Which of the following is the most important reason why tactics, techniques, and procedures (TTP) are beneficial to a defensive strategy?
Answer(s): D
TTPs describe how an adversary operates. These behavioral patterns are generally more durable and strategically useful for detection and defense than easily changed indicators such as IP addresses, hashes, or tools.
Which of the following is the best reason to heavily segment business-critical assets from within the network?
Answer(s): A
Legacy systems may be unsupported or unable to receive security patches. Strong network segmentation limits their exposure and prevents attackers from easily reaching them through lateral movement.
A cybersecurity analyst receives an unstructured text document that contains advanced persistent threat (APT)-related indicators of compromise (IoCs). The analyst needs to extract the IPv4 addresses. Which of the following is the best tool to accomplish this task?
CyberChef can parse unstructured text and extract IPv4 addresses using built-in extraction and regular-expression operations. Wireshark and Zeek analyze network traffic, while OpenCTI manages threat intelligence.
Which of the following best describes why operational technology (OT) devices use compensating controls?
Answer(s): C
OT systems often use specialized, legacy, or availability-sensitive equipment that cannot support conventional security tools or patches. Compensating controls provide alternative protection without disrupting operations.
The Chief Information Security Officer (CISO) reviews the following security operations metrics from the last month:Which of the following is the best action to improve overall security operations efficiency?
Answer(s): B
The large number of alerts and investigations compared with only five confirmed incidents indicates excessive non-actionable alerts. Tuning detection rules reduces false positives and unnecessary analyst workload.
A public threat intelligence report includes indicators of compromise (IoCs) for threat actors. The threat actors are exploiting a zero-day vulnerability that the vendor has not fixed. Which of the following techniques should be used until a patch is available?
Until a patch is available, the organization should continuously monitor systems and network activity for the reported IoCs to detect attempted or successful exploitation quickly.
The Chief Information Security Officer wants to improve internal security measures by continuously validating and verifying access to the production environment. Which of the following concepts best describes this practice?
Zero Trust follows the principle of “never trust, always verify,” continuously validating users, devices, and access requests rather than trusting them based on network location.
Which of the following allows an organization to leverage AI in various forms while protecting business objectives and data?
AI usage policies define approved tools, permitted data, acceptable use, and security requirements, enabling AI adoption while protecting organizational information and objectives.
Post your Comments and Discuss CompTIA CS0-004 exam prep with other Community members: