CompTIA CySA + CS0-004 (V4) Exam (New Version) Practice Test 5

The potential for full remote code execution describes impact, the severity of consequences if exploited, while the lack of a vendor-released fix describes patch and remediation availability. Asset value concerns how important the affected system is, exploitability concerns how easily the flaw can be exploited, and true positive rate concerns detection accuracy.

A report specifically tailored to the organization's own environment, translating observed adversary tactics into relevance for the company's own systems, is an internal threat intelligence report. An executive summary is a concise leadership overview, an after action report documents the incident record, a risk scorecard summarizes overall risk posture, and compliance findings document regulatory gaps.

Operational security awareness includes establishing consistent, defined communication channels during an incident so updates reach the right people reliably. An executive summary is a specific leadership-facing document, shift handover concerns transferring incident status between teams, post-incident reporting happens after resolution, and an internal threat intelligence report focuses on adversary context.

A remediation process that stalls due to multiple layers of required committee sign-off, independent of technical complexity, illustrates an organizational governance inhibitor. Legacy systems and patch availability concern the technology itself, business process interruption concerns operational downtime, and degrading functionality concerns a fix breaking something else.

A ranked list of the highest-impact unresolved findings is specifically the top risks element of vulnerability management reporting. Trends show directional change over time, an SLA defines a performance threshold, a risk scorecard is a broader visual summary of overall posture, and compliance findings document gaps against a specific standard.

The Cyber Kill Chain organizes an attack into a fixed, sequential set of stages, while MITRE ATT&CK catalogs a much larger and more granular set of specific techniques that do not follow a required fixed order. The Diamond Model maps relationships between intrusion elements, STRIDE is a design-time threat modeling framework, and the Pyramid of Pain ranks indicator value.

Identifying the actual underlying reason an incident occurred is root cause analysis, which typically precedes deciding on specific corrective actions. Establishing a timeline sequences events without necessarily explaining why they happened, triage is an early urgency assessment, chain of custody concerns evidence handling, and corrective action development is the subsequent step.

A simulation has participants actually execute real technical steps in a controlled or sandboxed environment, unlike a tabletop exercise where the response is only discussed verbally. Awareness training focuses on general security education, and a root cause analysis workshop or post-incident review both happen after a real incident.

Rebuilding a server from a known-good image and reapplying a standard baseline is performing restoration, the hands-on technical work of returning a system to a trusted state. Root cause analysis determines why the incident occurred, establishing a timeline sequences events, escalation concerns notification, and corrective action development defines broader preventive changes.

Restoring systems from clean backups, reconnecting them, and monitoring for reinfection after the malware is already removed is the recovery phase. Containment and eradication happen earlier while the threat is still active or being removed, preparation happens before any incident, and analysis happens early on.

Disconnecting infected machines to stop further spread, without yet removing the malware itself, is containment. Eradication would involve actually removing the malware, recovery would involve restoring systems, analysis happens before containment, and post-incident happens well after the threat is fully resolved.

Software composition analysis specifically scans an application's dependency tree to identify included open-source components and flag known vulnerabilities. SAST analyzes an organization's own source code, DAST tests a running application's behavior, SAMM is a broader maturity framework, and supply chain risk assessment is a broader concept SCA tooling directly supports.

Risk appetite defines how much risk an organization is willing to tolerate, inherent risk describes the raw exposure before any controls are applied, and residual risk describes what remains after controls have been put in place.

Log ingestion is the process of collecting and bringing log data from a source into a central platform like a SIEM for analysis. Retention concerns how long data is kept, time synchronization concerns clock alignment, integrity concerns tamper protection, and configuration concerns what and how events are recorded at the source.

Masscan is built for extremely high-speed scanning across very large IP ranges, prioritizing speed to quickly identify responsive hosts. Nmap offers deeper service detection but at slower speed across large ranges, Burp Suite targets web application traffic, Nuclei runs template-based vulnerability checks, and OpenVAS performs deeper vulnerability assessment.

The scan focused specifically on payment card processing systems checks against PCI DSS, while the broader international information security management standard used organization-wide is the ISO 27000 series. CIS benchmarks provide vendor-neutral configuration hardening guidance rather than a payment-specific or ISO-branded standard, CVSS scores vulnerability severity, and SAMM is a maturity model.

Considering the timing and potential performance impact of a scan on sensitive systems, and adjusting the schedule accordingly, is exactly what planning considerations such as scheduling and performance address. Scan type selection concerns which method to use, asset inventory concerns knowing what exists, discovery scanning identifies devices, and security baseline scanning checks configuration compliance.

A formal policy governing what data may or may not be entered into AI tools, paired with required training, is governance in the form of AI usage policies. AI risk assessment would evaluate specific risks rather than set usage rules, and model poisoning prevention, hallucination mitigation, and data exposure remediation are technical or incident-response responses rather than governance itself.

Confidence-level impacts such as timeliness, relevance, and accuracy explain why a recent, multi-source, directly relevant indicator carries more weight. Attribution concerns identifying who is responsible, threat modeling structures design-time threat analysis, cyber deception involves actively misleading an adversary, and the Pyramid of Pain ranks indicator types by attacker cost.

EVTX is the native file format used by the Windows Event Log service to store event records, including logon events, encountered when exporting and reviewing these logs from a Windows server.

CyberChef provides a drag-and-drop interface for chaining together decoding, decryption, and other data transformation operations. YARA matches file patterns rather than transforming data, tcpdump captures network traffic, MXToolbox analyzes email and DNS records, and OpenVAS scans for vulnerabilities.

The application becoming unresponsive due to a flood of malformed requests is service disruption, where availability itself is impacted. Anomalous activity is a broader category, unauthorized configuration refers to unapproved settings changes, and enumeration and impossible travel describe unrelated reconnaissance and identity indicators.

Installing an unapproved application is unauthorized software, while sustained abnormally high CPU usage with no legitimate explanation is resource consumption. File system changes would involve unexpected file modification, data exfiltration involves data leaving the network, and a rogue process refers to an unexpected running process rather than overall resource usage.

SCADA specifically refers to the supervisory system that collects real-time field data and allows centralized human monitoring and control of an industrial process. OT and ICS are broader umbrella terms SCADA falls under, critical infrastructure is a broader sector-level classification, and cloud native infrastructure is unrelated to industrial control.

The cloud-delivered bundle of networking and security functions for a distributed workforce is SASE, while running some workloads on-premises and others in public cloud is hybrid cloud. ZTNA specifically concerns identity- and device-based access control, a VLAN segments a local network, and software-defined networking is a broader networking approach.