A security operations center analyst is using the command line to display specific traffic. The analyst uses the following command:$tshark -r file.pcap -Y "http or udp"Which of the following will the command line display?
Answer(s): B
The http display filter selects plaintext HTTP traffic, while udp includes UDP-based traffic such as standard DNS queries. HTTPS traffic is not matched as HTTP because it is encrypted.
Which of the following network architectures would best implement a perimeter-less network topology?
SASE delivers networking and security controls through cloud-based services, protecting users and resources regardless of location instead of relying on a traditional network perimeter.
A new security operations center (SOC) manager joins a team that struggles to meet service-level agreements (SLAs). The alert backlog continues to increase daily. Which of the following will the manager most likely need to do?
Efficient triage prioritizes alerts by severity and risk, reduces time spent on low-value alerts, and helps the SOC process its backlog within SLA requirements.
Which of the following should a cybersecurity analyst utilize when a notification is inaccurate?
Answer(s): D
Alert tuning adjusts detection rules, thresholds, and conditions to reduce false positives and improve notification accuracy.
A Chief Information Security Officer (CISO) evaluates a threat heat map and notices a substantial increase in custom scanning and enumeration activities. The CISO wants to gather as much information as possible about the activities targeting the company to help prioritize mitigations. Which of the following solutions is the best way to accomplish this goal?
Answer(s): A
A honeypot safely attracts attackers and records detailed, organization-specific scanning, enumeration, and exploitation behavior without exposing production systems.
An analyst uses an AI platform to help correlate events. The AI output contains events that did not happen. This results in inaccurate correlations. Which of the following best describes what has occurred?
AI hallucinations occur when a model generates false or fabricated information, such as security events that never happened.
A security analyst must identify documents that contain encoded ActiveMime payloads in a directory containing thousands of files. The analyst runs the following command:grep -rail ActiveMime *The command returns no output. Which of the following Yet Another Recursive Acronym (YARA) rules should the analyst use to find the suspicious files?
Answer(s): C
The payload contains an encoded ActiveMime string, so the YARA base64 modifier searches for its Base64-encoded forms. A normal grep search cannot find the plaintext string.
An analyst executes the top command on a Linux system for an unresponsive application and observes the following output:Which of the following is the most likely cause of this issue?
The python process is consuming 91.2% CPU and 96% memory, exhausting system resources and causing the application to become unresponsive.
Post your Comments and Discuss CompTIA CS0-004 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-004 content, but please register or login to continue.