CompTIA CySA + CS0-004 (V4) Exam (New Version) Practice Test 4

The finding that manual verification disproves is a false positive, since the scanner reported a vulnerability that was not actually present, while the missed genuinely vulnerable application is a false negative. A true positive would be a correctly identified real vulnerability, a true negative would be correctly identifying a non-vulnerable system, and patch availability concerns whether a fix exists.

Alert volume measures raw workload, mean time to close measures how long tickets take from creation to closure, phishing campaign click rate measures user susceptibility, and false-positive rate measures alert quality, each capturing a different dimension of SOC performance.

Formally determining that an event meets the criteria for a major incident and triggering the response plan with leadership notification is incident declaration and escalation. Post-incident reporting happens after resolution, shift handover concerns transferring an ongoing incident, operational security awareness concerns communication channels, and an internal threat intelligence report focuses on adversary context.

A patch expected to break an existing integration illustrates degrading functionality, while a contract prohibiting direct modification illustrates a contractual agreement inhibitor. Legacy systems concern outdated technology rather than contract terms, business process interruption concerns operational downtime, and patch availability concerns whether a fix exists at all.

Determining which findings go to which audience and tailoring communication accordingly is exactly what stakeholder identification and communication involves. Action plans track remediation steps, metrics and KPIs measure program performance, risk scorecards visualize overall posture, and compliance findings document specific regulatory gaps.

These four actions map directly onto later Cyber Kill Chain stages. Delivery is the transmission of the malicious payload, installation is when the malware establishes persistence, command and control is the ongoing connection back to attacker infrastructure, and actions on objectives is when the attacker carries out their actual goal.

Deciding on and implementing specific changes to prevent a similar incident from recurring is corrective action development, which follows root cause analysis. Root cause analysis determines why the incident happened as a separate, earlier step, and triage, escalation, and log collection all occur during the active incident.

Arranging every relevant event in chronological order to understand how an attack unfolded is the establishment of a timeline. Triage is a quicker initial urgency check, root cause analysis determines why the incident happened, escalation concerns notifying appropriate personnel, and chain of custody concerns evidence handling documentation.

Log collection is the act of gathering relevant logs from multiple systems into a central location for review. Log correlation links related entries together after collection, augmentation and enrichment adds external context, establishing a timeline sequences events chronologically, and triage is an earlier, quicker urgency assessment.

Documenting a specific step-by-step technical procedure for a scenario like ransomware is playbook creation, while assigning named individuals to specific response positions in advance is defining roles. Developing an incident response plan is the broader document these support, performing training tests the plan rather than creating it, and log collection is unrelated.

The post-incident phase includes compiling lessons learned, updating playbooks, and formal reporting, all of which happen after systems are already restored. Recovery is the phase where systems are actually restored, eradication removes the threat, containment limits spread during the active incident, and analysis happens earlier.

A software bill of materials, or SBOM, itemizes every component in a piece of software so organizations can check for known vulnerabilities in their third-party and open-source dependencies. This directly supports third-party and supply chain risk management by making the dependency tree visible and auditable.

Attack surface management focuses on identifying and reducing the total set of exposed, reachable assets, including decommissioning unused internet-facing subdomains and legacy services. Secure coding best practices apply during development, patching and configuration management address flaws in assets still in use, and compensating controls and exceptions manage risk on findings that cannot be directly remediated.

System hardening involves reducing a system's attack surface by disabling unnecessary services, removing default accounts, and applying secure baseline configurations. File structure management concerns organizing critical files, process monitoring concerns observing running processes, data protection concerns safeguarding data itself, and encryption concerns confidentiality rather than baseline configuration.

Nuclei is a fast, template-driven scanner whose detection logic comes from community-contributed YAML templates, frequently updated for newly disclosed CVEs. Nessus and OpenVAS are more traditional signature-based scanners with built-in databases, and Masscan and Angry IP Scanner focus on high-speed port and host discovery.

Breach attack simulation tools such as Atomic Red Team or Caldera are purpose-built to safely emulate known adversary techniques against real environments. Vulnerability scanners identify weaknesses, network scanning and mapping tools discover hosts, web application scanners target application-layer flaws, and cloud infrastructure assessment tools check cloud configuration.

Agent-based scanning installs lightweight software directly on each endpoint, allowing continuous visibility even off the corporate network. Agentless scanning relies on network-based or credentialed remote checks, passive scanning observes traffic rather than installing software, discovery scanning finds devices, and external scanning views systems from outside the perimeter.

Model poisoning occurs when an attacker corrupts the training data itself so the resulting model behaves incorrectly in a way that benefits the attacker. Hallucination involves the model fabricating output, data exposure involves leaking information, a malicious prompt manipulates a deployed model's input, and governance failure is an organizational gap.

Gathering information entirely from publicly available sources is the definition of open-source intelligence. Closed-source intelligence comes from restricted or paid sources, threat intelligence sharing involves exchanging data between organizations, IoC collection focuses on specific compromise indicators, and cyber deception involves actively misleading an adversary.

Domain and IP reputation services such as AbuseIPDB aggregate reports from many organizations about known malicious IPs and domains. Sandboxing analyzes file behavior, file analysis tools examine file content directly, UEBA analyzes internal user and entity behavior, and packet analysis inspects traffic content.

A SIEM is specifically designed to aggregate logs from many sources, correlate related events, and generate alerts based on suspicious patterns across the environment. EDR is scoped to endpoint telemetry alone, sandboxing analyzes files in isolation, a threat-intelligence platform manages external indicator data, and a vulnerability scanner identifies weaknesses.

A domain with a single swapped character closely mimicking the real one is typosquatting, while a shortened link that hides its true destination is a URL shortener technique. Business email compromise typically involves executive impersonation and financial requests rather than domain tricks, and impossible travel and enumeration are unrelated indicator categories.

Traffic on a port not associated with any approved application, such as port 4444, is a classic example of activity on unexpected ports. A rogue device refers to an unauthorized device, enumeration refers to systematic probing, and impossible travel and business email compromise are identity- and email-based indicators unrelated to port activity.

The tool enforcing encryption and remote wipe on smartphones falls under mobile device management, while the tool monitoring and responding to threats on laptops and desktops falls under endpoint device management. Privileged access management governs elevated account access, secrets management protects credentials, and network access control governs what devices can join a network.

APIs are the machine-to-machine interfaces that accept requests and return structured data, and in a cloud native application they are often the primary way functionality is exposed. Virtualization and containerization describe how workloads run, hybrid cloud describes an infrastructure mix, and cloud native describes a design philosophy rather than the specific interface layer.