Practice Free CS0-004 CompTIA Cybersecurity Analyst CySA+ V4 (New Version) Exam Questions Answers With Explanation

Mean time to close is the most relevant measurement because the manager needs to quantify how long cases or incidents remain open before all required closure activities—including after-action documentation—are completed.

An incident may already be technically contained and remediated while administrative closure remains outstanding. Mean time to remediate measures how long it takes to correct or neutralize the security problem, but it does not necessarily include final reporting and formal case closure. Mean time to respond measures how quickly responders begin or perform response activity after detection. Mean time between failures is primarily a reliability metric describing the average operating duration between failures and does not measure SOC reporting performance.

Current Microsoft Sentinel SOC guidance explicitly includes mean time to closure and time-to-closure percentiles among incident-management metrics used to evaluate SOC performance. This directly maps to the manager's concern: if after-action reports delay completion of incidents, the organization's mean closure time will increase and can be trended by analyst, severity, team, or incident category.

Therefore, B provides the quantitative evidence needed to determine whether after-action reporting is preventing incidents from being closed promptly.

Study Guide Reference: Reporting and Communication ? Incident Metrics ? Mean Time to Close ? After-Action Reporting ? SOC Performance Measurement ? Continuous Improvement.

AI usage policies establish organizational boundaries for how artificial intelligence systems may be selected, accessed, configured, and used. They allow an organization to obtain operational benefits from AI while controlling risks involving confidential information, intellectual property, regulated data, model outputs, external AI services, and inappropriate automation. A strong policy can define approved platforms, prohibited data categories, validation requirements, human oversight, retention rules, acceptable use, and escalation procedures.

Prompt engineering is a technical method for constructing inputs that produce more useful model responses. It can improve output quality but does not establish enterprise-wide safeguards for protecting business objectives or sensitive information. A non-disclosure agreement establishes contractual confidentiality obligations between parties; it cannot govern the full technical and operational use of AI systems. An incident response policy determines how security incidents are managed and escalated, but it is reactive and not designed to establish routine AI governance.

CS0-004 explicitly addresses AI within Security Operations. The objectives identify AI risks including hallucinations, data exposure, model poisoning, and malicious prompts and identify governance considerations including legal or regulatory compliance and AI usage policies . AI use cases include log analysis, artifact comparison, incident investigation, event correlation, and automation.

Study Guide Reference: Security Operations ? AI in Security Operations ? AI Risks ? Governance ? AI Usage Policies ? Data Protection.

A SIEM alert is an indication requiring validation; it is not automatically a confirmed security incident. The analyst must therefore begin with triage . Triage establishes whether the activity is legitimate or malicious, determines the affected systems or accounts, evaluates severity and business impact, and establishes the appropriate investigative and escalation path.

Typical triage activities include reviewing the underlying events, checking source and destination information, identifying affected assets, correlating supporting telemetry, evaluating detection confidence, examining threat intelligence, and determining whether the alert represents a true positive. Only after this assessment can the incident be assigned an appropriate priority and routed to the correct responders.

Contacting an incident coordinator before establishing whether the alert represents meaningful risk may create unnecessary escalation. Recovery activities occur substantially later, after detection, analysis, containment, and eradication activities have established what happened and controlled the threat. Escalating directly to the help desk is similarly premature and may be inappropriate for a security event.

NIST's current incident-response model places detection and analysis before response and recovery actions and emphasizes determining event characteristics so appropriate response actions can follow.

Study Guide Reference: Incident Response and Management ? Detection ? Alert Validation ? Triage ? Analysis ? Severity Determination ? Escalation.

Tactics, techniques, and procedures (TTPs) occupy the highest level of the Pyramid of Pain because they represent the adversary's operational behavior rather than disposable technical artifacts. The model describes how different types of defensive indicators impose progressively greater disruption on an attacker when defenders successfully detect and deny them.

An IP address is comparatively easy to replace by changing hosting infrastructure, using a proxy, acquiring a new virtual server, or moving command-and-control services. Domain names similarly can be registered or replaced with relatively limited operational impact. Tools create greater difficulty because replacing or substantially modifying malware, frameworks, or utilities requires more attacker effort.

TTPs are significantly more costly to change because they encompass how the adversary conducts operations : the sequence and methods used for initial access, persistence, credential access, privilege escalation, lateral movement, command and control, and other objectives. Forcing attackers to change established behavior may require retraining personnel, redesigning operational processes, developing new capabilities, or adopting unfamiliar techniques.

This is why behavioral detection is strategically valuable. Indicators such as hashes and IP addresses may disappear quickly, while detections focused on adversary behavior can remain useful across multiple toolsets and infrastructure changes.

Study Guide Reference: Security Operations ? Threat Intelligence ? Pyramid of Pain ? TTPs ? Behavioral Indicators ? Adversary Tracking.

The ZAP finding concerns information disclosure through the HTTP Server response header , so the correct remediation is to suppress or minimize that header while leaving the website operational. OWASP ZAP maintains specific alerts for servers that disclose the web-server application or version through this response field. The version-disclosure rule is categorized as information exposure because detailed server identification can assist reconnaissance and vulnerability targeting.

Removing unnecessary product and version information reduces information available to an attacker without interrupting legitimate HTTP requests. This directly satisfies the requirement to remediate the finding while maintaining service availability.

Geo-blocking does not correct server-version disclosure and may unnecessarily deny legitimate users based on location. OCSP stapling relates to certificate-revocation status in TLS and is irrelevant to an HTTP server-header disclosure. Blocking incoming HTTP entirely would make the current endpoint unavailable, contradicting the requirement to keep the site operational.

The remediation principle is therefore minimize externally exposed implementation details while preserving application functionality . Server banners are not themselves an exploit, but they can improve an attacker's ability to fingerprint technology and select applicable exploits.

Study Guide Reference: Vulnerability Management ? Web Application Scanning ? OWASP ZAP ? Information Disclosure ? HTTP Server Headers ? Banner Suppression ? Secure Configuration.

The analyst should prioritize 10.203.10.11 because the scan output identifies that host as presenting the Windows SMB exposure relevant to the critical vulnerability. Vulnerability prioritization requires matching the vulnerability's technical prerequisites against the characteristics discovered on each host rather than simply patching every responding system indiscriminately.

Modern SMB services commonly use TCP port 445 . Microsoft documents TCP 445 as a required port for SMB-based file services, with port 139 associated with older NetBIOS-based implementations. Therefore, a Windows host exposing the affected SMB service satisfies an essential condition for applicability and should be prioritized when the vulnerability specifically targets open SMB ports.

The -Pn option is also significant operationally because it instructs Nmap to treat targets as online without relying on normal host-discovery probes. The analyst can consequently inspect reachable service ports even when systems do not respond to standard discovery methods.

The remaining hosts either do not expose the vulnerable SMB service or do not match the required Windows/service profile described by the scenario. Priority should follow confirmed applicability, exposure, severity, and exploitability.

Study Guide Reference: Vulnerability Management ? Nmap ? Port Scanning ? SMB ? TCP 445/139 ? Vulnerability Applicability ? Remediation Prioritization.

A comprehensive asset inventory is required because the discrepancy demonstrates that the organization lacks a reliable common understanding of which systems actually exist and should be covered by vulnerability and patch-management processes. Effective vulnerability management begins with asset discovery and inventory. Without accurate asset records, teams cannot determine whether missing systems represent decommissioned devices, unmanaged assets, duplicate IP addresses, dynamic addressing, scanning gaps, or endpoints that are not enrolled in the patch platform.

Reconciliation with the infrastructure team allows the organization to establish authoritative records for hostnames, IP addresses, operating systems, ownership, business function, physical or cloud location, patching status, and vulnerability-scanner coverage. Once that inventory exists, each security tool can be compared against the same source of truth.

Verbose scanner logging might explain specific scanning failures but cannot resolve discrepancies caused by unknown or unmanaged assets. Rebuilding report filters risks masking the real coverage problem. Rerunning patch deployment does not help when the organization has not established which assets should be receiving patches.

The governing principle is simple: an organization cannot reliably assess or patch assets it has not accurately inventoried .

Study Guide Reference: Vulnerability Management ? Asset Discovery ? Asset Inventory ? Vulnerability Scanner Coverage ? Patch Management ? CMDB/Reconciliation ? Shadow and Unmanaged Assets.

PRODWEB-01 represents the highest remediation priority because vulnerability prioritization should combine asset value, vulnerability risk, and exploitation likelihood , rather than relying on severity alone. A production web server is typically more exposed and operationally significant than a development endpoint, and the correlated CMDB information provides the business context required to determine whether exploitation would materially affect organizational operations.

A mature vulnerability-management process evaluates technical severity together with internet exposure, business criticality, existing controls, active exploitation, threat intelligence, and the availability of remediation. CISA specifically recommends using known exploitation evidence as an input into vulnerability prioritization and provides risk-based methodologies such as SSVC for determining appropriate response actions.

This explains why simply choosing the system with the numerically highest isolated vulnerability score would be inadequate. DEVWIN11-01, for example, may contain significant findings but carries lower production value. A control-system asset may have high business importance but can present different exposure and exploitability conditions. The correlated attributes associated with PRODWEB-01 establish the strongest combined risk.

Study Guide Reference: Vulnerability Management ? Vulnerability Prioritization ? Asset Criticality ? Exploitability ? Threat Intelligence ? CMDB Context ? Risk-Based Remediation.

Reimaging the disk is a recovery activity because it restores the compromised endpoint to a trusted operational state after malicious activity has been identified and contained. Reimaging replaces the affected operating environment with a known-good system image, removing uncertainty about hidden persistence mechanisms, modified system files, unauthorized software, or other residual effects of compromise.

Verification that malicious activity occurred belongs to the detection and analysis stage. Taking the system offline is a containment measure intended to prevent additional propagation, command-and-control communication, or damage. Writing the final report occurs during post-incident documentation and lessons-learned activities rather than operational restoration.

NIST's Recover function focuses on restoring affected assets and operations and verifying that restored systems are suitable for return to normal business use. A clean reimage is particularly appropriate where the integrity of the compromised operating system cannot be reliably established through selective malware removal.

After rebuilding, analysts should verify configuration, patch levels, security controls, credentials, and monitoring before reconnecting the machine to production.

Study Guide Reference: Incident Response and Management ? Recovery ? Reimaging ? Known-Good Baselines ? Restoration Validation ? Return to Production.

The scan results identify two systems exposing services that permit communications without transport encryption, making B the correct count. The analyst must examine each discovered service rather than merely count open ports, because the security property being evaluated is whether the identified protocol transmits its session or application data without adequate encryption.

Common examples include HTTP instead of HTTPS, Telnet instead of SSH, and legacy FTP rather than protected file-transfer alternatives. The presence of an unencrypted service does not automatically prove that sensitive information is currently being transmitted, but it identifies a configuration that can expose credentials, commands, session content, or application data to interception when used.

The correct vulnerability-management workflow is to map discovered ports to services, determine the security characteristics of those protocols, verify whether encryption is available and enforced, and then prioritize remediation according to asset exposure and business requirements. Where possible, administrators should disable unnecessary cleartext services or replace them with cryptographically protected equivalents.

This question therefore tests interpretation of vulnerability or port-scan output , not simple arithmetic. The two affected systems are those whose discovered services permit cleartext communications.

Study Guide Reference: Vulnerability Management ? Scan Result Interpretation ? Ports and Protocols ? Cleartext Services ? Encryption in Transit ? Remediation and Secure Configuration.

Option D applies the correct packet-filtering logic to isolate DNS-related traffic associated with the suspected server . The -r suspicious.pcap option directs tcpdump to read packets from the existing PCAP rather than capture live traffic. The expression port 53 and host 10.213.4.27 then limits output to packets involving the specified system and DNS's conventional port 53.

This is directly relevant to suspected DNS exfiltration. Attackers can encode data within DNS queries or responses, including unusually long subdomains or other manipulated DNS fields. Isolating the target's port 53 traffic dramatically reduces the dataset and allows the analyst to examine relevant queries and responses for encoded or anomalous information.

strings suspicious.pcap | grep treats the capture primarily as raw printable data and does not accurately perform protocol-aware packet filtering. The Zeek option searches file.log, which is focused on files observed in network traffic and is not the most direct location for DNS-query analysis. The Snort syntax shown is also inappropriate for the required extraction workflow.

The essential skill is translating an investigative hypothesis— possible DNS exfiltration by a known host —into a precise PCAP filter.

Study Guide Reference: Security Operations ? Network Traffic Analysis ? Full Packet Capture ? tcpdump ? BPF Filters ? DNS Analysis ? Data Exfiltration Detection.

Encryption at rest primarily protects the confidentiality of stored information when an unauthorized party obtains physical or logical access to the storage medium. This is particularly important for laptops because portable devices can be lost or stolen, giving an attacker possession of the disk outside the organization's normal network and endpoint protections.

NIST guidance on storage encryption specifically addresses laptops and other end-user devices and explains that storage encryption combines encryption and authentication to restrict unauthorized access to stored information. NIST further notes that threats involving lost or stolen end-user devices can expose information to unauthorized parties.

Encryption does not inherently prevent an authenticated and authorized user from copying information while the system is unlocked; data loss prevention controls are more directly suited to that objective. Regulatory requirements may mandate encryption in some environments, but compliance is an external requirement rather than the fundamental security reason encryption at rest exists. Option D confuses confidentiality with integrity and network protection. Encryption of data stored on a laptop is not primarily intended to validate whether network data has been modified.

The examination concept is the CIA triad: encryption primarily supports confidentiality , especially when physical possession of the storage device is lost.

Study Guide Reference: Security Operations ? Data Protection ? Encryption at Rest ? Full-Disk Encryption ? Confidentiality ? Lost/Stolen Endpoint Protection.

Improving the triage process addresses the underlying operational bottleneck described in the scenario. SOC triage determines which alerts require investigation, their relative severity, whether they represent true or false positives, and which cases require escalation. When triage is inefficient, alerts accumulate faster than analysts can classify them, causing backlog growth and SLA violations.

A mature triage workflow applies consistent severity criteria, asset criticality, threat context, confidence levels, enrichment, deduplication, and predefined escalation thresholds. This reduces analyst effort spent on low-value events while ensuring genuinely dangerous alerts reach investigators quickly. Modern SIEM and security analytics platforms similarly emphasize grouping and correlating alerts into incidents to reduce unnecessary investigation workload. Microsoft Sentinel, for example, uses analytics and correlation to reduce noise and consolidate related alerts into incidents.

Automating escalation does not resolve poor initial classification and can simply transfer excessive noise downstream. Better threat intelligence may enrich alerts but will not inherently correct a dysfunctional queue. Customer-service response is unrelated to SOC alert processing.

Study Guide Reference: Security Operations ? SOC Operations ? Alert Management ? Triage ? Prioritization ? Escalation Procedures ? Process Improvement.

The attacker is attempting lateral movement because an already compromised identity is being used to move from one cloud environment or subscription into another. Lateral movement describes adversary activity intended to reach additional systems, services, accounts, or resources after an initial foothold has been established.

MITRE ATT & CK specifically includes cloud-oriented lateral movement. Its Lateral Movement tactic documents adversaries using valid accounts to access additional cloud services and resources within compromised environments. MITRE also documents cloud-role manipulation that may enable movement into additional accounts, demonstrating how identity and role relationships can become lateral-movement pathways in cloud architectures.

Privilege escalation would apply if the attacker were primarily attempting to obtain greater permissions within the current security context. Persistence concerns maintaining long-term access. Execution concerns running malicious code or commands. Credential access involves obtaining credentials or authentication material.

In this scenario, the attacker already possesses a compromised user role. The objective is to use that existing access to traverse a trust boundary and reach another isolated subscription. That movement between security domains is the decisive indicator of the Lateral Movement tactic.

Study Guide Reference: Security Operations ? MITRE ATT & CK ? Lateral Movement ? Cloud Services ? Valid Accounts ? IAM Roles ? Cross-Subscription Access.

The correct remediation is to integrate a secrets-management solution and remove credentials from application source code. Hard-coded passwords, API keys, access tokens, certificates, and similar secrets create serious exposure because anyone who obtains the source repository, package, build artifact, backup, or configuration may recover the credential.

OWASP specifically identifies hard-coded secrets in source code and configuration files as a secrets-management problem and recommends centralized controls for securely storing, retrieving, rotating, auditing, and managing secrets throughout their lifecycle.

A secrets-management platform allows applications to retrieve sensitive values securely during execution instead of embedding them directly in code. Proper implementation also supports rotation and revocation when credentials are exposed.

PAM primarily governs privileged human or service access and is not the most direct application-code remediation. Single sign-on reduces repeated user authentication but does not remove embedded application credentials. Obfuscation is inadequate because an application that needs an API key must ultimately be capable of recovering and using it; attackers can often reverse that transformation.

The correct secure-development principle is therefore separation of secrets from application code .

Study Guide Reference: Vulnerability Management ? SAST ? Hard-Coded Credentials ? Secrets Management ? API Keys ? Credential Rotation ? Secure Software Development.

An after-action report (AAR) is the most comprehensive document associated with a closed incident because it consolidates the incident itself, the response activities performed, recovery actions, outcomes, deficiencies, and lessons identified during the event. NIST Cybersecurity Framework guidance specifically calls for preparing an after-action report that documents the incident, response and recovery activities, and lessons learned.

A lessons-learned document focuses primarily on what worked, what failed, and what should be improved. Those observations are important, but they represent only one component of a complete post-incident record. Root cause analysis has a narrower technical purpose: determining the fundamental condition that permitted the incident to occur or progress. A situation report is generally produced while an incident is ongoing to communicate current status, impact, actions, and outstanding issues.

An AAR is broader because it can incorporate the timeline, technical findings, containment and eradication actions, recovery results, stakeholder performance, root cause, lessons learned, and assigned corrective actions. NIST exercise guidance likewise treats lessons learned as information that becomes part of an after-action report.

Study Guide Reference: Reporting and Communication ? Post-Incident Reporting ? After-Action Reports ? Lessons Learned ? Root Cause Analysis ? Corrective Actions.

The analyst should first establish a legal hold because the suspected breach involves personnel records and evidence that may become relevant to regulatory, disciplinary, civil, or other legal proceedings. A legal hold prevents potentially relevant information from being deleted, overwritten, modified, rotated out under normal retention schedules, or otherwise destroyed before the organization's legal and investigative obligations are understood.

Preservation must precede destructive or potentially evidence-altering actions. NIST describes digital forensics as retrieving, storing, and analyzing electronic information while ensuring that evidence is captured reliably without alteration. RFC 3227 similarly emphasizes preserving evidence, following proper collection procedures, documenting handling, and maintaining chain of custody.

Log correlation and timeline construction are important investigative activities, but they should occur after preservation requirements have been established. Resetting credentials may subsequently be required for containment, but the scenario first raises an evidence-preservation obligation. Restoring files from backup would be especially premature because it could alter timestamps, overwrite artifacts, or otherwise complicate forensic analysis.

The examination principle is therefore preserve first when legal implications are reasonably foreseeable; analyze and remediate afterward under controlled procedures .

Study Guide Reference: Incident Response and Management ? Evidence Acquisition ? Legal Hold ? Evidence Preservation ? Chain of Custody ? Timeline Analysis ? Regulatory/Legal Considerations.

The activity is consistent with Virtual Network Computing (VNC) remote-control sessions. VNC provides interactive graphical access to another computer, which can manifest to the local user as unexpected mouse movement, windows opening, applications launching, or terminal sessions appearing without direct user interaction.

The network evidence distinguishes VNC from the other possibilities. Nmap's official VNC detection documentation demonstrates VNC services operating on TCP port 5900 and provides NSE functionality for querying VNC protocol versions and supported security mechanisms. When traffic logs show connections consistent with VNC services and users simultaneously observe visible remote desktop activity, VNC is the strongest correlation.

An internally addressable source address establishes only where traffic originated; it does not explain interactive mouse and keyboard activity. A reverse tunnel can provide an attacker with connectivity through network restrictions, but the tunnel itself does not identify the remote-control protocol responsible for the graphical symptoms. RDP can also provide interactive remote access, but it uses a different protocol and service profile; the traffic evidence in the scenario aligns with VNC instead.

An analyst should therefore correlate endpoint symptoms with network protocol and port evidence , rather than diagnosing remote access solely from visible user-interface behavior.

Study Guide Reference: Security Operations ? Network Traffic Analysis ? Remote Access ? VNC ? RDP ? Ports/Protocols ? Indicators of Unauthorized Remote Control.

Software Composition Analysis (SCA) is specifically designed to identify third-party and open-source components incorporated into software. It can enumerate libraries and dependencies, identify their versions, associate components with known vulnerabilities, and provide licensing information. This directly satisfies the legal team's requirement to determine whether the codebase contains open-source or commercially licensed libraries.

CISA's software supply-chain guidance recognizes software composition analysis and software bills of materials as mechanisms for obtaining visibility into software components. CISA guidance also notes that SBOM information can include both open-source and commercial third-party software and licensing information.

SAST examines source or compiled code for security weaknesses such as unsafe functions, data-flow problems, or coding vulnerabilities, but dependency licensing is not its primary purpose. DAST tests a running application from the outside and generally cannot inventory the complete component dependency tree. RASP operates within a running application to detect or prevent attacks. Credentialed infrastructure scanning identifies system-level vulnerabilities and configuration issues rather than software-license composition.

The strongest clue is the requirement to identify libraries and their licensing status , which directly maps to SCA.

Study Guide Reference: Vulnerability Management ? Application Security Testing ? SCA ? Third-Party Components ? Open-Source Dependencies ? SBOM ? Licensing and Vulnerability Analysis.