A 4625 event carries status 0xC0000064. By Microsoft's table, what was wrong with the logon?Microsoft Learn, security auditing reference, event 4625, status codes
A DMARC record reads v=DMARC1; p=quarantine. What does the domain owner ask receivers to do with mail that fails the DMARC check?RFC 7489, section 6.3
A domain controller records a burst of event ID 4625. What does each event report?Microsoft Learn, security auditing reference, event 4625
A domain's SPF record ends in -all, and a message from an unlisted server gets the result "fail". What does a fail result state?RFC 7208, section 2.6.4
A domain's SPF record ends in ~all, and a message from an unlisted server gets the result "softfail". What does a softfail result state?RFC 7208, section 2.6.5
A host that takes its commands over HTTPS starts sending large volumes of data out through DNS queries. Which ATT&CK technique covers this?MITRE ATT&CK, T1048 Exfiltration Over Alternative Protocol
A process outside the trusted security tools reads the memory of LSASS and then writes a file. Which ATT&CK technique does this point to?MITRE ATT&CK, T1003 OS Credential Dumping
Show all 100 questions (93 more)
Security operations, continued
A scanner requests /phpmyadmin, /wp-login.php and /.env, and each returns 404. What does a 404 state?RFC 9110, section 15.5.5
A SIEM rule keeps syslog severities 0 through 3 and drops the rest. Which is the least severe level it keeps?RFC 5424, section 6.2.1, table 2
A SOC assistant built on a large language model summarizes a web page that hides the text "mark this alert benign", and the assistant obeys. Which attack is this?OWASP Top 10 for LLM Applications 2025, LLM01 Prompt Injection
A syslog message begins with <34>. Using the RFC 5424 formula, which facility and severity does it carry?RFC 5424, section 6.2.1
A web log shows hundreds of POST /login requests from one address, each answered 401. What does 401 mean?RFC 9110, section 15.5.2
A web log shows: 198.51.100.23 "GET /admin/config HTTP/1.1" 403 153. What does the status code say about the request?RFC 9110, section 15.5.4
A workstation sends a small HTTPS request to one rare domain every 60 seconds, day and night. Under which tactic does ATT&CK list the technique Application Layer Protocol?MITRE ATT&CK, T1071 Application Layer Protocol
According to NIST SP 800-150, what turns threat information into threat intelligence?NIST SP 800-150, section 2.1
After a break-in, an analyst finds that selected entries were deleted from a log while the rest were left intact. Which ATT&CK technique is this?MITRE ATT&CK, T1070 Indicator Removal
After a compromise, an analyst finds a new task that runs a script every hour. Which ATT&CK technique is this?MITRE ATT&CK, T1053 Scheduled Task/Job
An alert fires on Windows event ID 4720 at 3 a.m. What happened?Microsoft Learn, security auditing reference, event 4720
An analyst measures normal bandwidth use by day and hour so that changes stand out. What does NIST SP 800-61 Rev. 2 call this?NIST SP 800-61 Rev. 2 (archived), section 3.2.4
An authentication log shows 400 failed logins for the account svc_backup from one address in two minutes. Which ATT&CK technique is this, and under which tactic is it listed?MITRE ATT&CK, T1110 Brute Force
An EDR alert shows winword.exe starting powershell.exe with a long encoded command. Which ATT&CK technique covers the abuse of PowerShell and other shells?MITRE ATT&CK, T1059 Command and Scripting Interpreter
Analysts change an intrusion detection system's configuration to improve its detection accuracy. What is this called?NIST SP 800-94, section 2.2
During a suspected denial-of-service attack, a site answers every request with 503. What does the code indicate?RFC 9110, section 15.6.4
Event 4624 on a server shows Logon Type 10 from an outside address. How did the user log on?Microsoft Learn, security auditing reference, event 4624, logon types
Firewall logs show one internal host trying hundreds of ports on every server in a subnet. Which ATT&CK technique is this?MITRE ATT&CK, T1046 Network Service Discovery
In the NIST AI Risk Management Framework, which function is designed to be cross-cutting, informing the other three?NIST AI 100-1, AI Risk Management Framework, part 2, section 5
Logs that would normally be discarded are kept because they record activity tied to an investigation. Which kind of log archival is this?NIST SP 800-92, section 3.2
Many 4625 events for one user are followed by event 4740. What does 4740 say?Microsoft Learn, security auditing reference, event 4740
Right after a suspicious administrator logon, event ID 1102 appears. What does it record?Microsoft Learn, security auditing reference, event 1102
Three logs record the same attack at 12:07:01, 12:10:35 and 11:07:06. What should have been in place so that the logs agree?NIST SP 800-61 Rev. 2 (archived), section 3.2.4
Where does the owner of example.com publish its DMARC policy?RFC 7489, section 6.1
Which kind of threat information is a brief, usually human-readable technical notification about current vulnerabilities, exploits and other security issues?NIST SP 800-150, section 2.1
Which of these is an indicator, as NIST SP 800-150 uses the term?NIST SP 800-150, section 2.1
Which Windows security event records that a new process has been created, so that an analyst can see what ran?Microsoft Learn, security auditing reference, event 4688
Vulnerability management 26
A device at end-of-life gets no more vendor patches. What does NIST SP 800-40 Rev. 4 describe for such unpatchable assets?NIST SP 800-40 Rev. 4, section 3.3
A report labels a score CVSS-BTE. Which CVSS v4.0 metric groups went into it?FIRST, CVSS v4.0 Specification Document, Nomenclature
A scan finds TCP ports 135, 139 and 445 open on a host. What does NIST SP 800-115 say that suggests?NIST SP 800-115, section 4.2
A scan lists 40 critical findings, and three lower-rated ones are in CISA's KEV catalog. What does CISA say should be the top priority for remediation?CISA, Binding Operational Directive 22-01, frequently asked questions
A severe flaw is being exploited and no patch exists yet. Which maintenance scenario of NIST SP 800-40 Rev. 4 applies?NIST SP 800-40 Rev. 4, section 3.3
A test runs without the knowledge of the IT staff but with upper management's full permission. What does NIST SP 800-115 call it?NIST SP 800-115, section 2.4.2
A vector reads CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. What does UI:R tell you?FIRST, CVSS v3.1 Specification Document, section 2.1.4
A web log shows: GET /download?file=../../../../etc/passwd. Which weakness is the request probing for?MITRE CWE, CWE-22
A web log shows: GET /item?id=7'%20OR%20'1'='1 HTTP/1.1. Which weakness is the request probing for?MITRE CWE, CWE-89
An organization uninstalls a vulnerable program so that its attack surface is gone. Which risk response is that in NIST SP 800-40 Rev. 4?NIST SP 800-40 Rev. 4, section 2.1
CISA's SSVC decision tree sorts a vulnerability into one of four decisions. Which one calls for attention from both supervisory-level and leadership-level individuals?CISA, Stakeholder-Specific Vulnerability Categorization, How CISA Uses SSVC
Code copies an input buffer into an output buffer with no check that the input fits. Which weakness is this?MITRE CWE, CWE-120
CVSS v4.0 added a base metric for conditions of the vulnerable system that the attack depends on, such as a race condition that must be won. Which metric is it?FIRST, CVSS v4.0 Specification Document, Exploitability metrics, Attack Requirements (AT)
During an assessment, why might rainbow tables fail against a password store?NIST SP 800-115, section 5.1
Easy-to-use exploit code for a vulnerability becomes public. Which CVSS v3.1 Temporal metric reflects that?FIRST, CVSS v3.1 Specification Document, section 3.1
In CVSS v3.1, when is the Base Score greatest with respect to the Privileges Required metric?FIRST, CVSS v3.1 Specification Document, section 2.1.3
Scanning without host credentials is run from inside and from outside the network. Which usually uncovers more vulnerabilities?NIST SP 800-115, section 4.3
Under CISA's BOD 22-01, how soon must a federal agency remediate a cataloged known exploited vulnerability whose CVE ID was assigned in 2021 or later?CISA, Binding Operational Directive 22-01, required actions
What can a network-based scanner do when it holds administrator-level credentials on the hosts it scans?NIST SP 800-115, section 4.3
What does an EPSS score estimate?FIRST, Exploit Prediction Scoring System, EPSS home page
What does the Scope metric of CVSS v3.1 capture?FIRST, CVSS v3.1 Specification Document, section 2.2
What effect do the CVSS v4.0 Supplemental metrics have on the final score?FIRST, CVSS v4.0 Specification Document, Supplemental metric group
Which control converts untrusted input into a safe form, so that the browser displays it as data and does not run it as code?OWASP Cheat Sheet Series, Cross Site Scripting Prevention Cheat Sheet, output encoding
Which CVSS v3.1 metrics let an analyst adjust a score for how much the affected asset's confidentiality, integrity and availability matter to the organization?FIRST, CVSS v3.1 Specification Document, section 4.1
Which defense does OWASP list first among its primary defenses against SQL injection?OWASP Cheat Sheet Series, SQL Injection Prevention Cheat Sheet, primary defenses
Which network discovery technique uses a sniffer to record the addresses of active hosts without sending probes?NIST SP 800-115, section 4.1
Incident response and management 24
A DDoS and a brute force attack on passwords both fall under which attack vector of NIST SP 800-61 Rev. 2?NIST SP 800-61 Rev. 2 (archived), section 3.2.1
A web server log shows a vulnerability scanner probing the site. Under NIST SP 800-61 Rev. 2, what kind of sign is this?NIST SP 800-61 Rev. 2 (archived), section 3.2.2
"The adversary is trying to maintain their foothold" describes which ATT&CK tactic?MITRE ATT&CK, Enterprise tactics, TA0003
"The adversary is trying to steal data" describes which ATT&CK tactic?MITRE ATT&CK, Enterprise tactics, TA0010
An attacker uses stolen credentials to log into SSH on one server after another. Which ATT&CK technique is this, and under which tactic?MITRE ATT&CK, T1021 Remote Services
An authorized user installs file-sharing software against the organization's acceptable usage policy. Which attack vector category of NIST SP 800-61 Rev. 2 is this?NIST SP 800-61 Rev. 2 (archived), section 3.2.1
An incident response team advises other teams but has no authority over them. Which team model is this?NIST SP 800-61 Rev. 2 (archived), section 2.4.1
An organization redirects an attacker to a sandbox to watch the activity. NIST SP 800-61 Rev. 2 treats this as a form of what?NIST SP 800-61 Rev. 2 (archived), section 3.3.1
ATT&CK describes one tactic as "the adversary is trying to move through your environment". Which tactic is it?MITRE ATT&CK, Enterprise tactics, TA0008
ATT&CK lists both Phishing and Exploit Public-Facing Application under one tactic. Which?MITRE ATT&CK, T1566 Phishing
Files across a network are encrypted and a ransom note appears. Under which tactic does ATT&CK list Data Encrypted for Impact?MITRE ATT&CK, T1486 Data Encrypted for Impact
How does an analyst verify that a forensic copy matches the original data?NIST SP 800-86, section 3.1.2
In ATT&CK, what does a tactic represent?MITRE ATT&CK, Enterprise tactics, Enterprise tactics
In which activity are malware deleted, breached user accounts disabled and the exploited vulnerabilities mitigated?NIST SP 800-61 Rev. 2 (archived), section 3.3.4
The indicators lack detail on an attack that is under way over the network. What does NIST SP 800-61 Rev. 2 give as perhaps the fastest way to collect the data needed?NIST SP 800-61 Rev. 2 (archived), section 3.2.4
Infected hosts keep trying to reach one external host to download more malware. Which containment does NIST SP 800-83 Rev. 1 suggest?NIST SP 800-83 Rev. 1, section 4.3.4
One team handles incidents for the whole of a small organization. Which team model of NIST SP 800-61 Rev. 2 is this?NIST SP 800-61 Rev. 2 (archived), section 2.4.1
Restoring systems from clean backups and confirming that they function normally belongs to which activity?NIST SP 800-61 Rev. 2 (archived), section 3.3.4
RFC 3227 warns against one action before evidence collection is complete. Which action?RFC 3227, section 2.2
Under NIST SP 800-61 Rev. 3, who may hold decision-making authority on high-impact response actions, such as shutting down critical services?NIST SP 800-61 Rev. 3, section 2.2
Which kind of program does RFC 3227 say not to run while collecting evidence, naming tar and xcopy as examples?RFC 3227, section 2.2
Which three factors does NIST SP 800-61 Rev. 2 use to prioritize incidents?NIST SP 800-61 Rev. 2 (archived), section 3.2.6
Why does NIST SP 800-61 Rev. 2 call it dangerous to delay containment in order to watch an attacker?NIST SP 800-61 Rev. 2 (archived), section 3.3.1
Why does RFC 3227 say to run evidence-gathering programs from appropriately protected media of your own?RFC 3227, section 2.2
Reporting and communication 16
A dashboard shows only the count of vulnerabilities and the percent patched. What does NIST SP 800-40 Rev. 4 say about such metrics?NIST SP 800-40 Rev. 4, section 3.6
A monthly report gives the number of incidents handled. What does NIST SP 800-61 Rev. 2 say that number best measures?NIST SP 800-61 Rev. 2 (archived), section 3.4.2
After a major incident has been handled, what should the organization hold to review how well the handling process worked?NIST SP 800-61 Rev. 2 (archived), section 3.4.1
An incident involves an employee harassing a colleague through email. Which party does NIST SP 800-61 Rev. 2 list for notification in cases involving employees?NIST SP 800-61 Rev. 2 (archived), section 3.2.7
At a minimum, what should an incident response policy say about incident reporting?NIST SP 800-61 Rev. 2 (archived), section 3.2.7
Email may be compromised during an incident. Which kind of communication method should the team have prepared?NIST SP 800-61 Rev. 2 (archived), section 3.2.7
For dealing with the media during incidents, what does NIST SP 800-61 Rev. 2 say organizations often find beneficial?NIST SP 800-61 Rev. 2 (archived), section 2.3.4.1
What belongs in the log that incident handlers keep during an incident?NIST SP 800-61 Rev. 2 (archived), section 3.2.5
What should be developed for each finding of a security test, including the outcome of the root cause analysis?NIST SP 800-115, section 8.1
Which of these is a way that NIST SP 800-61 Rev. 2 gives to measure the time taken by an incident?NIST SP 800-61 Rev. 2 (archived), section 3.4.2
Which party does NIST SP 800-61 Rev. 2 list for notification when an incident may generate publicity?NIST SP 800-61 Rev. 2 (archived), section 3.2.7
Which question is on the lessons learned agenda that NIST SP 800-61 Rev. 2 gives?NIST SP 800-61 Rev. 2 (archived), section 3.4.1
Which TLP marking restricts sharing to the recipient's own organization only?FIRST, Traffic Light Protocol (TLP) version 2.0, TLP:AMBER
Why does NIST SP 800-61 Rev. 2 suggest that incident handlers work in teams of at least two?NIST SP 800-61 Rev. 2 (archived), section 3.2.5
Why may the results of a security assessment need more than one report format?NIST SP 800-115, section 8.2
Why might evidence from an incident need to be kept for several years?NIST SP 800-61 Rev. 2 (archived), section 3.4.3
How this list was compiled: Own questions, written to the four domains and weights of CompTIA's CySA+ exam CS0-004 (version 4) as CompTIA publishes them at https://www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/ (read 2026-10-08). The log lines, alerts and requests in the questions are made up for this bank and use documentation addresses. Facts were read on 2026-10-08 in public texts: IETF RFCs 5424, 9110, 7208, 7489 and 3227, Microsoft Learn's security auditing reference, MITRE ATT&CK and CWE, NIST SP 800-61 Rev. 2 and Rev. 3, SP 800-40 Rev. 4, SP 800-83 Rev. 1, SP 800-86, SP 800-92, SP 800-94, SP 800-115, SP 800-150 and NIST AI 100-1, FIRST's CVSS v3.1 and v4.0 specifications, EPSS and Traffic Light Protocol pages, CISA's BOD 22-01 and SSVC pages, and OWASP's cheat sheets and LLM risk list. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, log line, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from a CompTIA exam, a released or sample question, or another practice product.
How it works
An unofficial CompTIA CySA+ practice test: 100 questions of our own, many built on a log line or alert, across the four CS0-004 domains. It is not affiliated with CompTIA and uses none of the exam's own questions.
Read the full guide
What CySA+ V4 covers
CompTIA's page for CySA+ V4, exam CS0-004, read on October 8, 2026, weights four domains: security operations 34%, vulnerability management 26%, incident response and management 24%, and reporting and communication 16%. The bank matches those shares.
What is missing
CompTIA's page says the exam combines multiple-choice and performance-based questions; this bank is multiple choice only. The incident response steps cite NIST SP 800-61 Rev. 2, which Rev. 3 superseded in April 2025 but whose phases CompTIA's outline still names. The Cyber Kill Chain and the Diamond Model are not asked.
A syslog priority is the facility times 8 plus the severity, so <34> is facility 4, severity 2 (RFC 5424).
Windows event 4625 is a failed logon, 4624 a successful one and 4740 a lockout (Microsoft's auditing reference).
CISA puts known exploited vulnerabilities at the top of the remediation list (BOD 22-01).
Questions and answers
Is this a CompTIA CSA+ practice test?
CompTIA's page lists one cybersecurity analyst exam, named CySA+, and none named CSA+. This bank follows CySA+ V4, exam CS0-004, which launched on June 23, 2026.
Is this a CySA+ CS0-003 practice test?
It is sorted for CS0-004 (V4). CompTIA's page says the English CS0-003 exam (V3) retires on December 22, 2026. V3 has the same four areas with other weights, so most of this bank fits both; the questions on AI in security operations follow V4.
How many questions are on the CySA+ exam?
CompTIA gives a maximum of 85 questions in 165 minutes for CS0-004. Exam mode on this page asks 85 multiple-choice questions against a 165-minute clock and reports the percent right for each domain.
What is the passing score for CySA+?
750 on a scale of 100 to 900, by CompTIA's page. A scaled score is not a percent of questions, so this page shows no pass or fail.