Tool Index — Every Named Tool in One View

CHECK YOURSELF — Toolkit chapter

Answer each question before reading the key. Every scenario is set at CertCrack.com.

1. CertCrack.com's cloud team wants a check-by-check report of its AWS accounts against the CIS AWS Foundations Benchmark, in a format the external auditor can consume directly. Which tool fits best? A. ScoutSuite B. Prowler C. Trivy D. Checkov

2. A container image for CertCrack.com's payments service must not ship if it contains critical CVEs or leaked secrets, and the pipeline needs an SBOM for the release record. Which tool covers all three? A. Nessus B. Nuclei C. Trivy D. OpenVAS

3. Before sign-off, CertCrack.com's SOC lead wants proof that the EDR detects one specific technique — PowerShell execution as described in MITRE ATT&CK — and nothing broader. What should the team run? A. A Caldera operation B. An Atomic Red Team test C. A Masscan sweep D. A Recon-ng module

4. The purple team wants a recurring, automated exercise in which an agent on a test host chains several ATT&CK techniques together and adapts as it goes, emulating a campaign rather than a single action. Which platform? A. Atomic Red Team B. Metasploit Framework C. Caldera D. Maltego

5. An incident responder must reconstruct two weeks of DNS lookups made by a compromised host. Full packet captures were rotated away after 48 hours. Which data source was designed for exactly this? A. Wireshark live capture B. Zeek dns.log records C. Nikto findings D. YARA matches

6. CertCrack.com's vulnerability team must confirm, today, whether any of 500 web servers is exposed to one newly published CVE. Speed matters more than a full assessment. Which scanner? A. Nessus (full credentialed scan) B. OpenVAS C. Nuclei with a template for that CVE D. Nikto

7. During a web assessment, the analyst must intercept a checkout request, change the account ID in it, replay it, and see whether the application returns another customer's order. Which tool is built for this? A. Nikto B. Burp Suite C. Masscan D. ScoutSuite

8. CertCrack.com is migrating SIEMs and wants its library of log detections to survive the move instead of being rewritten per platform. Which format should the detections be written in? A. YARA B. Sigma C. NSE D. EVE JSON

Answer key

1. B. Prowler's checks are mapped to benchmarks such as CIS, with PASS/FAIL output auditors consume. ScoutSuite audits posture broadly but is not the benchmark-evidence tool; Trivy scans artefacts, not live accounts; Checkov reads code before deployment.

2. C. Trivy scans container images for CVEs, secrets, and misconfigurations and can generate an SBOM. Nessus and OpenVAS are host/network vulnerability scanners; Nuclei verifies template-described issues on running targets.

3. B. Atomic Red Team is a library of single-technique tests mapped to ATT&CK — built for validating one detection at a time. A Caldera operation chains techniques into a campaign; Masscan and Recon-ng are not detection-validation tools.

4. C. Caldera runs automated, planner-driven operations that chain abilities across agents. Atomic Red Team executes individual techniques; Metasploit exploits vulnerabilities rather than emulating chained campaigns; Maltego is OSINT graphing.

5. B. Zeek writes structured logs (including dns.log) designed for retention, hunting, and reconstruction. Wireshark needs packets that no longer exist; Nikto scans web servers; YARA matches files.

6. C. Nuclei's template model exists for exactly this: one check, many targets, fast. Full Nessus or OpenVAS scans are heavier general assessments; Nikto checks server hygiene, not a specific CVE across an estate.

7. B. Burp Suite's intercepting proxy with Repeater is the hands-on request-tampering tool. Nikto never interacts with application workflows; Masscan finds ports; ScoutSuite audits cloud accounts.

8. B. Sigma is the vendor-neutral detection format with converters for many SIEMs. YARA classifies files; NSE is Nmap's scripting engine; EVE JSON is Suricata's output format, not a portable rule language.

End of supplement chapter. Every tool name, category, and distinction in this chapter follows the official CompTIA CS0-004 exam objectives. Tool-output samples are illustrated examples created for this book and are labelled as such wherever they appear.

End of the Analyst Toolkit. Every tool name, category, and distinction follows the official CompTIA CS0-004 exam objectives. Tool-output samples are illustrated examples created for this book and are labelled as such wherever they appear.