Free CS0-001: CompTIA CySA Certification Exam Questions and Answers

Last updated: September 15, 2026

Exam code

CS0-001

Provider

CompTIA

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   A cybersecurity analyst traced the source of an attack to compromised user credentials. Log analysis revealed that the attacker successfully authenticated from an unauthorized foreign country. Management asked the security analyst to research and implement a solution to help mitigate attacks based on compromised passwords. Which of the following should the analyst implement?

   • A. Self-service password reset
   • B. Single sign-on
   • C. Context-based authentication
   • D. Password complexity
   Reveal Answer

2. Question #2

   After completing a vulnerability scan, the following output was noted: Which of the following vulnerabilities has been identified?

   • A. PKI transfer vulnerability.
   • B. Active Directory encryption vulnerability.
   • C. Web application cryptography vulnerability.
   • D. VPN tunnel vulnerability.
   Reveal Answer

3. Question #3

   After running a packet analyzer on the network, a security analyst has noticed the following output: Which of the following is occurring?

   • A. A ping sweep
   • B. A port scan
   • C. A network map
   • D. A service discovery
   Reveal Answer

4. Question #4

   After analyzing and correlating activity from multiple sensors, the security analyst has determined a group from a high-risk country is responsible for a sophisticated breach of the company network and continuous administration of targeted attacks for the past three months. Until now, the attacks went unnoticed. This is an example of:

   • A. privilege escalation.
   • B. advanced persistent threat.
   • C. malicious insider threat.
   • D. spear phishing.
   Reveal Answer

5. Question #5

   A security analyst is performing a forensic analysis on a machine that was the subject of some historic SIEM alerts. The analyst noticed some network connections utilizing SSL on non-common ports, copies of svchost.exe and cmd.exe in %TEMP% folder, and RDP files that had connected to external IPs. Which of the following threats has the security analyst uncovered?

   • A. DDoS
   • B. APT
   • C. Ransomware
   • D. Software vulnerability
   Reveal Answer

6. Question #6

   An HR employee began having issues with a device becoming unresponsive after attempting to open an email attachment. When informed, the security analyst became suspicious of the situation, even though there was not any unusual behavior on the IDS or any alerts from the antivirus software. Which of the following BEST describes the type of threat in this situation?

   • A. Packet of death
   • B. Zero-day malware
   • C. PII exfiltration
   • D. Known virus
   Reveal Answer

7. Question #7

   The security configuration management policy states that all patches must undergo testing procedures before being moved into production. The security analyst notices a single web application server has been downloading and applying patches during non-business hours without testing. There are no apparent adverse reactions, server functionality does not seem to be affected, and no malware was found after a scan. Which of the following actions should the analyst take?

   • A. Reschedule the automated patching to occur during business hours.
   • B. Monitor the web application service for abnormal bandwidth consumption.
   • C. Create an incident ticket for anomalous activity.
   • D. Monitor the web application for service interruptions caused from the patching.
   Reveal Answer

8. Question #8

   The Chief Information Security Officer (CISO) has asked the security staff to identify a framework on which to base the security program. The CISO would like to achieve a certification showing the security program meets all required best practices. Which of the following would be the BEST choice?

   • A. OSSIM
   • B. SDLC
   • C. SANS
   • D. ISO
   Reveal Answer

9. Question #9

   A recent audit has uncovered several coding errors and a lack of input validation being used on a public portal. Due to the nature of the portal and the severity of the errors, the portal is unable to be patched. Which of the following tools could be used to reduce the risk of being compromised?

   • A. Web application firewall
   • B. Network firewall
   • C. Web proxy
   • D. Intrusion prevention system
   Reveal Answer

10. Question #10

    As part of the SDLC, software developers are testing the security of a new web application by inputting large amounts of random data. Which of the following types of testing is being performed?

    • A. Fuzzing
    • B. Regression testing
    • C. Stress testing
    • D. Input validation
    Reveal Answer