CompTIA CySA + CS0-004 (V4) Exam (New Version) Practice Test 1

The Exploit Prediction Scoring System estimates the probability a vulnerability will be exploited in the wild within a given timeframe, exactly the dimension CVSS does not capture on its own. CVSS scores severity and impact characteristics, while SLA, KPI, and SBOM are unrelated to exploit likelihood.

These four metrics measure different stages of the detection and response lifecycle. MTTD measures how quickly a compromise is discovered, MTTR measures how quickly the team acts once detected, mean time to remediate measures how long full resolution takes, and false-positive rate measures alert quality rather than speed.

The legal team determines regulatory obligations and mandated timeframes for breach notification, providing the guardrails that shape when and how the organization must report. Public relations handles public messaging, law enforcement handles criminal investigation, IT operations focuses on technical remediation, and customers are a notification target rather than the group determining legal obligations.

A risk scorecard aggregates and visualizes risk posture and trends across the organization in a format suited to executive and board-level reporting. A raw vulnerability scan report is too granular for this audience, an SLA defines expected service performance rather than risk trends, a compliance finding documents a specific gap, and an action plan tracks remediation steps rather than overall posture.

Business process interruption describes situations where applying a fix would disrupt an active, revenue-generating operation, exactly as described with the production system that cannot go offline. Legacy and proprietary systems refer to outdated or vendor-locked technology, contractual agreements involve third-party obligations, and patch availability refers to whether a fix even exists, none of which match the operational downtime concern here.

Root cause analysis and corrective action development both happen in the post-incident phase, where the team determines why the incident occurred and defines changes to prevent recurrence. Isolating affected targets and evidence gathering happen earlier during containment and analysis, and timeline establishment happens during analysis rather than after the incident is closed.

Once command-and-control activity is confirmed, isolating the affected host limits further damage and prevents lateral movement while the investigation continues. Root cause analysis and the executive summary come later in the process, releasing from isolation happens only after remediation is verified, and updating the communication plan is a longer-term administrative task rather than an immediate containment action.

Log augmentation and enrichment adds external context, such as threat intelligence or asset ownership data, to a raw log entry so analysts have more to work with before deciding how to respond. Log correlation instead links multiple related log entries together, timeline establishment sequences events chronologically, root cause analysis happens after the incident, and triage is the decision step that typically follows enrichment.

Chain of custody documents who handled evidence, when, and under what conditions, at every step from collection to analysis, which is essential if the evidence is later used in legal or disciplinary proceedings. Integrity validation and preservation support the broader chain of custody process, a legal hold prevents deletion of relevant data, and escalation is about notifying the right people, none of which alone cover the full handoff requirement.

The full sequence runs preparation, detection, analysis, containment, eradication, recovery, and post-incident, so detection is the second phase, containment the fourth, eradication the fifth, and recovery the sixth. Skipping or reordering these phases, such as eradicating before properly containing, risks letting the threat persist or spread further.

The Diamond Model explicitly maps the four core features of an intrusion, adversary, capability, infrastructure, and victim, and the relationships between them. The Cyber Kill Chain models sequential attack stages instead, MITRE ATT&CK catalogs specific techniques, STRIDE is used for threat modeling software, and the Pyramid of Pain ranks indicator value.

Administrative controls are policies and training, physical controls are tangible barriers like badge readers, and technical controls are enforced through technology such as firewall rules and automated session timeouts, which is why two of the four examples here map to the technical category.

When no patch is available, a documented exception paired with a compensating control such as segmentation or added monitoring is the standard way to manage residual risk formally rather than leaving it untracked. Ignoring the finding or waiting indefinitely leaves risk unmanaged, and decommissioning a business-critical application is rarely a proportionate first response.

Time synchronization, typically via NTP, keeps clocks aligned across disparate systems so timestamps can be trusted for correlation and timeline reconstruction. Retention controls how long logs are kept, integrity hashing protects against tampering, and ingestion or configuration govern how logs are collected, none of which fix clock drift between hosts.

Burp Suite operates as an intercepting proxy, letting an analyst capture, modify, and replay individual HTTP requests for hands-on manual testing. Nikto is primarily an automated web server scanner, OpenVAS and Nessus are general-purpose vulnerability scanners, and Masscan is built for high-speed port scanning rather than manipulating application traffic.

Passive scanning observes existing network traffic to infer device and vulnerability information without injecting packets, avoiding the risk of disrupting sensitive ICS equipment. Active scanning sends probes that could destabilize fragile devices, agent-based and credentialed scanning both require software or logins on each host, and baseline scanning checks configuration against a standard rather than avoiding network impact.

Credentialed scanning logs into the target with valid credentials, letting the scanner inspect patches, configurations, and local vulnerabilities far more deeply than an unauthenticated view. Non-credentialed and external scans only see what is exposed on the network, and discovery scanning finds devices rather than assessing vulnerabilities.

Hallucination occurs when a model generates confident, plausible-sounding output not actually supported by its input data, exactly as described here. Data exposure involves the model leaking sensitive information, model poisoning involves an attacker corrupting training data, and a malicious prompt is an input crafted to manipulate model behavior, none of which match a fabricated fact in output.

IoCs are commonly classified as atomic, a single discrete value like an IP address or hash, or behavioral, a pattern of activity such as a sequence of process executions. Structural, predictive, and categorical are not recognized IoC classification types in this framework.

The Pyramid of Pain ranks indicator types by how much cost they impose on an adversary when defenders act on them, with TTPs at the top being hardest to change and hashes at the bottom being trivial to change. MITRE ATT&CK catalogs adversary techniques, the Diamond Model maps relationships between adversary, capability, infrastructure, and victim, and STRIDE is a threat modeling framework, none of which rank indicators by attacker cost.

YARA is purpose-built for writing and applying pattern-matching rules that identify malware families by their strings and byte sequences. Tools like Wireshark or tcpdump analyze network traffic rather than static files, so they do not fit this use case.

tcpdump is a lightweight, command-line packet capture tool well suited to headless Linux servers, which makes it the right fit here. Wireshark performs similar analysis but is primarily a GUI tool, CyberChef decodes and transforms data rather than capturing packets, YARA matches file patterns, and MXToolbox analyzes email and DNS records.

Impossible travel flags authentications from geographically distant locations in a window too short for actual travel, suggesting credential compromise or account sharing. Enumeration involves systematically probing for valid accounts or resources, typosquatting is a domain-based social engineering technique, and the other options describe unrelated attack patterns.

certutil.exe is a legitimate, signed Windows binary that attackers commonly repurpose to download or decode payloads, which is the definition of a LOLBin. The activity described is inbound retrieval rather than data leaving the host, it is not a new device on the network, and it is not a configuration change or a performance issue.

Secrets management stores and injects credentials like database passwords at runtime from a secure vault rather than embedding them in code or scripts. PAM controls elevated account access, MFA and SSO govern how users authenticate, and RBAC controls what an authenticated user can do, none of which stop a credential from being hardcoded into source in the first place.