How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 5 Refer to the Exhibit Practice Questions scenario questions for the CS0-004 exam, each with detailed explanations and wrong-answer analysis.

How should I approach CS0-004 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CompTIA CySA+ CS0-004 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise CompTIA CySA+ CS0-004 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CS0-004

exam code

CompTIA

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Exhibit

2025-02-15 08:23:45 | src=192.168.2.10 | dst=10.0.0.5 | port=443 | action=blocked | signature=ET TROJAN Suspicious Outbound Connection

A
Immediately block the source IP at the firewall
Why wrong: Immediately blocking a source IP based solely on a SIEM alert, without prior verification, carries a significant risk of disrupting legitimate business operations. Many SIEM alerts can be false positives or indicate benign activity, especially if the alert threshold is low or the signature is overly broad. A security analyst's initial step should involve validating the alert's legitimacy to avoid impacting critical services or users.
B
Check the baseline behavior of the source IP
Checking the baseline behavior of the source IP is a crucial initial step in incident response, as it provides essential context for the triggered SIEM alert. By comparing the current activity against established normal patterns for that IP, the analyst can determine if the behavior is truly anomalous or if it represents a routine, albeit unusual, operation. This comparison helps to quickly differentiate between legitimate, expected traffic and genuinely suspicious activity, thereby reducing false positives and prioritizing actual threats.
C
Update the signature database
Why wrong: Updating the signature database is not an appropriate immediate response to an active SIEM alert that has already triggered. The alert indicates that an existing signature successfully identified a pattern, meaning the current database was sufficient to detect this specific event. While regular signature updates are vital for proactive defense against new threats, they do not directly address the investigation or remediation of an alert that has already been generated by an existing rule.
D
Isolate the affected system for forensic analysis
Why wrong: Isolating an affected system for forensic analysis is a containment strategy typically employed after an analyst has confirmed malicious activity and determined the scope of the compromise. Performing isolation as the very first step, without initial investigation or verification, could prematurely disrupt critical business functions or hinder the collection of live evidence. Initial steps should focus on validating the alert and understanding the nature of the potential incident before enacting such a disruptive measure.

Full breakdown with real-world context →

Question 2easymultiple choice

Full question →

Refer to the exhibit. The output is from a Linux system running `netstat -an`. Which of the following ports is likely being used for remote command-and-control communication?

Exhibit

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 10.0.0.5:54321         198.51.100.20:443        ESTABLISHED
tcp        0      0 192.168.1.10:80         0.0.0.0:*               LISTEN     
udp        0      0 0.0.0.0:53              0.0.0.0:*

A
54321
Port 54321 falls into the dynamic/private port range, typically used for ephemeral client-side connections. However, if observed as a listening port or as the destination port for an established connection to an external IP, it becomes highly anomalous. Attackers frequently utilize high, non-standard ports for command and control (C2) communication or data exfiltration to bypass basic firewall rules and blend with legitimate outbound traffic, making it a strong indicator of compromise.
B
22
Why wrong: Port 22 is the standard port for Secure Shell (SSH), a cryptographic network protocol used for secure remote access and file transfers. While SSH can be a target for brute-force attacks or used maliciously if compromised, its presence as an established connection is generally expected for legitimate system administration. Without further context indicating unauthorized access or unusual traffic patterns, SSH itself is not inherently anomalous.
C
53
Why wrong: Port 53 is dedicated to the Domain Name System (DNS), a critical service for translating human-readable domain names into IP addresses. Both UDP and TCP port 53 are fundamental for nearly all internet communication, making its presence in network traffic entirely expected. Although DNS can be exploited for tunneling or data exfiltration, the mere observation of traffic on port 53 does not, by itself, indicate an anomaly or compromise.
D
80
Why wrong: Port 80 is the well-known port for the Hypertext Transfer Protocol (HTTP), which is the foundation of data communication for the World Wide Web. Web browsers and servers routinely communicate over this port for unencrypted web traffic. Therefore, seeing established connections on port 80 is a common and legitimate occurrence in almost any network environment, reflecting normal user activity or server functions.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?

A
Reboot the server into safe mode.
Why wrong: Rebooting a server, even into safe mode, irrevocably alters the system's volatile memory, destroys active processes, and clears critical log buffers. This action contaminates the forensic evidence by changing the live state of the compromised system, making it impossible to capture the true initial state of the intrusion and understand the full scope of the attack.
B
Disconnect the network cable from the server.
Disconnecting the network cable immediately isolates the compromised server from the network, preventing further malicious activity such as data exfiltration, lateral movement, or command-and-control communication. This crucial containment step preserves the current volatile system state for subsequent forensic acquisition without introducing significant changes, allowing for a more accurate investigation.
C
Power off the server to freeze the system state.
Why wrong: Powering off the server immediately destroys all volatile memory contents, including running processes, active network connections, open files, and potentially critical encryption keys or malware residing only in RAM. This irreversible loss of ephemeral data significantly hinders forensic analysis, as much of the evidence crucial for understanding the attack's scope and methodology resides in the system's live memory.
D
Run a memory dump with WinPmem before any action.
Why wrong: While a memory dump is an essential forensic step, performing it *before* isolating the system is a critical misstep in incident response. Executing tools on a live, potentially compromised network-connected server risks alerting the attacker, allowing them to destroy evidence, exfiltrate more data, or escalate privileges during the acquisition process. Containment must precede forensic collection to secure the environment.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

What is the net effect of the policy shown in the exhibit on requests from an IP address in the 10.0.0.0/8 range?

Exhibit

Refer to the exhibit.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confidential-data/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::confidential-data/*"
    }
  ]
}
```

A security analyst is reviewing an S3 bucket policy for an AWS environment.

A
Allows all S3 actions from the 10.0.0.0/8 range and denies from other IPs.
Why wrong: The policy's explicit Deny statement, which applies to all S3 actions without any IP condition, takes precedence over any Allow statement. Therefore, even if an Allow statement permits actions from the 10.0.0.0/8 range, the unconditional Deny overrides it, rendering that Allow ineffective. The policy does not selectively deny *only* from IPs outside the specified range; it denies universally.
B
Denies all S3 actions from all IP addresses.
This option is correct because the policy contains an explicit Deny statement for all s3:* actions, which lacks any limiting conditions such as aws:SourceIp. According to AWS IAM policy evaluation logic, an explicit Deny always overrides any explicit Allow statements. Consequently, all S3 actions are denied for all principals, regardless of their source IP address, effectively nullifying any Allow rules.
C
Denies all S3 actions except GetObject from the 10.0.0.0/8 range.
Why wrong: This statement is incorrect because the explicit Deny action in the policy likely specifies s3:*, encompassing all S3 operations, including GetObject. Since the Deny is unconditional regarding IP addresses, it applies universally, meaning GetObject requests are also denied, even from the 10.0.0.0/8 range. The policy does not create an exception for GetObject.
D
Allows GetObject requests from the 10.0.0.0/8 range and denies all other S3 actions.
Why wrong: This option is incorrect because the fundamental principle of AWS IAM policy evaluation dictates that an explicit Deny always takes precedence over an explicit Allow. Even if there were an Allow statement specifically for GetObject from 10.0.0.0/8, the unconditional Deny for s3:* would still override it. Therefore, GetObject requests would also be denied, not allowed.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

Based on the exhibit, which type of issue is most likely affecting the server's network performance?

Exhibit

Refer to the exhibit.

```
ethtool -S eth0 | grep -E "(rx_crc_errors|rx_fifo_errors|rx_frame_errors)"
rx_crc_errors: 2451
rx_fifo_errors: 12
rx_frame_errors: 892
```

An analyst is investigating network performance issues on a Linux server. The exhibit shows output from ethtool.

A
Faulty network cable or interface
CRC (Cyclic Redundancy Check) errors and frame errors are strong indicators of data corruption occurring during transmission or reception. These typically point to issues at the physical layer (Layer 1) of the OSI model, such as a damaged Ethernet cable, a loose connection, or a malfunctioning network interface card (NIC) or switch port. Such physical defects introduce noise or signal degradation, leading to corrupted frames that fail their integrity checks upon arrival.
B
Duplex mismatch between the server and switch
Why wrong: A duplex mismatch occurs when one side of a link operates in full-duplex mode while the other operates in half-duplex. This scenario primarily leads to late collisions and alignment errors, as the half-duplex device attempts to transmit while the full-duplex device is also sending, causing data corruption due to simultaneous transmissions on a shared medium. While data corruption can occur, the primary symptoms are usually collisions and significant performance degradation, rather than high CRC errors alone.
C
Incorrect TCP/IP configuration
Why wrong: Incorrect TCP/IP configuration, such as a wrong IP address, subnet mask, or default gateway, affects network layer (Layer 3) and transport layer (Layer 4) communication. These issues would manifest as connectivity problems, routing failures, or inability to reach specific services, but they do not directly cause physical layer data corruption like CRC errors. CRC errors are a lower-layer issue related to the integrity of the transmitted frame itself.
D
Outdated network driver
Why wrong: An outdated or corrupted network driver can lead to various issues, including packet drops, intermittent connectivity, poor performance, or system instability. While a faulty driver could potentially misinterpret or misprocess frames, directly causing a high volume of CRC errors is less common. Driver issues are more likely to manifest as higher-level errors or system-level problems rather than consistent physical layer data integrity failures.

Full breakdown with real-world context →

These CS0-004 practice questions are part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style CS0-004 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related CS0-004 topic practice pages

Security Operations practice questions

Vulnerability Management practice questions

Incident Response and Management practice questions

Reporting and Communication practice questions

CompTIA A+ hardware practice questions

CompTIA A+ mobile devices practice questions

CompTIA A+ networking practice questions

CompTIA A+ operating systems practice questions

CompTIA A+ security practice questions

CompTIA A+ software troubleshooting questions

CompTIA A+ operational procedures questions

Practice scenarios

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Exhibit

Refer to the exhibit. The output is from a Linux system running `netstat -an`. Which of the following ports is likely being used for remote command-and-control communication?

Exhibit

An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?

What is the net effect of the policy shown in the exhibit on requests from an IP address in the 10.0.0.0/8 range?

Exhibit

Based on the exhibit, which type of issue is most likely affecting the server's network performance?

Exhibit