CompTIA CySA + CS0-004 (V4) Exam (New Version) Practice Test 2

Finding A illustrates active exploitation and threat intelligence, since a known exploit is actively in use, while Finding B illustrates asset value, since the system holds highly sensitive data. Patch availability concerns whether a fix exists, true positive rate concerns detection accuracy, and scoring methods refer to systems like CVSS rather than these specific criteria.

The after action report formally documents the full incident record, lessons learned captures process improvement discussion, root cause analysis identifies why the incident happened, and shift or incident handover ensures continuity when responsibility transfers between teams.

An executive summary distills an incident into a concise, non-technical overview tailored for leadership consumption. An after action report and root cause analysis document are typically more detailed and technical, an internal threat intelligence report focuses on adversary context, and shift handover notes are operational rather than executive-facing.

The requirement to escalate to the CISO if a deadline is missed describes escalation, while the reliance on another team's unrelated work first describes a dependency. Risk appetite concerns organizational risk tolerance broadly, SLA defines expected performance, and stakeholder identification names who needs to be informed.

Compliance findings specifically document gaps against a named standard such as PCI DSS. A general vulnerability scan report covers all discovered issues regardless of framework, a risk scorecard summarizes overall risk trends, an action plan tracks remediation steps, and metrics/KPIs measure program performance rather than compliance status.

Determining severity and impact, and prioritizing based on business criticality and scope, are exactly the factors that separate a low-impact test server incident from a production payment system compromise or a spreading ransomware event. Establishment of a timeline and chain of custody are evidentiary activities for deeper investigation, and post-incident reporting happens after resolution.

Triage is the quick initial assessment of an alert's severity and urgency to decide how it should be handled next. Root cause analysis and post-incident reporting happen much later, establishing a timeline is a more detailed reconstruction step, and evidence gathering is a distinct forensic activity.

A tabletop exercise walks stakeholders through a hypothetical scenario verbally without executing real technical actions. A simulation involves participants taking real actions in a controlled environment, and penetration tests, red team engagements, and live-fire drills all involve executing technical actions rather than only discussion.

The first document describing triage and remediation is the incident response plan, while the second describing media and customer communication is the communication plan. A playbook or runbook would detail specific technical procedures, and the other pairs describe different scopes of documentation entirely.

Preparation is the phase where an organization builds the plans, tools, and trained personnel needed to respond effectively before an incident occurs. Detection and analysis happen once suspicious activity is identified, containment happens during an active incident, and post-incident work happens after resolution.

The Diamond Model explicitly maps the four core features of an intrusion and the relationships between them. The Cyber Kill Chain models sequential attack stages instead, MITRE ATT&CK catalogs specific techniques, STRIDE is for threat modeling software, and the Pyramid of Pain ranks indicator value.

Transferring risk shifts financial impact to a third party such as an insurer, avoiding risk eliminates the risky activity altogether, mitigating risk reduces likelihood or impact through controls, and accepting risk formally acknowledges a finding within tolerance without further action.

Context awareness considers the environment a vulnerable asset sits in, adjusting prioritization since an isolated system carries much lower real-world risk despite a high raw score. Scoring methods produce the base severity without this context, validation of remediation happens after a fix, and secure coding or patch management are mitigation actions rather than prioritization factors.

Log retention defines how long logs stay retrievable, so extending it closes the gap between the 90-day default and the 18-month requirement. Time synchronization aligns clocks, ingestion governs collection, integrity protects against tampering, and configuration governs what is recorded, none of which control storage duration.

Nmap is the standard tool for port scanning and service or version enumeration during reconnaissance. Metasploit Framework develops and executes exploits, Maltego maps open-source intelligence relationships, Recon-ng is a web-based reconnaissance framework, and Burp Suite targets web application traffic.

Discovery scanning, including mapping scans and device fingerprinting, identifies live hosts and their OS or services as a precursor to deeper assessment. Security baseline scanning checks configuration against a standard, credentialed scanning requires logging in, passive scanning avoids sending probes, and agentless scanning describes a deployment model.

An accurate asset inventory is the foundation of vulnerability management; without knowing what assets exist, scans cannot be scoped to cover them regardless of scan type or configuration. Credentialed scanning improves the depth of results on known assets, discovery and passive scanning can help find devices but are tactics rather than the foundational inventory itself, and baseline scanning checks configuration rather than asset coverage.

SOAR platforms automate and orchestrate repetitive, multi-step analyst workflows like phishing triage. A SIEM correlates logs but does not itself orchestrate response workflows, IaC automates infrastructure provisioning, UEBA focuses on behavioral analytics, and a vulnerability scanner identifies weaknesses rather than automating response.

A well-resourced, stealthy group maintaining long-term access matches the definition of an advanced persistent threat, while an employee misusing legitimate access from within is a textbook insider threat. Hacktivists are typically ideologically motivated, script kiddies use unsophisticated pre-built tools, and competitor is not a formal threat actor category here.

XDR extends beyond a single endpoint's telemetry to correlate data across endpoints, email, cloud, and other sources into a unified view. MDM manages device configuration, EDR is scoped to endpoint telemetry alone, SIEM aggregates logs broadly without being endpoint-focused, and UEBA focuses specifically on behavioral analytics.

MISP is designed as a self-hosted platform for storing, correlating, and sharing structured threat intelligence, including with trusted partner communities. OTX is a public community feed rather than self-hosted, VirusTotal analyzes files and URLs, CyberChef transforms data, and Recon-ng is a reconnaissance framework.

The combination of an unauthorized policy change exposing data publicly and a spike in outbound transfer strongly suggests the resource has been compromised and is being used to exfiltrate data. Unauthorized configuration alone would not explain the traffic spike, and the remaining options describe unrelated attack categories.

The unauthorized access point is a rogue device connected without approval, while the systematic SNMP sweep across a subnet is enumeration. Unexpected port activity, data exfiltration, and impossible travel describe different indicator patterns not present here.

Operational technology refers to hardware and software that monitors and controls physical devices and processes, such as valves and pumps, and includes SCADA and ICS components. The remaining options describe compute architecture or identity concepts rather than physical process control.

ZTNA grants access to specific applications based on continuous identity and device verification rather than broad network-level trust. SASE is a broader cloud-delivered networking and security framework, hybrid cloud describes an infrastructure mix, VLAN segmentation divides a local network, and SCADA relates to industrial control systems.