CompTIA CySA + CS0-004 (V4) Exam (New Version) Practice Test 3

Validation of remediation confirms a fix was actually effective by re-checking the system after the patch is applied. Scoring methods and context awareness inform prioritization before remediation, compensating controls are an alternative to direct remediation, and true positive rate measures detection accuracy.

The phishing campaign click rate specifically measures the percentage of recipients who clicked a link in a simulated or real phishing test, making it a direct measure of user susceptibility rather than a technical detection metric like alert volume or mean time to detect.

The body that receives the organization's mandated breach notification filing is the regulatory reporting agency, while the body responsible for investigating the criminal aspect is law enforcement. Public relations manages public messaging, the legal team advises internally rather than being the external recipient, and customers are a notification target.

A service-level agreement defines an expected performance threshold, such as this contractual 14-day patch requirement. Trends show directional change over time rather than a fixed threshold, a risk scorecard aggregates broader risk posture, compliance findings document gaps against a standard, and an action plan tracks remediation steps.

An outdated system running on an unsupported OS with no further vendor patches is the definition of a legacy systems inhibitor. Proprietary systems refer to vendor lock-in on modification rights, contractual agreements involve third-party obligations, business process interruption concerns operational downtime, and degrading functionality concerns a fix breaking something else.

Comparing cryptographic hashes before and after handling confirms data integrity validation, while storing the original in a secure, access-controlled location represents preservation. Chain of custody documents the full handling history, legal hold suspends deletion schedules, and triage is an early urgency assessment.

Verifying that remediation was effective and the system is genuinely clean is required before releasing a system from isolation, to avoid reintroducing the threat. The executive summary, communication plan, after action report, and formal closure are all later reporting and wrap-up activities.

When an investigation reveals a scope or sensitivity beyond the initial assessment, escalating to senior responders or the incident commander ensures the incident gets appropriate attention and authority. Continuing alone risks delay on a high-stakes incident, and customer notification, executive summaries, and closure all come later after proper assessment.

A legal hold suspends normal data destruction or retention schedules for specific records when litigation is anticipated. Chain of custody tracks who handled evidence, data integrity validation confirms evidence has not been altered, preservation is a broader concept a legal hold helps enforce, and escalation concerns notifying the right people.

The analysis phase involves examining and correlating data to confirm whether an alert represents genuine malicious activity before any containment decision. Detection is the initial identification, containment happens once confirmed, eradication removes the threat, and post-incident happens after full resolution.

MITRE ATT&CK provides a standardized catalog of adversary techniques that incident responders commonly use to tag observed behavior for comparison. STRIDE is a design-time threat modeling framework, the Diamond Model maps relationships between intrusion elements, the Pyramid of Pain ranks indicator value, and the Cyber Kill Chain models attack stages.

SAST examines source code directly without running the application, DAST tests the application while it is running, and SAMM provides a broader maturity framework for evaluating software security practices across an organization.

The firewall rule blocking malicious traffic before it reaches internal systems is a preventative control, while the SIEM alert flagging suspicious logins after they occur is a detective control. Responsive controls act during or after an incident, corrective controls restore systems afterward, and administrative controls are policy-based rather than technical.

Log integrity and security controls, such as write-once storage or cryptographic hashing, protect logs from being altered after the fact. Retention governs how long logs are kept, time synchronization aligns clocks, and ingestion and configuration govern collection rather than tamper protection.

Cloud infrastructure assessment tools such as Prowler or ScoutSuite are purpose-built to evaluate cloud configurations. Multipurpose network tools and vulnerability scanners are generally built for on-premises assessment, breach attack simulation tools test detection capability, and web application scanners target application-layer flaws.

CIS benchmarks provide vendor-neutral, consensus-based configuration hardening standards. CVSS and EPSS score vulnerability severity and exploit likelihood rather than configuration compliance, an SBOM inventories software components, and SAMM is a software assurance maturity model.

Scanning from inside versus outside the corporate network is precisely the distinction between internal and external scanning. Credentialed versus non-credentialed concerns authentication, active versus passive concerns probe traffic, agent versus agentless concerns software deployment, and discovery versus baseline concerns scan purpose.

The chatbot revealing confidential data it should not have shared is a data exposure risk, while the specially crafted input designed to bypass safety instructions is a malicious prompt. Model poisoning involves corrupting training data, hallucination involves fabricating information, and governance failure is a broader organizational gap.

STRIDE structures threat modeling around six categories including spoofing, tampering, and denial of service, directly covering impersonation, tampering, and denial of service. MITRE ATT&CK catalogs real-world observed techniques, and the other frameworks serve different purposes related to analyzing actual intrusions.

MITRE ATT&CK is a public knowledge base cataloging adversary tactics and techniques mapped to known threat groups. STRIDE is a software threat modeling framework, the Pyramid of Pain ranks indicator value, and the Cyber Kill Chain and Diamond Model describe attack progression and intrusion relationships rather than a technique-to-group knowledge base.

Sandboxing tools like Cuckoo Sandbox or Joe Sandbox execute suspicious files in an isolated environment specifically to observe their behavior safely. Packet analysis inspects network traffic, domain and IP reputation checks external indicators, UEBA analyzes behavior patterns, and log analysis reviews existing log data.

Business email compromise involves impersonating a trusted executive to manipulate an employee into an unauthorized financial transaction. Typosquatting is one technique supporting this broader BEC pattern, while URL shorteners, enumeration, and impossible travel describe unrelated techniques.

Compressing sensitive files and uploading them to an external, personal account is a classic pattern of data exfiltration. Resource consumption refers to abnormal CPU or memory usage, unauthorized software refers to unapproved applications, file system changes refer to unexpected file modifications, and an anomalous rogue process refers to unexpected running processes.

PAM governs how elevated accounts are checked out, time-limited, and monitored. SSO and MFA concern how a user authenticates, secrets management stores credentials for applications and scripts, and RBAC defines permission sets rather than session-based elevation.

Containerization packages an application with its dependencies into a lightweight unit that shares the host OS kernel, unlike virtualization which runs full separate guest operating systems. Cloud native describes a design philosophy, API-based architecture concerns communication, and hybrid cloud describes infrastructure mix.