12 real CS0-004 sample questions, each with an explanation of why every option is right or wrong. No account, no card. This is the reasoning the CS0-004 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real CS0-004 is Maximum of 85 questions in 165 minutes, pass mark 750 on a scale of 100 to 900. For a domain-by-domain breakdown and a study plan, read the CS0-004 study guide. The full bank has 289 questions.
lock_openFree sampleSecurity Operationseasy
A SOC deploys an AI assistant that summarises and prioritises incoming alerts to speed up triage. During a busy shift, an analyst notices the assistant consistently ranks alerts from one noisy scanner as top priority while burying a credential-stuffing pattern lower down. What is the analyst's best response?
- AApply analyst judgement to re-prioritise the credential-stuffing alerts and report the ranking flaw for tuning.check_circle Correct
- BDisable all AI triage assistance permanently, as it has proven unable to prioritise alerts correctly.
- CContinue to accept the assistant's ranking, since the tool processes more context than a human analyst can.
- DDelete the noisy scanner alerts from the queue so the assistant stops ranking them highly.
AI triage augments rather than replaces analyst judgement, so analysts override flawed prioritisation and feed corrections back for tuning. Alert triage augmentation is designed to assist human decisions, not overrule them, so when the tool mis-ranks a genuine threat the analyst reprioritises on the evidence and reports the flaw so the model can be tuned.
Why A is correct: Correct: AI triage augments the analyst, so the analyst overrides the flawed ranking on the evidence and feeds the issue back so the tool improves.
Why B is wrong: Tempting after a visible miss, but a single prioritisation error does not justify removing a tool that reduces overall triage load; the fix is oversight, not abandonment.
Why C is wrong: Tempting because AI can weigh more signals, but blind acceptance of a demonstrably skewed ranking lets a real threat sit unactioned.
Why D is wrong: Tempting as a quick way to clean the queue, but deleting source alerts destroys evidence and does not address the assistant's flawed weighting.
lock_openFree sampleSecurity Operationseasy
An analyst reviews an alert raised by the SOC's machine learning detection model, which flagged a finance workstation for anomalous outbound traffic. The model reports a confidence score of 0.42 and no supporting rule or signature match. Before escalating, what should the analyst do first?
ml_alert: host=FIN-WS07 class=beaconing confidence=0.42
supporting_signatures: none
raw_flows: 443/tcp to 203.0.113.9, 5 conns/hour
- AEscalate the alert to incident response immediately because the detection model classified the host as beaconing.
- BSuppress the alert and retrain the model, since a 0.42 confidence indicates the detection logic is faulty.
- CBlock the destination address at the firewall before any further review of the traffic.
- DValidate the model output by examining the underlying flow evidence to confirm whether the behaviour is genuinely anomalous.check_circle Correct
Analysts must validate AI or machine learning detection output against underlying evidence before treating it as an actionable finding. Machine learning detections are probabilistic and can produce false positives, so a low-confidence flag with no corroborating signature requires the analyst to confirm it against the raw telemetry before escalation or containment.
Why A is wrong: Tempting because ML output can feel authoritative, but escalating an unvalidated low-confidence flag wastes response resources and skips triage.
Why B is wrong: Tempting because low confidence looks like a model defect, but a single low score is not evidence of a broken model and suppression hides a possible true positive.
Why C is wrong: Tempting as a fast containment move, but blocking on an unconfirmed low-confidence flag risks disrupting legitimate business traffic without evidence.
Why D is correct: Correct: a low-confidence ML flag with no corroborating signature is a lead, not a verdict, so the analyst confirms it against the raw evidence before acting.
lock_openFree sampleSecurity Operationseasy
An analyst investigates why the SOC's machine learning malware classifier has started passing several samples that older signatures would have caught. Reviewing the training pipeline, they find that an unvalidated external feed has been injecting mislabelled benign entries for malicious files over several weeks. Which concept best describes this problem?
training_feed: source=partner-feed-3 (unverified)
label_audit: 214 malicious files labelled 'benign'
model_effect: detection rate down 18% on known families
- AA privacy governance failure, because the training data included records that should have been anonymised first.
- BData poisoning, where manipulated training input degrades the model's ability to detect malicious samples.check_circle Correct
- CA false-negative tuning error, where the detection threshold was set too high for the known malware families.
- DModel drift, where the malware landscape evolved faster than the classifier could naturally adapt.
Deliberately corrupting a model's training data to degrade its detection is data poisoning, a core adversarial AI risk. Data poisoning occurs when an attacker injects manipulated or mislabelled samples into the training set so the model learns the wrong decision boundary, which here causes malicious files to be classified as benign.
Why A is wrong: Tempting because governance of training data is a real concern, but the issue here is corrupted labels degrading detection, not exposure of private data.
Why B is correct: Correct: injecting mislabelled samples into the training set to skew the model's learned behaviour is the defining pattern of data poisoning.
Why C is wrong: Tempting because the symptom is missed detections, but the root cause is corrupted training labels, not a mis-set threshold on a sound model.
Why D is wrong: Tempting because both cause degraded accuracy over time, but drift is natural change in real data, not deliberate corruption of the training labels.
lock_openFree sampleVulnerability Managementhard
Within the CVSS version 3.1 framework, what does the Environmental metric group allow an analyst to do that the Base metric group alone cannot?
- AAdjust the score to reflect the security requirements and modified characteristics of the analyst's own deployment.check_circle Correct
- BReflect the current maturity of available exploit code and the state of official remediation.
- CExpress the intrinsic severity of the flaw independent of any particular organisation or time.
- DPredict the probability that the vulnerability will be exploited in the wild within thirty days.
Distinguish the CVSS Environmental metric group as the mechanism for tailoring a base score to local asset context and security requirements. The Environmental group applies modified base metrics and confidentiality, integrity and availability requirement weightings so the final score represents risk to the specific environment rather than the flaw in the abstract.
Why A is correct: Correct: the Environmental group re-weights confidentiality, integrity and availability requirements and lets the analyst override base metrics to match how the asset is actually deployed.
Why B is wrong: Tempting because these do adjust a score over time, but exploit maturity and remediation level belong to the Temporal metric group, not the Environmental group.
Why C is wrong: This describes the purpose of the Base metric group itself, which is the fixed starting point the Environmental group is meant to tailor.
Why D is wrong: Exploitation probability is what EPSS estimates; CVSS environmental scoring measures contextual impact, not likelihood of attack over a time window.
lock_openFree sampleVulnerability Managementhard
How does the EPSS score differ from a CVSS base score when used to prioritise vulnerabilities?
- AEPSS measures the technical severity of a flaw, whereas CVSS estimates how soon a patch will be released.
- BEPSS estimates the probability that a vulnerability will be exploited, whereas CVSS base scores rate its intrinsic severity if exploited.check_circle Correct
- CEPSS is a confirmed list of exploited flaws, whereas CVSS predicts which flaws will be exploited next.
- DEPSS is set individually by each organisation, whereas CVSS base scores are recalculated for every environment.
Explain that EPSS estimates exploitation likelihood while a CVSS base score expresses intrinsic severity, making them complementary inputs. EPSS uses observed threat data to output a probability of exploitation, a different question from the CVSS base score, which quantifies how damaging and how exploitable a flaw is by its intrinsic characteristics.
Why A is wrong: This reverses both concepts; severity is the domain of CVSS and patch timing is measured by neither metric.
Why B is correct: Correct: EPSS is a data-driven likelihood-of-exploitation estimate, while the CVSS base score rates impact and exploitability characteristics assuming exploitation occurs.
Why C is wrong: A confirmed exploited-in-the-wild catalogue describes CISA KEV, not EPSS, and CVSS makes no exploitation prediction at all.
Why D is wrong: This inverts the truth: EPSS is a published global model and the CVSS base score is the environment-independent portion that organisations do not recalculate.
lock_openFree sampleVulnerability Managementhard
What is the defining characteristic of the CISA Known Exploited Vulnerabilities (KEV) catalogue as a prioritisation input?
- AIt assigns each listed vulnerability a numeric severity from zero to ten based on impact and exploitability.
- BIt forecasts the statistical likelihood that each vulnerability will be weaponised in the coming month.
- CIt lists vulnerabilities with reliable evidence of active exploitation in the wild, each with a remediation due date.check_circle Correct
- DIt enumerates every publicly disclosed vulnerability regardless of whether exploitation has been seen.
Identify the CISA KEV catalogue as a list of vulnerabilities with confirmed active exploitation and mandated remediation dates. KEV inclusion depends on reliable evidence that a vulnerability is being actively exploited, so its presence is a strong, evidence-based reason to prioritise remediation ahead of many higher-scoring but unexploited flaws.
Why A is wrong: Numeric severity from zero to ten is the CVSS scale; the KEV catalogue records exploitation status rather than producing its own score.
Why B is wrong: Forecasting likelihood of future exploitation is the role of EPSS; KEV documents exploitation that has already been observed, not a prediction.
Why C is correct: Correct: entry criteria require confirmed active exploitation, and each entry carries a required remediation date, making it an evidence-of-exploitation prioritisation signal.
Why D is wrong: A catalogue of all disclosed flaws describes something like the CVE list or NVD; KEV is deliberately narrow, including only those with confirmed exploitation.
lock_openFree sampleIncident Response and Managementmedium
During triage you review an EDR alert on a finance workstation: 'rundll32.exe loaded a signed but unusual DLL from C:\Users\Public, then spawned a connection to a known content delivery domain'. Your team maps every observation to MITRE ATT&CK. Which mapping BEST fits the rundll32 behaviour observed here?
- AInitial Access via T1566 Phishing, because the workstation belongs to a finance user who is a common phishing target
- BExfiltration via T1041 Exfiltration Over C2 Channel, because a network connection to an external domain was observed
- CDefense Evasion via T1218 System Binary Proxy Execution, because a trusted signed Windows binary is being abused to run the payloadcheck_circle Correct
- DPersistence via T1547 Boot or Logon Autostart Execution, because the DLL was loaded from a public writable folder
Map abuse of a trusted signed system binary to the correct ATT&CK technique rather than to an unproven adjacent tactic. System binary proxy execution abuses a signed, allowlisted OS binary such as rundll32 to run attacker code, which evades controls that trust the parent process; the observed load-and-execute chain matches this technique rather than delivery, exfiltration, or persistence.
Why A is wrong: Tempting because finance users are phished often, but the evidence shows post-execution binary abuse, not a delivery vector, so mapping to phishing invents a tactic the artefact does not establish.
Why B is wrong: Tempting because an outbound connection is present, but a single connection to a CDN domain is not evidence that data left the host, so keying exfiltration overreads the artefact.
Why C is correct: Correct: rundll32 is a legitimate signed system binary abused to proxy execution of an attacker DLL, which is exactly the living-off-the-land pattern ATT&CK catalogues under T1218.
Why D is wrong: Tempting because a writable path suggests staging, but nothing shows a run key, service, or startup entry, so persistence is a technique the evidence does not support.
lock_openFree sampleIncident Response and Managementmedium
You are documenting an intrusion with the Diamond Model. Your notes read: 'source host 203.0.113.44 used a spearphishing attachment that dropped a RAT signed with a stolen certificate, targeting the HR department's mail server'. Which mapping of these facts to the four Diamond Model vertices is correct?
- A203.0.113.44 is the infrastructure, the RAT is the capability, the HR mail server is the victim, and the unknown actor behind the attack is the adversarycheck_circle Correct
- B203.0.113.44 is the adversary, the RAT is the capability, HR mail server is the victim, and the stolen certificate is the infrastructure
- CThe spearphishing attachment is the adversary, the RAT is the infrastructure, the HR mail server is the capability, and 203.0.113.44 is the victim
- D203.0.113.44 is the capability, the RAT is the infrastructure, the HR mail server is the adversary, and the stolen certificate is the victim
Correctly assign intrusion facts to the adversary, capability, infrastructure, and victim vertices of the Diamond Model. The Diamond Model separates the actor (adversary) from the systems they operate (infrastructure) and the tools they wield (capability) against a target (victim); a source IP is infrastructure and the RAT is capability, while the adversary remains the human or group operating both.
Why A is correct: Correct: the sending IP is infrastructure, the RAT is the capability, the HR mail server is the victim, and the adversary vertex is the actor operating them, which matches the Diamond Model's four core features.
Why B is wrong: Tempting because it fills all four vertices, but an IP address is infrastructure the adversary uses, not the adversary itself, and a stolen certificate is part of the capability, so two vertices are swapped.
Why C is wrong: Tempting to a candidate who pattern-matches loosely, but it misassigns every vertex, treating a delivery method as an actor and the target server as a capability, which inverts the model.
Why D is wrong: Tempting because it uses the same four labels, but it confuses the tooling with the actor and casts the targeted asset as the adversary, so the assignments are internally inconsistent.
lock_openFree sampleIncident Response and Managementmedium
An intrusion analyst is placing observed activity on the Cyber Kill Chain to decide where detection is weakest. Evidence so far: a malicious macro document was opened, a second-stage implant was written to disk, and the implant beaconed outbound every 60 seconds but no lateral movement or data staging has appeared. Which Kill Chain phase has the adversary MOST clearly reached?
- AActions on Objectives, because a second-stage implant was successfully written to the victim disk
- BDelivery, because a malicious macro document reached and was opened by the user
- CExploitation, because the macro executed code when the document was opened
- DCommand and Control, because the implant is beaconing to an external controller on a regular intervalcheck_circle Correct
Identify the furthest Cyber Kill Chain phase an adversary has reached from beaconing evidence rather than an earlier completed phase. The Kill Chain is sequential, so the correct read is the latest phase the evidence supports; a steady outbound beacon to an external controller is the signature of Command and Control, which sits after delivery, exploitation, and installation but before actions on objectives.
Why A is wrong: Tempting because the implant landing feels like a goal achieved, but writing a payload is installation, and no data theft or impact has occurred, so this phase is premature.
Why B is wrong: Tempting because the macro document is the delivery mechanism, but the adversary has clearly progressed past delivery to installation and beaconing, so naming delivery understates the furthest phase reached.
Why C is wrong: Tempting because macro execution is exploitation, but that phase is already complete and the beaconing places the adversary later in the chain, so this is not the furthest phase.
Why D is correct: Correct: a repeating outbound beacon to an external controller is the defining evidence of the Command and Control phase, which the 60-second interval demonstrates.
lock_openFree sampleReporting and Communicationmedium
During a ransomware incident, your executive sponsor sends this email at 09:15: "Board call at 10:00. Give me the current business impact and what we are doing, in plain terms." You have technical findings but the eradication is still in progress. What should your update to the sponsor prioritise?
- AWhich services are down, the current containment status, and the expected next milestone in plain business languagecheck_circle Correct
- BA packet-level breakdown of the C2 beacon intervals and the malware's registry persistence keys
- CA request that the board approve purchasing a new EDR platform before the call begins
- DThe full indicator-of-compromise list so the board can forward it to peer organisations
Tailor incident communications to the audience: executives need business impact, status, and next steps in plain language, not raw technical artefacts. Stakeholder communication effectiveness depends on matching content to the audience's decisions. Executives make resourcing and disclosure calls, so they need impact, containment status, and milestones framed in business terms rather than low-level indicators they cannot use.
Why A is correct: An executive update should translate technical status into business impact and next steps, matching the audience and the decision they must support.
Why B is wrong: This is accurate technical detail, but a board-facing sponsor needs business impact and status, not indicators they cannot act on.
Why C is wrong: Procurement decisions belong in the lessons-learned phase, not a mid-incident status update, and pre-empting them derails the sponsor's immediate need.
Why D is wrong: Sharing raw IOCs with a board is the wrong audience and risks premature disclosure; the sponsor asked for impact and actions in plain terms.
lock_openFree sampleReporting and Communicationmedium
You are the analyst on a confirmed breach of a payment-processing server. The forensic timeline reads: 03:12 unauthorised access, 03:40 cardholder data table queried, 04:05 outbound transfer to an external host. Your incident lead asks which stakeholder fact most directly drives the external notification clock you must start tracking. Which fact is it?
- AThe 53-minute gap between initial access and data exfiltration recorded in the forensic timeline
- BThe external host address that received the outbound transfer at 04:05
- CThat the affected system is a server rather than an end-user workstation
- DThat the queried table held cardholder data, bringing PCI DSS and breach-notification obligations into scopecheck_circle Correct
Regulatory notification deadlines are triggered by the classification of the data involved, not by timeline metrics or infrastructure details. External notification obligations attach to the type of data exposed. Cardholder data pulls the incident into PCI DSS and jurisdictional breach-notification regimes, each with its own reporting clock, which is why the data classification governs the deadline rather than dwell time or destination.
Why A is wrong: Dwell time is a useful metric for the after-action report, but it does not by itself trigger a regulatory notification deadline; the nature of the data does.
Why B is wrong: The destination is vital for containment and threat intelligence, but knowing the IP does not set a notification deadline; the data classification does.
Why C is wrong: Asset type informs impact scoring, yet a server versus workstation distinction does not create a legal notification duty on its own; the regulated data does.
Why D is correct: Regulated cardholder data being accessed is what starts contractual and statutory notification clocks, so it is the fact that governs the external notification timeline.
lock_openFree sampleReporting and Communicationmedium
Your after-action review for a phishing-led compromise notes: "Mean time to detect 6 days; mean time to respond 2 hours once detected." The CISO asks which improvement area this pairing of metrics points to most clearly. Which conclusion is best supported?
- AResponse playbooks are the weak point and need to be rewritten before the next incident
- BDetection and monitoring coverage is the weak point, since detection took days while response was fastcheck_circle Correct
- CBoth metrics are acceptable and no improvement action is warranted from this incident
- DThe eradication phase overran and extended the overall incident duration
Incident KPIs like MTTD and MTTR localise where a process is weak; a long detect time with a short response time indicates a detection gap. Metrics guide lessons-learned prioritisation by separating detection performance from response performance. When detection spans days but response takes hours, the detection and monitoring stage is the constraint, so improvement effort should target visibility rather than response.
Why A is wrong: A 2-hour response time is strong, so the data points away from playbooks; the long detection window is where the gap actually sits.
Why B is correct: A six-day detect time against a two-hour response time isolates detection as the bottleneck, directing improvement to monitoring and alerting coverage.
Why C is wrong: A six-day dwell time is a serious exposure window, so concluding no action is needed misreads the metric that matters most here.
Why D is wrong: Neither metric measures eradication duration; inferring an eradication overrun goes beyond what mean time to detect and respond can establish.
Examworthy is not affiliated with or endorsed by CompTIA. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. CS0-004 and related marks belong to their respective owners.
