CertificationsCompTIA CySA+ CS0-004Labs
CompTIA CySA+ CS0-004 hands-on labs
Analyst shifts: triage the queue, tell a true positive from a false one, scope containment and justify the call.
41 labs you run in the browser: 5 guided, 26 assisted, 8 challenge, 2 capstone. About 10 hours of authored lab time. This set has no free taster yet; the free tier still carries the lessons and practice questions.
41
labs
5
guided
steps in order
10
goal only
challenge and capstone
0
free tasters
none in this set
What you practise
Exam facts and study plan- SIEM queue· you click39 labs
- Risk register and control sheets· you click2 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
A sweep of the plant subnet from a laptop
ProGuided · Quick · 6 min · SIEM queue
The plant sensor saw a sweep of the control subnet from an address on the user network. The approved appliance sits on the management network…
scan placementsegmentationapproved windowcontainment
A signed system tool that fetched its own update
ProGuided · Quick · 7 min · SIEM queue
FIN-WS-07 is a finance workstation with no server role. At 02:14 it used the built in certificate utility to fetch a file from a domain registered nine days earlier and dropped the file…
living off the landsuspicious command lineegress indicatorhost containment
Decode the encoded command before you judge it
ProGuided · Quick · 7 min · SIEM queue
A finance workstation opened a workbook from an email attachment at 10:12. One minute later a hidden PowerShell process started with a long encoded argument…
decodingbase64log analysispowershell
The sandbox says clean, the workstation says otherwise
ProGuided · Quick · 7 min · SIEM queue
An invoice document arrived from a domain registered nine days ago and the mail gateway flagged it for a failed sender check. The sandbox ran it and found nothing at all…
sandbox evasionchild processmacro documentfalse negative
A scanner no vendor will patch
ProGuided · Quick · 12 min · Risk register and control sheets
The radiology image archive runs an operating system the vendor stopped patching in June. The clinical team cannot replace it before the new year and the images are patient records…
control typesrisk treatmentcompensating controlresidual risk
A second access point on the third floor
ProAssisted · Quick · 6 min · SIEM queue
The wireless controller sees an access point broadcasting the corporate network name as an open network, strong enough to be inside the third floor meeting room…
rogue devicenetwork indicatorcontainmentcredential capture
A rule that forwards invoices to a lookalike domain
ProAssisted · Quick · 7 min · SIEM queue
The accounts payable lead clicked a sign in link in a message about an invoice batch. Twenty minutes later a mailbox rule forwards every message with the word invoice in it to an address…
business email compromiseidentity indicatormailbox ruleincident declaration
Choose where to cut a chain that already moved
ProAssisted · Quick · 7 min · SIEM queue
One workstation in accounts opened an invoice archive at 09:14. By 09:20 it was calling a host on a hosting range every minute…
cyber kill chaincontainment pointlateral movement
Finish the scorecard row before the board pack
ProAssisted · Quick · 7 min · Risk register and control sheets
The quarterly vulnerability scorecard goes to the board on Monday and one row is blank. The remote access appliance is two releases behind, sits on the internet, and carries 3,000 staff…
risk scorecardvulnerability reportingmetricsstakeholder communication
The backup catalog emptied before the encryption ran
ProAssisted · Quick · 7 min · SIEM queue
At 01:58 the backup service account removed catalog entries for 42 servers. The job that followed failed on 39 of them…
kill chainimpact stagebackup integritycontainment
An old indicator on a fresh alert
ProAssisted · Quick · 10 min · SIEM queue
A-534 matched a feed entry for 198.51.100.200. Decide if the feed still describes this address.
indicator of compromisethreat intelligence confidenceindicator agefalse positive
A decoy account just signed in
ProAssisted · Quick · 12 min · SIEM queue
A-531 reports a sign-in using svc-hr-archive, a decoy account with no legitimate users. Trace the external address to its next connection…
honeytoken detectionidentity investigationedge containment
Find the biggest upload with three searches
ProAssisted · Quick · 12 min · SIEM queue
The uplink saturated at 17:00. Find the largest upload to an external site, then check whether the destination and transfer match an approved month-end change before you judge the alert.
proxy log searchalert dispositionauthorized data transfer
Quarantine the lookalike invoice, keep the real one
ProAssisted · Quick · 12 min · SIEM queue
Ana Patel has two invoices in her mailbox. One came from a lookalike domain and points replies to that same domain. The second came from the real billing address…
email headerslookalike domainmessage quarantine
Release one quarantined laptop and hold the other
ProAssisted · Quick · 12 min · SIEM queue
Two quarantined laptops are waiting for release. The engineering owner says both are clean and asks IT to return them today. Check each host's release requirements…
containment releaseremediation checkslegal holdcase handoff
Two PowerShell alerts, one real
ProAssisted · Quick · 12 min · SIEM queue
At the 23:00 handover, two open alerts share the same PowerShell rule. One command line is encoded and runs on WS-ENG-031 under a user session…
alert triageliving off the landparent processtrue positive
Write the case note the morning shift can act on
ProAssisted · Quick · 12 min · SIEM queue
FS-02 was contained after ransomware encrypted its finance shares. At the 23:00 handover the case still has no analyst note. Record what happened, what containment was done…
incident handoffcase notesevent evidencecontainment status
A critical finding built on one version string
ProAssisted · Quick · 13 min · SIEM queue
The scanner rated V-201 critical on APP-INT-05 from a version banner. Check it before the ticket goes to the app team. The portal finding from the same scan belongs to its own owner.
banner grabbingvulnerability triageexploit validationfalse positive
Check the AI incident summary against evidence
ProAssisted · Quick · 13 min · SIEM queue
The SOC assistant summarized A-550 as “scheduled maintenance, no action.” A human signs off. Check the alert and endpoint evidence, correct the assistant's conclusion…
AI output verificationransomware indicatorsincident containmentcase evidence
Find a path traversal in the proxy log
ProAssisted · Quick · 13 min · SIEM queue
The customer portal recorded a burst of encoded file requests from one address. Most returned 404, but one request returned data. Confirm the successful response…
proxy log analysispath traversal detectiontargeted network containment
Find the silent log source and the skewed clock
ProAssisted · Quick · 13 min · SIEM queue
Mail alerts went quiet after 14:00, while WS-ENG-044's events appear two hours behind the rest of the environment. Find the missing source and the clock discrepancy…
centralized loggingsource healthclock synchronization
A service account signed in like a person
ProAssisted · Quick · 14 min · SIEM queue
A-533 reports svc-backup signing in interactively from WS-FIN-07 at 02:40. The account runs the nightly backup and the restore catalog, and two of its sessions are still active…
service account misuseidentity alert triagesession revocationsecret rotation
Close an update-driven alert storm but not the real one
ProAssisted · Quick · 14 min · SIEM queue
A detection rule began alerting on updsvc.exe after a vendor content update. Four signed installer copies look routine…
alert fatiguesoftware update behaviorfalse positive disposition
Contain a signed tool with a bad parent
ProAssisted · Quick · 14 min · SIEM queue
EDR raised A-526 on WS-ENG-022: rundll32.exe reached an external address after Microsoft Word launched it to load a DLL from the public user folder. The system tool is signed…
parent processcode signingnetwork containment
Identify the scanner probing the load balancer
ProAssisted · Quick · 14 min · SIEM queue
A-530 reports a probe of the load balancer login page. Only SCAN-01 (10.20.30.200) is approved to scan on Tuesdays. Identify who sent the request and what information the response revealed…
web bannerTCP flagsHTTP HEADauthorized scanning
Prove a workstation is beaconing to a young domain
ProAssisted · Quick · 14 min · SIEM queue
Alert A-521 reports repeated DNS requests from WS-ACCT-014 to a newly registered domain. Confirm whether the traffic is a beacon rather than routine browsing…
DNS beaconingTXT record queriespacket capture filtersthreat intelligence
Silence a noisy rule without hiding the real hit
ProAssisted · Quick · 14 min · SIEM queue
The backup rule pages the night shift every hour. Most of its matches are the scheduled agent on BACKUP-01 writing the catalog on time…
rule tuningalert fatiguedetection engineeringexception expiry
The playbook isolated the wrong host
ProAssisted · Quick · 14 min · SIEM queue
Auto-containment is wired to A-535, and its isolate step names WS-ACCT-021. The alert carries 10.20.30.21, and DHCP moved that lease to WS-ENG-031 at 21:00, ten minutes before the alert…
SOAR playbookcontainment automationDHCP leaserelease from isolation
Contain a credential dump without taking the DC down
ProAssisted · Quick · 15 min · SIEM queue
A-524: procdump.exe read lsass on DC-01 at 02:09 under a.oyelaran and wrote lsass.dmp to the public user folder. Everyone signs in through that server…
credential dumpingprocess terminationsession revocationescalation with a reason
Put the patch queue in order and park one risk
ProAssisted · Quick · 15 min · SIEM queue
Five findings are open. Fix order is by exploitation and exposure, not score alone. One finding cannot be patched this quarter.
vulnerability prioritizationactive exploitationasset exposurerisk exception
The travel alert that hid a mailbox rule
ProAssisted · In-depth · 32 min · SIEM queue
Three alerts land before the morning standup. One says a support agent logged on from two cities six thousand kilometres apart, which the identity team wants closed as travel noise…
impossible travelVPN egressbusiness email compromisemailbox forwarding rule
Two alerts at handover, one answer each
ProChallenge · Quick · 8 min · SIEM queue
Two alerts are open at shift handover. A warehouse tablet talks to the same address every 61 seconds with a fixed delay between calls, and that address appears on a public feed as a relay…
beaconingtrue positivefalse positiveasset context
A clean hash and a dirty memory read
ProChallenge · Quick · 9 min · SIEM queue
A feed pushed a hash this morning that matches a file on two application servers. The same hash appears in the platform team build manifest, from a release six weeks ago…
indicator typepyramid of painbehavioural detectionhunting
Three alerts, one incident, one recovery path
ProChallenge · Quick · 9 min · SIEM queue
Three alerts landed between 03:00 and 03:12. One workstation beacons to a hosting address, a second sensor reports the same workstation a minute later…
incident analysisalert deduplicationcontainment scoperecovery
The vendor tunnel that outlived its change
ProChallenge · In-depth · 25 min · SIEM queue
A-539 reports traffic arriving through a vendor tunnel. The change that opened the tunnel ended on 10 September…
firewall log reviewremote access change windowsvendor accesscontainment without service loss
Two alerts at handover, one answer each
ProChallenge · In-depth · 25 min · SIEM queue
Two alerts are open at the 23:00 handover. A-521 says WS-ACCT-014 keeps asking for one young domain, and A-536 says j.ibrahim signed in from a new country. One of the two is real…
DNS beaconingshared VPN gateway addressestravel noticeverdict and disposition
The travel alert that hid a mailbox rule
ProChallenge · In-depth · 26 min · SIEM queue
A-537 says a.oyelaran signed in from a new country. HR says she is travelling, so the sign-in alone is easy to close. Before you do…
mailbox forwarding rulescloud audit eventstravel exceptionsblock scope at the mail gateway
Hunt the task name, not the hash
ProChallenge · In-depth · 28 min · SIEM queue
A-538 found a scheduled task called UpdateCheck-Sync on WS-ENG-011. The binary hash differs on every host, so a hash search finds one machine and stops…
scheduled task persistencebehavioural huntingfile hashes as weak pivotschange records
The vendor tunnel that outlived its change
ProChallenge · In-depth · 32 min · SIEM queue
A remote support tunnel ran from the vendor jump host on Thursday night. There is a change record for that tunnel, and it closed five days earlier. Six entries sit in the queue: the tunnel…
unauthorised remote accesschange window expirylocal account creationindicator age and relevance
Hunt the task name, not the hash
ProCapstone · In-depth · 38 min · SIEM queue
The weekly intel note describes a shape rather than a file: a scheduled task with an ordinary name, a signed administration tool copying a script into a startup folder…
behavioural indicatorthreat huntingscope expansionshared infrastructure
Three alerts, one incident, one recovery path
ProCapstone · In-depth · 40 min · SIEM queue
Three critical and high alerts landed inside twenty minutes: the backup catalog was deleted, a credential dump ran on the domain controller, and files are being encrypted on FS-02…
alert correlationcontainment decisionschain of eventsrecovery planning
Where to go next
Every certification with labsCS0-004 lab questions
There are 41 labs: 5 guided, 26 assisted, 8 challenge, 2 capstone. Together they carry about 10 hours of authored lab time, and none of them is a free taster yet.
Practise CS0-004 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.