CS0-004 Practice Exam: 750 Questions with Explanations

1. A ransomware outbreak encrypted hosts in the finance VLAN but did not reach the HR or engineering VLANs, even though all three share the same core switches. Which architecture concept MOST limited the blast radius?

1. A single flat Layer 2 domain for all hosts
2. Network segmentation with ACLs between VLANs
3. 802.1X authentication on access ports
4. An intrusion prevention system in detection mode

2. A SOAR playbook is triggered by a phishing alert: it isolates the host, blocks the sender domain at the email gateway, and opens a ticket. Which efficiency benefit does this automation PRIMARILY provide?

1. Reduced mean time to respond through consistent, immediate containment
2. Elimination of the need for any analyst review of future alerts
3. Guaranteed prevention of all future phishing attempts against the company
4. Replacement of the SIEM as the primary detection platform

3. EXHIBIT — SIEM excerpt (times UTC, same workstation WKSTN-1147): 10:02:11 Outlook opened attachment Invoice.docm; macro execution allowed by user 10:02:58 powershell.exe -enc <base64 blob> spawned from WINWORD.EXE 10:03:40 powershell.exe connected to 185.220.101.47:443 (no prior DNS query) 10:04:05 rundll32.exe loaded C:\Users\jdoe\AppData\Local\Temp\upd.dll 10:05:12 credential access alert: LSASS memory read by upd.dll process Based on this sequence, which conclusion is BEST supported?

1. The host is performing a routine Office update
2. The host is compromised: a malicious macro led to code execution, C2 contact, and credential access
3. The alerts are false positives from antivirus scanning
4. The user intentionally installed a software update

4. According to the pyramid of pain, which indicator type is HARDEST for an adversary to change?

1. File hashes, which change with every recompiled binary
2. TTPs (tactics, techniques, procedures)
3. IP addresses, which attackers rotate frequently
4. Domain names, which are cheap for attackers to register

5. An analyst needs to determine how malware entered a host and what it did after execution. Which data source is MOST valuable?

1. SIEM aggregation
2. Firewall logs
3. EDR telemetry
4. Vulnerability scanner output

6. Match each identity attack to its BEST description: 1. MFA fatigue 2. Kerberoasting 3. Session token theft 4. Pass-the-ticket

1. 1-D, 2-B, 3-A, 4-C
2. 1-A, 2-C, 3-B, 4-D
3. 1-C, 2-A, 3-D, 4-B
4. 1-B, 2-D, 3-C, 4-A

7. Which two factors should drive how often a system is vulnerability scanned? (Choose two.)

1. The system's exposure and the criticality of the data it handles.
2. The vendor's marketing schedule for new scanner features.
3. The number of employees in the department that owns the system.
4. Regulatory or contractual requirements that mandate a scan cadence.
5. The physical location of the data center where the system sits.

8. An analyst notices that scan results for a subnet vary widely between runs, with hosts appearing and disappearing. What is the most likely explanation?

1. The subnet contains DHCP-assigned or ephemeral addresses, so the same IP may represent different hosts across runs.
2. The scanner is randomly dropping results.
3. The subnet is under active attack during every scan.
4. The hosts are all powered off between scans.

9. An analyst sees a finding for a vulnerability that was already remediated and verified last month. What is the most likely cause of its reappearance?

1. A system was restored from an old image or backup, or a new identical host was deployed from an unpatched template.
2. The scanner is generating random findings.
3. The remediation was never actually performed.
4. The vulnerability mutated into a new variant.

10. A remediation team consistently misses SLAs for one application because its owner never approves maintenance windows. What is the best escalation path?

1. Present the accumulated risk to the application owner
2. Silently extend the SLAs for that application.
3. Close the findings as accepted without owner involvement.
4. Stop scanning the application.

11. A vulnerability affects a system that is already scheduled for a major upgrade next month, which will replace the vulnerable component. What is the best interim handling?

1. Do nothing, since the upgrade will fix it.
2. Close the finding now in anticipation of the upgrade.
3. Patch the old component at full cost this week.
4. Apply mitigations and monitoring now

12. MATCHING PBQ. Match each observed activity to the MITRE ATT&CK tactic it best represents. Activities: 1. An attacker queries Active Directory for all domain administrators. 2. Malware writes a registry Run key so it starts at logon. 3. A script dumps LSASS process memory. 4. Stolen documents are uploaded to an external file-sharing site. Which mapping is correct?

1. 1-Discovery, 2-Persistence, 3-Credential Access, 4-Exfiltration
2. 1-Reconnaissance, 2-Defense Evasion, 3-Discovery, 4-Command and Control
3. 1-Collection, 2-Privilege Escalation, 3-Credential Access, 4-Impact
4. 1-Discovery, 2-Persistence, 3-Defense Evasion, 4-Collection

13. A threat intelligence report describes an adversary that consistently uses spear-phishing for initial access, then credential dumping, then lateral movement via SMB. An analyst maps this to the adversary's typical playbook. Which framework best supports describing this repeated sequence of tactics?

1. MITRE ATT&CK, because it catalogs tactics and techniques in the order adversaries use them
2. The Diamond Model, because it sequences attacks into phases from adversary action through victim impact
3. The Cyber Kill Chain, because it lists adversary tools
4. CVSS, because it scores vulnerability severity

14. A responder is documenting an incident timeline. The responder records each event with a timestamp, source, and description, and notes where timestamps came from different time zones. Why is time-zone normalization important?

1. Normalization slows documentation, so it should be skipped
2. Events from systems in different zones appear out of order unless converted to a common reference, which corrupts the sequence
3. Time zones do not affect timelines, because all systems use the same clock and synchronize to the same time source, so offsets never occur in practice
4. Normalization is only needed for legal cases, not internal reviews

15. YES/NO PBQ. For each statement about evidence handling, select Yes if it follows proper procedure or No if it does not. Statements: 1. Original evidence should be analyzed directly rather than working from a forensic image. 2. Every transfer of evidence must be recorded with date, time, sender, and receiver. 3. A hash of the evidence should be recorded at acquisition and verified before analysis. 4. Evidence may be stored on any available shared drive as long as it is password-protected. Which answer sequence is correct?

1. 1-No, 2-Yes, 3-Yes, 4-No
2. 1-Yes, 2-Yes, 3-No, 4-Yes
3. 1-No, 2-No, 3-Yes, 4-Yes
4. 1-Yes, 2-No, 3-No, 4-No

16. A responder is handling an incident involving a compromised email account. The responder checks the account's login history, mailbox rules, and sent items. Which investigation principle does this sequence follow?

1. Comprehensive account review: checking access, persistence mechanisms, and actions taken by the attacker
2. Minimal review, because only login history matters
3. Random review, because order does not matter
4. Recovery review, because the account is being restored to service and its settings are being reset to defaults

17. An analyst includes screenshots in an incident report as evidence of attacker activity. What makes those screenshots most useful as documentation?

1. Capturing them in high resolution regardless of content
2. Including visible timestamps, hostnames, and a caption explaining what each image shows
3. Cropping out all system information to keep the images clean and presentable for executives
4. Saving them only on the analyst's personal workstation

18. A SOC report cites an MTTD of 4 hours. What does that metric measure?

1. The average time from when an incident begins until it is detected
2. The average time to close a ticket
3. The average time to restore service after an incident
4. The average time between a user report and analyst assignment, from ticket creation

19. A retailer discovers cardholder data was exposed. Who must be notified first under PCI DSS obligations?

1. Notify the acquiring bank and card brands promptly, as required by PCI DSS and contractual obligations
2. Notify only internal IT staff
3. Wait until the next annual PCI audit
4. Notify customers directly and no one else

20. Which two signs show a lessons-learned program is working? Choose two.

1. The repeat-incident rate for the same weakness declines
2. Incident reports get longer
3. Action items from reviews are closed on time, verified as done
4. Every review produces the same recommendations as the last

21. An EDR alert flags suspicious SMB traffic from a workstation at CertCrack.com. Before isolating the host, the analyst wants to confirm exactly which services and versions the host is running and which ports are actually listening. Which action gives the analyst this information?

1. Run a vulnerability scan template check for one named CVE against the host
2. Run an Nmap service and version detection scan against the host
3. Review the host's entries in Zeek's conn.log for the last hour
4. Sweep the subnet with Angry IP Scanner to list live hosts

22. CertCrack.com is investigating a suspected DNS-tunnelling channel. The responder needs two weeks of historical DNS queries and connection records for one workstation, but full packet captures are kept for only 48 hours. Which source gives the responder what they need?

1. A new Wireshark capture started today
2. Nikto's web server findings for the workstation
3. The YARA match report from the antivirus console
4. Zeek's dns.log and conn.log records for the period

23. CertCrack.com is migrating from one SIEM platform to another and does not want to rewrite its library of log detections a second time. The detection engineer writes each detection once, in a vendor-neutral format, and converts it to each platform's query language. Which format is the engineer using?

1. EVE JSON, Suricata's event output schema
2. YARA, converted per platform by the SIEM vendor
3. Sigma, the generic signature format for SIEM detection rules
4. NSE, Nmap's scripting format

24. After a detection-engineering sprint, CertCrack.com's SOC wants to verify that its EDR now alerts on one specific MITRE ATT&CK technique — OS credential dumping — before the technique is added to the coverage report. The test must be small, controlled, and repeatable. Which approach is BEST?

1. Run a Caldera operation across the test range
2. Run a full Nessus credentialed scan of the test host
3. Run the matching Atomic Red Team test for that technique
4. Sweep the test range with Masscan to confirm the host is reachable

25. A critical CVE in a widely used web framework was published this morning. CertCrack.com needs to know, within the hour, whether any of its 500 web servers is exposed to this one specific vulnerability. Which approach is fastest?

1. Schedule full credentialed Nessus scans of all 500 servers and review the results tomorrow
2. Run Nikto against each server and read every hygiene finding for a mention of the CVE
3. Point ScoutSuite at the web tier and review its flagged rules
4. Run Nuclei with the template written for that CVE against all 500 targets

26. CertCrack.com is preparing for a cloud security review of its production AWS environment. The security lead wants a broad posture audit of the live accounts — which storage buckets are public, which IAM policies are over-privileged, and which services have logging disabled — presented as a visual report the team can work through service by service. Which tool is the BEST fit?

1. Prowler
2. ScoutSuite
3. Trivy
4. Checkov

27. CertCrack.com's CI pipeline is about to publish a new container image for the payments API. Policy states the build must fail if the image contains any CRITICAL vulnerability or an embedded secret, and the release record must include a software bill of materials. Which tool enforces this in the pipeline?

1. Nessus
2. OpenVAS
3. ScoutSuite
4. Trivy

28. A developer at CertCrack.com opens a pull request whose Terraform would create a storage bucket with public access enabled. The security team wants this caught automatically before merge, with the failing policy named in the pull request. Which tool provides this gate?

1. ScoutSuite, scheduled to audit the account after the next deployment
2. Checkov, scanning the Terraform code in CI and failing the pull request on the public-access policy
3. Prowler, run manually by the cloud team each Friday
4. Trivy, scanning the bucket after it has been created

29. An incident at CertCrack.com began with exploitation of a known CVE on an Internet-facing server. Before finalising the root-cause report, the IR lead wants technical confirmation that the CVE is genuinely exploitable on that server's exact software version — not merely listed by a scanner. Which action provides that confirmation?

1. Run the corresponding Metasploit exploit module against a clone of the server in the lab and observe whether it yields a session
2. Re-run the vulnerability scan with a second scanner and compare the two reports
3. Check the CVE's CVSS score and record it as proof of exploitation
4. Ask the server's administrator whether the patch was applied

30. An external auditor asks CertCrack.com for evidence of how its Azure subscriptions score against recognised cloud security benchmarks, control by control, in a format the audit team can import into its own tooling. Which tool should the security team run?

1. Prowler
2. ScoutSuite
3. Nikto
4. Nuclei