CompTIA CySA+ CS0-004 CS0-004 Questions 226–236 | Page 4/4

226

MCQmedium

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the alert triage phase, Which action gives the analyst the clearest next triage step?

A.Ignore the indicators because TLP markings are optional

B.Publish the indicators on a public GitHub repository

C.Send the indicators to all customers

D.Use them internally with only people who need to know and avoid wider redistribution

AnswerD

TLP:AMBER+STRICT restricts sharing to the recipient organisation on a need-to-know basis.

Why this answer

TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and prohibits any wider redistribution. In the alert triage phase, using the indicators internally ensures the SOC can investigate and respond without violating the information-sharing constraints set by the vendor, which is a mandatory security practice, not optional.

Exam trap

CompTIA often tests the misconception that TLP markings are merely advisory or optional, leading candidates to choose 'ignore' or 'publish' options, when in fact TLP is a mandatory handling framework with strict enforcement requirements.

How to eliminate wrong answers

Option A is wrong because TLP markings are mandatory for handling sensitive threat intelligence; ignoring them would violate security policies and potentially expose the organization to legal or operational risks. Option B is wrong because publishing TLP:AMBER+STRICT indicators on a public GitHub repository directly violates the strict no-redistribution rule and could compromise ongoing investigations or expose the vendor's sources. Option C is wrong because sending the indicators to all customers, even if they are internal, violates the 'need to know' restriction of TLP:AMBER+STRICT, which limits sharing to only those individuals directly involved in the response.

Full explanation →

227

Multi-Selectmedium

A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?

Select 2 answers

A.All DNS queries are to internal DNS servers

B.Frequent DNS queries to domains with random-looking, long subdomains

C.DNS queries to domains with a high Alexa ranking

D.High volume of DNS queries resulting in NXDOMAIN responses

E.Consistent DNS query intervals to a single IP

AnswersB, D

Frequent queries to domains with random-looking, long subdomains are a hallmark of Domain Generation Algorithms (DGAs). Malware uses DGAs to generate pseudorandom domain names as rendezvous points with command-and-control (C2) servers, often producing long, alphanumeric subdomains that appear nonsensical. The high query rate to such domains is a strong indicator of compromise because legitimate users rarely make repeated queries to random subdomains.

Why this answer

DGA domains are often algorithmically generated, resulting in random-looking, long domain names. High NXDOMAIN rates occur because many generated domains are not registered at the time of query.

Full explanation →

228

Multi-Selecthard

A threat hunter is using osquery to look for persistence mechanisms on a set of Windows endpoints. Which THREE registry keys or scheduled tasks should the hunter check for common persistence?

Select 3 answers

A.HKLM\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

B.User's Startup folder

C.HKLM\SYSTEM\CurrentControlSet\Services

D.HKCU\Software\Microsoft\Windows\CurrentVersion\Run

E.Scheduled tasks in Task Scheduler

AnswersC, D, E

Services are a high-value persistence target because they can be set to AUTO_START, allowing an adversary to execute payloads with SYSTEM privileges at boot, before any user logs on. The osquery services table exposes fields such as name, path, start_type, and status, making it easy for hunters to spot anomalies like a non-standard executable path or a suspicious service name. Because services run independently of user sessions, survive reboots, and often run with the highest integrity level, they are one of the strongest and most frequently abused persistence techniques.

Why this answer

Run keys, scheduled tasks, and services are common persistence locations. Startup folder is also common, but osquery can check Run keys directly. AppInit_DLLs is less common.

Full explanation →

229

Multi-Selectmedium

A security analyst is prioritizing vulnerabilities for remediation. Which THREE factors from the CISA Known Exploited Vulnerabilities (KEV) catalog should the analyst consider? (Select THREE.)

Select 3 answers

A.EPSS probability score

B.Date the vulnerability was added to the catalog

C.CVSS base score

D.Vulnerability name or CVE ID

E.Affected vendor or product

AnswersB, D, E

The KEV catalog includes a 'Date Added' field that records when a vulnerability was first identified as known exploited, allowing security teams to prioritize based on how recent and relevant the active exploitation is. This date is crucial because newer entries often warrant immediate attention, as attackers may be actively leveraging them. In contrast to CVSS or EPSS scores, this date is a distinct component of the KEV record itself, making it the right field when consulting the catalog for prioritization.

Why this answer

The KEV catalog lists vulnerabilities known to be exploited in the wild, including the date added, vendor name, and a brief description.

Full explanation →

230

MCQmedium

An analyst wants to capture all traffic to and from a specific IP address for analysis. Which command-line tool is most appropriate?

A.nmap -sS 10.0.0.1

B.netstat -ant | grep 10.0.0.1

C.iptables -L -v

D.tcpdump host 10.0.0.1

AnswerD

Tcpdump is a powerful command-line packet analyzer that captures and displays network traffic. The `host 10.0.0.1` filter expression precisely instructs `tcpdump` to capture all packets where the source IP address is `10.0.0.1` or the destination IP address is `10.0.0.1`. This effectively captures all inbound and outbound network traffic associated with the specified host, fulfilling the requirement to capture all traffic to and from it.

Why this answer

`tcpdump host 10.0.0.1` captures all packets where the source or destination IP address matches 10.0.0.1, making it the ideal tool for capturing all traffic to and from a specific IP for analysis. It operates at the packet level, using libpcap to intercept raw network frames, and the `host` filter instructs it to match both directions of traffic without additional parsing or state tracking.

Exam trap

The trap here is that candidates confuse tools that probe or display state (nmap, netstat, iptables) with tools that capture raw traffic (tcpdump), leading them to select a tool that does not actually capture packets for analysis.

How to eliminate wrong answers

Option A is wrong because `nmap -sS 10.0.0.1` performs a SYN stealth scan against the target IP, which sends crafted packets to probe open ports, not capture existing traffic. Option B is wrong because `netstat -ant | grep 10.0.0.1` displays current network connections and listening ports from the system's socket table, but it does not capture live packets or traffic content; it only shows connection state at a single point in time. Option C is wrong because `iptables -L -v` lists the current firewall rules and their packet/byte counters, but it does not capture or log individual packets for analysis; it only shows aggregate statistics for rules.

Full explanation →

231

Multi-Selecteasy

An analyst is configuring correlation rules in a SIEM. Which TWO data sources are essential for detecting lateral movement using pass-the-hash attacks?

Select 2 answers

A.Firewall logs

B.Authentication logs (e.g., Windows Event ID 4624)

C.DNS logs

D.Endpoint process creation logs (e.g., Event ID 4688)

E.Vulnerability scan results

AnswersB, D

Authentication logs, specifically Windows Event ID 4624, are central to detecting pass-the-hash because they record successful and failed logon events, including the logon type, authentication package (e.g., NTLM), source workstation, and target account. In a PtH attack, an attacker uses an NTLM hash as if it were a password; the logon event will typically show a network logon (Type 3) using NTLM, often from a non-domain host or in conjunction with suspicious source IP addresses. Correlating these 4624 events with known user activity patterns can reveal an attacker authenticating with a hash from an unauthorized source.

Why this answer

Pass-the-hash involves using NTLM hashes to authenticate. Authentication logs show logon events, and endpoint logs show process creation (e.g., wmic, psexec). Firewall logs may show network connections but are not specific to PtH.

Full explanation →

232

Multi-Selectmedium

An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)

Select 3 answers

.Isolating affected systems from the network by disabling their network interfaces.

.Creating a forensic image of the infected systems for later analysis.

.Blocking outbound communication from infected hosts at the firewall.

.Identifying and patching the vulnerability exploited by the malware.

.Implementing network segmentation to prevent lateral movement.

.Notifying law enforcement agencies about the incident.

Why this answer

Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.

Exam trap

CompTIA often tests the distinction between containment actions (immediate isolation) and eradication actions (patching, imaging), so candidates mistakenly select 'creating a forensic image' or 'patching the vulnerability' as containment steps when they actually belong to later phases of the incident response process.

Full explanation →

233

MCQeasy

An organization performs quarterly vulnerability scans of its internal network. The scans have a high number of false positives for out-of-date software that is actually up to date. Which of the following would BEST improve the accuracy of the scans?

A.Disable verbose output to reduce clutter.

B.Implement credential-based scanning.

C.Increase scan frequency to monthly.

D.Use a different vulnerability scanner.

AnswerB

Implementing credential-based scanning significantly enhances accuracy by allowing the scanner to log into target systems and perform authenticated, local checks. This enables the tool to inspect actual patch levels, system configurations, installed software versions, and internal service states directly, rather than relying solely on network-level inferences. By gaining this internal visibility, the scanner can definitively confirm the presence or absence of vulnerabilities, drastically reducing both false positives and false negatives.

Why this answer

Credential-based scanning (authenticated scanning) allows the scanner to log into target systems with valid credentials, enabling it to query the local registry or package manager for the exact installed software versions. This eliminates reliance on banner grabbing or service fingerprinting, which often produce false positives when out-of-date software is detected based on network-level heuristics rather than actual installed patches.

Exam trap

The trap here is that candidates assume false positives are caused by scanner quality or frequency, rather than recognizing that unauthenticated scanning inherently lacks the visibility needed to confirm patch levels, making credential-based scanning the only direct solution.

How to eliminate wrong answers

Option A is wrong because disabling verbose output only reduces the amount of log data; it does not change the underlying detection method, so false positives from unauthenticated fingerprinting would persist. Option C is wrong because increasing scan frequency to monthly does not address the root cause of false positives; it merely repeats the same inaccurate detection more often, potentially increasing noise. Option D is wrong because simply using a different vulnerability scanner without enabling credential-based scanning would likely yield similar false positives, as most scanners rely on unauthenticated fingerprinting by default and require credentials to improve accuracy.

Full explanation →

234

Multi-Selectmedium

A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?

Select 2 answers

A.Exclude failed logins from known service accounts

B.Disable the rule entirely

C.Increase the alert severity to critical for all failed logins

D.Add a correlation rule to trigger on successful login after multiple failures

E.Require a minimum threshold of 5 failed attempts from the same source IP within 10 minutes before alerting

AnswersA, E

Service accounts frequently generate legitimate failed-login noise from scheduled password rotations, expired credentials in automation scripts, or misconfigured connection strings, none of which represent an attacker probing for access. Suppressing these known, expected sources removes a large share of benign alert volume without weakening detection against genuine unauthorized login attempts from unexpected accounts or sources.

Why this answer

Aggregating alerts by source IP reduces noise; excluding known service accounts eliminates expected failures.

Full explanation →

235

Multi-Selecthard

A cloud security posture tool reports public access on object storage. Which follow-up checks matter? (Choose two.)

Select 2 answers

A.Whether the storage account name is short

B.Whether sensitive objects were accessed or downloaded

C.Whether the administrator uses dark mode

D.Whether public access is effectively allowed by bucket and account policies

AnswersB, D

Once a Cloud Security Posture Management (CSPM) tool identifies potential public access, determining whether sensitive objects were actually accessed or downloaded is critical for incident response and impact assessment. This moves beyond a misconfiguration alert to evidence of potential data exfiltration or unauthorized access, directly informing the severity of the incident and necessary remediation steps. It helps quantify the actual damage and regulatory reporting requirements.

Why this answer

The primary concern with public access to object storage is data exposure. Checking whether sensitive objects were accessed or downloaded determines if a breach actually occurred, which is a critical follow-up step in vulnerability management. Without this check, you cannot assess the real-world impact of the misconfiguration.

Exam trap

The trap here is that candidates often focus on the misconfiguration itself (public access) rather than the necessary forensic step of verifying actual data exposure, leading them to pick irrelevant options like account name length or UI settings.

Full explanation →

236

Multi-Selectmedium

Which three of the following are key considerations when implementing a vulnerability management lifecycle in an enterprise environment? (Choose three.)

Select 3 answers

.Establishing a remediation prioritization framework based on asset criticality and exploitability

.Scanning all assets with the highest possible scan intensity to ensure no vulnerability is missed

.Integrating threat intelligence feeds to contextualize vulnerabilities and focus on active threats

.Performing vulnerability scans only during off-peak hours to minimize network disruption

.Defining a formal remediation SLA that aligns with organizational risk tolerance

.Using default scan credentials from the vulnerability scanner vendor for consistency

Why this answer

Establishing a remediation prioritization framework based on asset criticality and exploitability is correct because it ensures that vulnerabilities posing the greatest risk to the business are addressed first. This aligns with risk-based vulnerability management, where not all vulnerabilities are equal; prioritizing by asset value and exploitability (e.g., CVSS exploitability metrics or active exploitation evidence) optimizes resource allocation and reduces overall risk exposure.

Exam trap

CompTIA often tests the distinction between operational best practices (like scanning intensity or timing) and strategic lifecycle components (like prioritization frameworks, threat intelligence integration, and SLA definitions), leading candidates to confuse tactical scanning habits with core lifecycle pillars.

Full explanation →

CompTIA CySA+ CS0-004 (CS0-004) — Questions 226–236