CS0-004 CompTIA Cybersecurity Analyst CySA+ V4 (New Version) Question and Answers

The Diamond Model of Intrusion Analysis is specifically suited to visually representing relationships between a threat actor, the infrastructure used during an intrusion, the actor's capabilities, and the victim. Its four principal vertices are adversary, infrastructure, capability, and victim . IP addresses and network services naturally map to infrastructure, while malware and attack tools map to capability.

The original Diamond Model describes an intrusion event through these four interconnected features and uses their relationships to support documentation, correlation, and analysis of malicious activity. This makes it particularly useful when the analyst wants to visualize intelligence rather than simply place activity into chronological stages.

EPSS predicts the probability that a vulnerability will be exploited and therefore does not model threat-actor infrastructure. The Cyber Kill Chain represents progressive stages of an intrusion, making it useful for understanding attack progression but less suitable for relational visualization. MITRE ATT & CK provides detailed behavioral information on adversary tactics and techniques; MITRE itself notes that ATT & CK and the Diamond Model are complementary, with the Diamond Model particularly useful for clustering and relating intrusion information.

Study Guide Reference: Security Operations → Threat Intelligence → Diamond Model → Adversary → Infrastructure → Capability → Victim → Threat Visualization.

The relevant follow-up is to assess the security configuration of the discovered VPN/IKE remote-access service , making option C the appropriate examination answer. Internet Key Exchange supports different negotiation modes, and Nmap includes specific capabilities for assessing IKE services. Nmap's ike-version script probes UDP port 500 and tests both Main and Aggressive Mode while identifying supported transforms and vendor characteristics.

Nmap's IKE library likewise explicitly supports generating either Main Mode or Aggressive Mode requests, enabling analysts to characterize the configuration of an exposed VPN endpoint. The security concern traditionally associated with this distinction is that Aggressive Mode exposes more negotiation information and has historically enabled offline attacks in some pre-shared-key configurations; Main Mode provides stronger identity protection during IKEv1 negotiation.

The other choices do not validate the security of the remote-access service. A web-server certificate is relevant to TLS-enabled HTTP services, BGP route publication relates to network routing, and ICMP ping only demonstrates basic reachability.

The analyst should therefore move from port discovery to service-specific configuration validation .

Study Guide Reference: Vulnerability Management → Nmap → Service Enumeration → VPN/IKE → UDP 500 → Main Mode/Aggressive Mode → Configuration Validation.

The attacker is attempting lateral movement because an already compromised identity is being used to move from one cloud environment or subscription into another. Lateral movement describes adversary activity intended to reach additional systems, services, accounts, or resources after an initial foothold has been established.

MITRE ATT & CK specifically includes cloud-oriented lateral movement. Its Lateral Movement tactic documents adversaries using valid accounts to access additional cloud services and resources within compromised environments. MITRE also documents cloud-role manipulation that may enable movement into additional accounts, demonstrating how identity and role relationships can become lateral-movement pathways in cloud architectures.

Privilege escalation would apply if the attacker were primarily attempting to obtain greater permissions within the current security context. Persistence concerns maintaining long-term access. Execution concerns running malicious code or commands. Credential access involves obtaining credentials or authentication material.

In this scenario, the attacker already possesses a compromised user role. The objective is to use that existing access to traverse a trust boundary and reach another isolated subscription. That movement between security domains is the decisive indicator of the Lateral Movement tactic.

Study Guide Reference: Security Operations → MITRE ATT & CK → Lateral Movement → Cloud Services → Valid Accounts → IAM Roles → Cross-Subscription Access.

Resource exhaustion is the most likely explanation because Linux top is specifically used to observe real-time system and process resource consumption. Its output provides system summary information and process-level metrics that allow an analyst to identify abnormal CPU or memory utilization, excessive process activity, load conditions, and other resource constraints. The Linux top manual describes the utility as providing a dynamic real-time view of the running system and its processes.

When an application becomes unresponsive while top indicates abnormally high processor consumption, memory pressure, or another exhausted resource, the immediate technical conclusion is resource exhaustion. An application can become starved of CPU time, physical memory, or other capacity, causing severe degradation or apparent failure.

Service disruption is a description of an outcome rather than the underlying condition demonstrated by process-resource statistics. Unauthorized software would require evidence showing an unexpected or prohibited process rather than simply excessive utilization. Filesystem changes are normally investigated through filesystem auditing, integrity monitoring, timestamps, logs, or forensic comparison; top does not primarily report file modifications.

The examination distinction is therefore between symptom and cause : the unresponsive application is the symptom, while excessive resource consumption revealed by top identifies the probable root cause.

Study Guide Reference: Security Operations → Host Analysis → Linux Utilities → top → CPU/Memory Analysis → Resource Exhaustion → Performance Anomalies.

The observed activity corresponds to privilege escalation , meaning the attacker attempted to move from a lower level of authorization to a more powerful security context. Privilege escalation becomes important after initial compromise because an account or process obtained during initial access frequently lacks the permissions required to disable controls, access sensitive resources, modify protected system settings, dump credentials, or establish deeper persistence.

MITRE ATT & CK defines the Privilege Escalation tactic as adversary activity intended to obtain higher-level permissions on a system or network. Techniques can include exploiting vulnerabilities, manipulating access tokens, modifying accounts or group memberships, abusing misconfigurations, or executing processes under more privileged identities.

Exfiltration specifically concerns removing information from the compromised environment. Remote code execution describes obtaining the ability to execute attacker-controlled commands or code remotely; while RCE can sometimes lead to privilege escalation, they represent different objectives. Spoofing involves impersonating or falsifying an identity, address, or other trusted characteristic.

The critical analytical distinction is therefore the attacker's objective demonstrated by the logs : attempting to obtain elevated access indicates privilege escalation rather than merely establishing execution or transferring data.

Study Guide Reference: Security Operations → Malicious Activity Analysis → MITRE ATT & CK → Privilege Escalation → Account/Permission Changes → System Log Interpretation.

A phishing simulation click rate measures user susceptibility to phishing and is therefore primarily an indicator of employee security awareness and behavior . If a simulated phishing message is delivered to employees and a percentage of recipients click the embedded malicious-style link, that percentage provides evidence about how effectively users are recognizing and resisting social-engineering attempts.

NIST research specifically identifies phishing-simulation click rates as a commonly used measure for evaluating the effectiveness of phishing-related security-awareness programs. NIST also cautions that raw click rates should be interpreted in context because phishing messages differ substantially in difficulty; the Phish Scale was developed to provide context for click-rate and report-rate results.

The metric does not primarily measure email-filter effectiveness because a controlled simulation may intentionally bypass or be allowlisted through technical filtering so employee behavior can be evaluated. It is unrelated to data-loss prevention false positives. It also does not directly measure response speed; metrics such as reporting time or mean time to respond would be more appropriate for that purpose.

Therefore, click rate is fundamentally a human-risk and awareness metric .

Study Guide Reference: Reporting and Communication → Security Metrics → Security Awareness → Phishing Simulations → Click Rate → Reporting Rate → Human Risk Measurement.

Prowler is designed for cloud security assessment, configuration review, and compliance evaluation, which directly meets the requirement to establish cloud-security baselines. The project's official repository describes Prowler as an open-source cloud security platform that automates security and compliance assessments across cloud environments and provides extensive security checks, reporting, and remediation guidance.

Baseline assessments establish an expected security posture against which subsequent configurations and changes can be evaluated. Prowler can examine cloud settings such as identity permissions, logging, encryption, public exposure, network controls, storage configuration, and service-specific security features. This allows the vulnerability-management team to identify deviations from security and compliance expectations.

Metasploit is an exploitation framework used primarily for penetration testing and validation of exploitable weaknesses. Maltego is an information-gathering and relationship-mapping platform frequently associated with OSINT and infrastructure reconnaissance. MITRE CALDERA is an adversary-emulation platform used to exercise defensive controls using automated attack techniques.

The term “cloud environment” combined with “security baselines” points directly toward a cloud posture and compliance assessment tool rather than exploitation, OSINT, or adversary simulation.

Study Guide Reference: Vulnerability Management → Cloud Assessments → Prowler → Security Baselines → Configuration Auditing → Compliance Checks → Cloud Security Posture.

The analyst must construct an accurate incident timeline . Patient zero is the earliest compromised system from which subsequent malicious activity originated or propagated. Determining it requires ordering events chronologically across all affected hosts and correlating authentication activity, process execution, network connections, malware creation times, lateral movement, and other evidence.

Raw logs alone do not communicate this sequence effectively. Logs from different systems must first use reliable timestamps and then be normalized and correlated. Once events are ordered, the analyst can work backward from known compromises to determine which host displayed the earliest credible signs of intrusion and whether subsequent systems were reached from that host.

Enabling additional monitoring helps detect future activity but does not reconstruct historical sequence by itself. Isolation is necessary during containment but does not establish which system was initially compromised. Shift-handoff improvements are useful organizationally but do not answer the forensic question. Malware composition analysis may identify relationships between samples, but it does not establish system-level chronology.

NIST's incident-response guidance emphasizes analysis, documentation, root-cause understanding, and after-action reporting as inputs to continuous improvement.

Study Guide Reference: Incident Response and Management → Timeline Analysis → Event Correlation → Patient Zero → Root Cause Analysis → After-Action Review.

The framework is the Diamond Model of Intrusion Analysis . The Diamond Model represents malicious activity using four core interconnected features: adversary, infrastructure, capability, and victim . This structure allows incident responders and threat-intelligence analysts to examine relationships between who conducted an intrusion, the technical resources used, the capabilities or tools involved, and the targeted organization or asset.

The original Diamond Model paper explicitly defines an intrusion event around these four core features and connects them in a diamond-shaped analytical structure. This relational approach is particularly useful for correlating separate intrusion events, identifying common infrastructure, associating capabilities with adversaries, and developing broader campaign intelligence.

STRIDE is a threat-modeling categorization method covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. MITRE ATT & CK organizes real-world adversary behavior according to tactics and techniques. The Cyber Kill Chain organizes intrusion activity into sequential attack stages. The NIST Cybersecurity Framework is a broader cybersecurity risk-management framework rather than an intrusion-event relationship model.

Therefore, a diagram or report organized around adversary–capability–infrastructure–victim relationships specifically identifies the Diamond Model.

Study Guide Reference: Incident Response and Management → Attack Methodology Frameworks → Diamond Model of Intrusion Analysis → Adversary → Infrastructure → Capability → Victim.

Eradication addresses the root causes and malicious mechanisms that allow an attacker to remain inside the environment. Typical eradication actions include deleting malware, removing persistence mechanisms, disabling unauthorized accounts, resetting compromised credentials, eliminating malicious scheduled tasks or services, correcting exploited vulnerabilities, and rebuilding systems when trust cannot be restored.

This differs fundamentally from containment. Containment is intended to limit immediate damage or prevent further spread , such as isolating an infected workstation, blocking an IP address, disabling a network segment, or temporarily suspending an account. These measures can interrupt attacker activity, but they do not necessarily remove the underlying foothold. Microsoft security architecture guidance similarly distinguishes containment from eradication and describes eradication procedures as completely removing the threat from the environment.

Detection identifies that suspicious or malicious activity exists; it does not remove access. Denial of service is an attack or availability condition rather than a recognized incident-response phase.

Therefore, if the examination asks which phase permanently removes the adversary's access , the correct answer is eradication because this is where attacker persistence and the enabling compromise are eliminated before normal operations are fully restored.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Persistence Removal → Credential Reset → Malware Removal → Vulnerability Remediation.

The activity is consistent with Virtual Network Computing (VNC) remote-control sessions. VNC provides interactive graphical access to another computer, which can manifest to the local user as unexpected mouse movement, windows opening, applications launching, or terminal sessions appearing without direct user interaction.

The network evidence distinguishes VNC from the other possibilities. Nmap's official VNC detection documentation demonstrates VNC services operating on TCP port 5900 and provides NSE functionality for querying VNC protocol versions and supported security mechanisms. When traffic logs show connections consistent with VNC services and users simultaneously observe visible remote desktop activity, VNC is the strongest correlation.

An internally addressable source address establishes only where traffic originated; it does not explain interactive mouse and keyboard activity. A reverse tunnel can provide an attacker with connectivity through network restrictions, but the tunnel itself does not identify the remote-control protocol responsible for the graphical symptoms. RDP can also provide interactive remote access, but it uses a different protocol and service profile; the traffic evidence in the scenario aligns with VNC instead.

An analyst should therefore correlate endpoint symptoms with network protocol and port evidence , rather than diagnosing remote access solely from visible user-interface behavior.

Study Guide Reference: Security Operations → Network Traffic Analysis → Remote Access → VNC → RDP → Ports/Protocols → Indicators of Unauthorized Remote Control.

The organization cannot completely block the malicious URL because it remains necessary for a legitimate business process. Instead, the security team is implementing compensating controls that reduce exposure while preserving required functionality. These controls include limiting access to explicitly authorized users, restricting network paths through firewall and cloud security-group rules, increasing monitoring, and ensuring that systems interacting with the external resource are fully patched.

A compensating control is an alternative safeguard used when the preferred control—such as completely removing access to the risky resource—is operationally impractical. The important distinction is that the underlying risk still exists; the organization is reducing its likelihood or potential impact through layered protections.

Patching is only one component of the response and therefore does not describe the overall mitigation. Configuration management concerns maintaining approved system configurations and controlling changes. Attack surface management focuses on identifying and reducing externally or internally exposed assets and services, but the scenario specifically describes alternative safeguards around a business-required risk.

The combination of access restriction, enhanced monitoring, and system hardening is therefore characteristic of compensating-control implementation.

Study Guide Reference: Vulnerability Management → Vulnerability Mitigation → Compensating Controls → Network Segmentation → Monitoring → Patch Management → Risk-Based Remediation.

Secure access service edge is specifically designed for environments in which users, devices, applications, and workloads are distributed beyond a traditional enterprise network perimeter. SASE integrates networking and security functions into a service-oriented architecture so policy enforcement can follow the user or workload rather than depend solely on traffic traversing a centralized corporate boundary.

This makes SASE particularly suitable for a perimeter-less topology , where employees may work remotely, applications may reside in multiple cloud providers, and services may be accessed directly over the internet. Typical SASE implementations combine software-defined wide-area networking with cloud-delivered security controls such as secure web gateways, cloud access security brokerage, firewall-as-a-service, and Zero Trust-oriented access controls.

A hybrid cloud network connects private and public cloud resources but can still operate using conventional network boundaries. Cloud-native computing describes an application and infrastructure design approach based on cloud technologies such as containers, microservices, and automation; it does not inherently define perimeter-less access security. A content delivery network distributes content geographically for performance and availability and is not an enterprise access-security architecture.

The CS0-004 Security Operations objectives explicitly identify SASE, Zero Trust Network Architecture, and hybrid cloud as network architecture concepts analysts must understand.

Study Guide Reference: Security Operations → Network Architecture Concepts → SASE → Zero Trust Network Architecture → Distributed/Cloud Security.

The log relationships support two conclusions: ws-57 is scanning dc-1 , and ws-57 is communicating with a service through a non-standard port . Network scanning is normally identified when one source system attempts connections against multiple ports or services on another host over a short period. Here, the directionality of the recorded communications identifies ws-57 as the initiating host and dc-1 as the target, supporting option A rather than B.

Port numbers then need to be interpreted in context. Standard service-port mappings provide useful baselines, but a service can technically operate on a port different from its conventional assignment. Detection logic therefore needs to consider both the actual port number and the protocol or service identified in the traffic. Nmap, for example, classifies scanned ports according to states and attempts to associate ports with known services during network reconnaissance.

The entries do not provide sufficient behavioral evidence for phishing delivery or ransomware infection. Those conclusions would require additional indicators such as SMTP message evidence, malicious attachments, encryption activity, process execution, or endpoint telemetry.

The correct analytical approach is to determine source, destination, connection pattern, and port/service relationship before assigning malicious intent.

Study Guide Reference: Security Operations → Network Log Analysis → Scanning/Enumeration → Source/Destination Interpretation → Ports and Protocols → Non-standard Service Ports.

Software Composition Analysis (SCA) is specifically designed to identify third-party and open-source components incorporated into software. It can enumerate libraries and dependencies, identify their versions, associate components with known vulnerabilities, and provide licensing information. This directly satisfies the legal team's requirement to determine whether the codebase contains open-source or commercially licensed libraries.

CISA's software supply-chain guidance recognizes software composition analysis and software bills of materials as mechanisms for obtaining visibility into software components. CISA guidance also notes that SBOM information can include both open-source and commercial third-party software and licensing information.

SAST examines source or compiled code for security weaknesses such as unsafe functions, data-flow problems, or coding vulnerabilities, but dependency licensing is not its primary purpose. DAST tests a running application from the outside and generally cannot inventory the complete component dependency tree. RASP operates within a running application to detect or prevent attacks. Credentialed infrastructure scanning identifies system-level vulnerabilities and configuration issues rather than software-license composition.

The strongest clue is the requirement to identify libraries and their licensing status , which directly maps to SCA.

Study Guide Reference: Vulnerability Management → Application Security Testing → SCA → Third-Party Components → Open-Source Dependencies → SBOM → Licensing and Vulnerability Analysis.

The analyst should collect the Netstat output first because current network-connection information is highly volatile and will change immediately when the server is disconnected. netstat-type evidence can identify active TCP/UDP connections, listening services, remote endpoints, and potentially the communication channels associated with an attacker or command-and-control infrastructure.

Digital-forensic acquisition follows the order of volatility : evidence most likely to disappear or change should be captured before more persistent artifacts. RFC 3227 explicitly directs investigators to proceed from volatile to less-volatile evidence and identifies information such as routing data, ARP cache, process state, memory-related information, and network state as highly time-sensitive.

The ARP table is also volatile and should be captured early, but the wording “before disconnecting the server from the network” makes active connection state particularly important because those sessions will terminate when network connectivity is removed. ShellBags are persistent forensic artifacts stored within Windows Registry data and can be collected later from disk. A hard-disk image is critical but comparatively nonvolatile and should follow acquisition of live state.

Therefore, live network-session information takes priority.

Study Guide Reference: Incident Response and Management → Evidence Acquisition → Order of Volatility → Live Response → netstat → Network Connections → Forensic Preservation.

Compensating controls are appropriate when the preferred remediation cannot currently be implemented but the organization must still reduce exposure. A mission-critical system with an unpatched vulnerability for which no vendor patch exists is a classic example. The system cannot simply be removed from service because the business requires it, and conventional patching is unavailable.

The organization may therefore deploy alternative controls such as network segmentation, restrictive firewall rules, application allowlisting, disabling unnecessary services, enhanced monitoring, IPS signatures, access restrictions, or isolation of affected functionality. These measures do not eliminate the underlying defect; instead, they reduce the probability or impact of exploitation while a permanent solution is developed.

NIST's control framework is designed to allow security controls to be selected and tailored according to organizational mission requirements and risk, supporting the broader principle that organizations may apply appropriate alternative safeguards when operational constraints exist.

Option B requires no compensating control because remediation has already occurred. Option C describes a vulnerability that is not applicable to the organization's systems. Option D represents a false positive and therefore does not constitute an actual exposure requiring mitigation.

Study Guide Reference: Vulnerability Management → Mitigation → Compensating Controls → Patch Availability → Mission-Critical Systems → Segmentation and Monitoring.

CyberChef is the most appropriate option because the task involves parsing and extracting structured indicators from unstructured text , rather than inspecting network traffic or managing a threat-intelligence repository. CyberChef provides operations for text manipulation, pattern matching, regular expressions, decoding, extraction, and transformation. An analyst can therefore feed the document into CyberChef and identify IPv4 address patterns without manually reviewing potentially thousands of characters.

Wireshark is primarily a packet-analysis platform. It would be appropriate if the analyst needed to inspect packets from a PCAP or live network capture, but the scenario provides a text document. Zeek is a network security monitoring and traffic-analysis framework that converts network activity into structured logs; it is similarly unnecessary for static textual extraction. OpenCTI is a threat-intelligence platform designed to organize, correlate, and manage intelligence objects and relationships. It could store the resulting IoCs after extraction, but it is not the most efficient tool for extracting IPv4 strings from raw text.

The official CS0-004 objectives identify CyberChef under decoding/parsing tools , while Wireshark and Zeek are classified under packet analysis and OpenCTI under threat-intelligence platforms.

Study Guide Reference: Security Operations → Tools for Malicious-Activity Analysis → Decoding/Parsing → CyberChef → Pattern Recognition/Regular Expressions → IoC Analysis.

PRODWEB-01 represents the highest remediation priority because vulnerability prioritization should combine asset value, vulnerability risk, and exploitation likelihood , rather than relying on severity alone. A production web server is typically more exposed and operationally significant than a development endpoint, and the correlated CMDB information provides the business context required to determine whether exploitation would materially affect organizational operations.

A mature vulnerability-management process evaluates technical severity together with internet exposure, business criticality, existing controls, active exploitation, threat intelligence, and the availability of remediation. CISA specifically recommends using known exploitation evidence as an input into vulnerability prioritization and provides risk-based methodologies such as SSVC for determining appropriate response actions.

This explains why simply choosing the system with the numerically highest isolated vulnerability score would be inadequate. DEVWIN11-01, for example, may contain significant findings but carries lower production value. A control-system asset may have high business importance but can present different exposure and exploitability conditions. The correlated attributes associated with PRODWEB-01 establish the strongest combined risk.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization → Asset Criticality → Exploitability → Threat Intelligence → CMDB Context → Risk-Based Remediation.

ScoutSuite is specifically designed for security posture assessment of cloud environments, making it the best tool for establishing a cloud-security baseline. NCC Group describes ScoutSuite as an open-source, multi-cloud security-auditing tool that uses cloud-provider APIs to collect configuration information and identify risk areas across cloud environments.

This capability is fundamentally different from conventional host or web vulnerability scanning. A cloud baseline requires evaluation of configurations such as identity permissions, storage exposure, network controls, encryption settings, logging, cloud-native security services, and resource policies. ScoutSuite queries the cloud control plane and produces an organized view of configuration weaknesses that can be compared with security expectations.

OpenVAS is primarily a general-purpose vulnerability-assessment scanner for systems and network services. Nikto concentrates on web-server weaknesses and dangerous configurations. Metasploit is primarily an exploitation and penetration-testing framework. Although each has legitimate assessment uses, none is as directly suited to broad cloud configuration posture assessment as ScoutSuite.

The critical examination distinction is cloud configuration auditing versus traditional vulnerability scanning or exploitation .

Study Guide Reference: Vulnerability Management → Cloud Vulnerability Assessment → Configuration Baselines → ScoutSuite → Cloud APIs → Security Posture Assessment → Misconfiguration Identification.

Reimaging the disk is a recovery activity because it restores the compromised endpoint to a trusted operational state after malicious activity has been identified and contained. Reimaging replaces the affected operating environment with a known-good system image, removing uncertainty about hidden persistence mechanisms, modified system files, unauthorized software, or other residual effects of compromise.

Verification that malicious activity occurred belongs to the detection and analysis stage. Taking the system offline is a containment measure intended to prevent additional propagation, command-and-control communication, or damage. Writing the final report occurs during post-incident documentation and lessons-learned activities rather than operational restoration.

NIST's Recover function focuses on restoring affected assets and operations and verifying that restored systems are suitable for return to normal business use. A clean reimage is particularly appropriate where the integrity of the compromised operating system cannot be reliably established through selective malware removal.

After rebuilding, analysts should verify configuration, patch levels, security controls, credentials, and monitoring before reconnecting the machine to production.

Study Guide Reference: Incident Response and Management → Recovery → Reimaging → Known-Good Baselines → Restoration Validation → Return to Production.