About these questions
These five questions are original. We wrote them in the style of the CS0-004 objectives, spread across the four domains. They are not real exam questions, and the real exam will word things differently. The real exam also includes performance-based items, which this page cannot reproduce.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it on the domains explained page.
Question 1 (Security Operations)
An analyst downloaded a packet capture from a branch office yesterday and now needs Wireshark to show only DNS traffic that involves the host 10.20.0.14. A colleague says to enter a capture filter. Which approach is correct?
- A. Apply a display filter such as `ip.addr == 10.20.0.14 && dns` to the saved capture
- B. Apply a capture filter to the saved file, because capture filters can be changed after the fact
- C. Run a new capture today with a filter on port 53
- D. Export the file to JSON and scan it with a YARA rule
Show the answer and explanation
Correct answer: A. Wireshark has two kinds of filters. Display filters hide packets that do not match inside a capture you already have, which is exactly what is needed here. Capture filters, the closest wrong option, only decide what is recorded while a live capture runs, so they cannot be applied to a saved file. Capturing again today would not recover yesterday’s traffic. YARA matches patterns in files or memory and does not understand protocols the way Wireshark does.
Question 2 (Security Operations)
A SOC adds a free list of malicious domains to its DNS blocking rules. A review shows that most entries were last seen in attacks more than two years ago, and several of them now point to legitimate websites. Which quality of the intelligence is mainly lacking?
- A. Timeliness
- B. Attribution
- C. Relevance
- D. Confidentiality
Show the answer and explanation
Correct answer: A. Timeliness describes whether intelligence reflects what adversaries are doing now. Domains and addresses get reassigned, so old entries lose value and create false positives, which is what happened here. Relevance, the closest wrong option, asks whether the intelligence applies to your organization, and the problem here is age, not fit. Attribution is about naming the actor behind activity. Confidentiality is a handling label and does not measure how current or accurate data is.
Question 3 (Vulnerability Management)
The same High-severity vulnerability is found on two identical file-transfer servers. One is published to the internet through the firewall. The other can only be reached from an internal administration network. Patch time is limited. Which server should be fixed first?
- A. The internal server, because administration networks hold the most valuable data
- B. Both at once, because the scores are identical so the risk is identical
- C. The internal server, because most breaches come from insiders
- D. The internet-facing server, because anyone on the internet can attempt to exploit it
Show the answer and explanation
Correct answer: D. A severity score describes how bad a flaw is, not how likely it is to be used against you. The internet-facing server can be attacked by anyone, while the internal one first needs an attacker to get inside, so exposure raises the practical risk of the first. Option B is the closest wrong answer because it treats identical scores as identical risk, but context such as exposure and asset value belongs in prioritization. Options A and C rely on blanket rules that the scenario does not support.
Question 4 (Incident Response and Management)
A workstation is sending beacons to an unknown external address. The analyst must stop it from reaching other hosts but keep it powered on and reachable for remote investigation. Which action fits best?
- A. Hold the power button until it shuts down
- B. Reimage it from the standard company image
- C. Delete the files that the endpoint tool flagged
- D. Use the endpoint detection and response network containment feature
Show the answer and explanation
Correct answer: D. EDR network containment cuts the host off from the network except for its connection to the management console. The machine stays on, memory stays intact, and analysts can keep collecting data. Shutting it down is the closest wrong option: it stops the spread but loses volatile evidence and ends remote work. Deleting files is an eradication step that does not stop other attacker activity. Reimaging is a recovery step that destroys evidence and belongs after investigation.
Question 5 (Reporting and Communication)
A SOC lead wants to report on how accurate the team’s detection rules are, not on how fast analysts work. Which two metrics fit this purpose? Choose two.
- A. Mean time to respond
- B. True-positive rate
- C. Alert volume per shift
- D. False-positive rate
- E. Mean time to remediate
Show the answer and explanation
Correct answers: B and D. The true-positive rate shows how often alerts reflect real malicious activity, and the false-positive rate shows how often alerts fire on harmless activity. Together they describe how trustworthy the detections are. Mean time to respond and mean time to remediate, the closest wrong options, measure speed, not accuracy. Alert volume measures workload and says nothing about whether alerts were right. Good reports keep these three kinds of metric separate.
More guides for CS0-004
- CS0-004 Exam Format, Scoring and Retakes
- CS0-004 Study Plan: 4-Week and 8-Week
- Is the CS0-004 Exam Hard?
- CS0-004 Prerequisites and Experience
- CS0-004 Renewal and Retakes Explained
- Is CS0-004 Worth It? An Honest Look
- CS0-004 Cheat Sheet: Key Facts to Review
- SY0-801 vs CS0-004: Which Exam First?
Next step
Missed one? The domains explained page shows where each topic sits. For more practice, our CS0-004 practice tests include 500 original questions, each with an explanation for every answer option.