need clear governance requirements that define acceptable use, data handling, security controls, and compliance expectations.

A. Usage policies –Usage policies establish the rules, guidelines, and boundaries for how AI tools can be used within an organization. They typically cover data classification (e.g., prohibiting input of PII, IP, or confidential data), acceptable use cases, approval workflows, and oversight mechanisms. By setting clear expectations and controls, usage policies enable organizations to adopt AI safely while mitigating risks such as data leakage, regulatory non-compliance, reputational harm, and inaccurate outputs. This directly protects both business objectives and sensitive data.

Why Other Options Are Incorrect:

B. Prompt engineering
– Prompt engineering involves creating or refining inputs to obtain more useful or accurate responses from an AI model. Although it can improve the quality of AI output, it does not establish organizational governance, define acceptable use, or provide comprehensive data protection requirements. It is a technique for interacting with AI rather than an organizational security policy.

C. Non-disclosure agreement (NDA)
– An NDA is a legal agreement designed to restrict the disclosure of confidential information between parties. It may provide contractual protection when working with an external AI provider, but it does not establish comprehensive internal rules for employee AI usage or enforce technical security controls. Therefore, an NDA alone is insufficient for governing organizational AI use.

D. Incident response policy
– An incident response policy defines how an organization detects, contains, investigates, and recovers from security incidents. It can be important when an AI-related security incident occurs, but it primarily addresses response after an incident. It does not establish the broader rules needed to prevent inappropriate AI use or accidental data exposure during normal operations.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers security policies, governance, emerging technologies, and security considerations associated with artificial intelligence and machine learning.

Explanation:

The SOC is struggling to meet SLAs, and the alert backlog continues to increase daily. This indicates that the current workflow is unable to keep pace with the volume of incoming alerts. The root cause is likely inefficient or inconsistent handling of alerts upon arrival. Without effective triage, analysts waste time on false positives, low-priority events, or unactionable alerts, which compounds the backlog and delays response to genuine threats. The priority must be to streamline how alerts are assessed and prioritized.

B. Improve the triage processes
– Triage is the process of evaluating, categorizing, and prioritizing alerts based on severity, impact, and confidence. Improving triage processes directly addresses the backlog by ensuring that high-priority alerts are handled immediately, while low-priority or false positive alerts are quickly dismissed or investigated at a lower tempo. This reduces the overall volume requiring deep analysis, enables faster SLA adherence, and increases the efficiency of the SOC team.

Why Other Options Are Incorrect:

A. Automate escalation
– While automation can improve efficiency, escalating alerts faster without improving triage will only push more alerts to higher-tier analysts or incident responders, potentially overwhelming them. Automation should be applied after triage processes are defined and optimized, not as a standalone fix for a triage problem.

C. Upgrade threat intelligence
– Threat intelligence improves detection accuracy and context, but it does not directly reduce alert volume or backlog. Even with better intelligence, alerts still need to be triaged and prioritized. This is a longer-term improvement, not the immediate solution to a growing backlog.

D. Enhance the customer service response
– Customer service response refers to communication with business stakeholders or external parties. While important, it does not address the operational issue of increasing alerts and missed SLAs. Improving customer response does not reduce alert volume or improve the efficiency of internal SOC workflows.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Domain 4.0, Security Operations and Response, covers security operations, incident response, and optimizing SOC processes to improve operational effectiveness and response performance.

Explanation:

The manager is concerned that after-action reporting is not being completed in a timely manner. After-action reports are an important part of the incident response lifecycle because they document what happened, how the incident was handled, what was learned, and what improvements are needed. This activity occurs during the post-incident and lessons-learned phase. The metric that best measures the time required to fully close an incident, including documentation and follow-up activities, is Mean Time to Close (MTTC)

B. Mean time to close
– MTTC measures the total time from when an incident is opened or detected until it is fully resolved and closed. Depending on the organization's definition, this can include investigation, containment, eradication, recovery, documentation, and post-incident reporting. If after-action reports are consistently delayed, MTTC can increase, helping the manager identify bottlenecks in the incident closure process.

Why Other Options Are Incorrect:

A. Mean time to remediate
– Mean Time to Remediate measures how long it takes to correct or resolve a security issue. It focuses primarily on remediation activities rather than the complete administrative closeout of an incident. Therefore, it is less appropriate for measuring delays in after-action reporting.

C. Mean time between failures
– MTBF is a reliability metric that measures the average time between system failures. It is commonly used in system engineering and IT operations to evaluate system reliability. It does not measure incident response performance or the timeliness of after-action documentation.

D. Mean time to respond
– Mean Time to Respond measures how quickly a team begins responding after an incident is detected or reported. It focuses on the initial response stage rather than the time required to complete investigation, documentation, and final incident closure.


References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers incident response activities, security operations, and metrics used to evaluate incident handling and response performance.

Explanation:

When a notification or alert is inaccurate, it generally indicates a false positive, meaning the security tool generated an alert that does not represent a genuine security threat. False positives consume analyst time, contribute to alert fatigue, and can make legitimate threats harder to identify. The appropriate response is to review and adjust the detection logic, threshold, rule, or baseline that generated the alert. This process improves alert accuracy and allows analysts to focus on events that require investigation.

D. Alert tuning
– Alert tuning is the process of refining security monitoring rules, signatures, thresholds, and baselines to reduce false positives and false negatives. When a notification is inaccurate, the analyst should review the detection condition that triggered it and adjust the relevant parameters. Examples include modifying a Suricata rule, refining a SIEM query, or adjusting a UEBA baseline. Proper tuning reduces unnecessary alerts while maintaining detection of genuine security threats.

Why Other Options Are Incorrect:

A. Data enrichment
– Data enrichment adds additional context to an alert, such as threat intelligence, asset criticality, or user information. This context can help analysts determine whether an alert is malicious, but it does not correct the underlying detection rule that produced an inaccurate notification. Enrichment supports investigation rather than directly reducing false positives.

B. Dashboard creation
– Dashboards provide visual representations of security events, metrics, trends, and alerts. They can help analysts monitor security activity, but they do not modify the detection logic that generates inaccurate notifications. Therefore, creating a dashboard does not directly address the false-positive problem.

C. Threat hunting
– Threat hunting is a proactive security activity in which analysts search for threats that may have bypassed existing security controls. Although threat hunting can identify previously undetected malicious activity, it does not correct an inaccurate alert. The issue in this scenario requires modification of the detection mechanism, making alert tuning the better choice.

References:

CompTIA CySA+ CS0-004 Exam Objectives – Covers security operations, alert analysis, and techniques for improving detection effectiveness and reducing false positives.