Which of the following is the most difficult for threat actors to change according to the Pyramid of Pain model?
Answer(s): A
TTPs reflect an attacker’s established behavior and operational methods, making them much harder to change than tools, domains, or IP addresses.
An analyst is assigned to a new cybersecurity improvement project. The analyst wants to better understand the workflow processes and the skill set of the cybersecurity engineers on this task force. The analyst sets up a recurring, weekly conference call. Which of the following best describes the purpose for the conference call?
Answer(s): C
A recurring team call supports information sharing, workflow alignment, role awareness, and coordination among the cybersecurity engineers.
A security analyst uses a full pcap solution to extract all traffic from the last two days associated with the 10.213.4.27 file server. This file server is under investigation due to concerns about potential data exfiltration using Domain Name System (DNS) traffic. Which of the following commands should the analyst use to extract any potentially leaked data from the suspicious.pcap file?
Answer(s): D
This command reads the packet capture and filters traffic involving the file server on DNS port 53, allowing the analyst to inspect potential DNS-based data exfiltration.
An analyst is configuring a security information and event management system to capture fileless malware execution events. Which of the following log files requires additional configuration to accomplish this task?
Answer(s): B
Fileless malware commonly executes through PowerShell. Enhanced PowerShell logging, such as script block and module logging, must be specifically enabled to capture detailed execution activity for the SIEM.
A binary file that might contain malicious code is hosted on an isolated machine. An analyst wants to quickly detect the malicious code. Which of the following should the analyst use?
YARA scans files locally for patterns and signatures associated with known malware. It is appropriate for an isolated system, whereas VirusTotal requires uploading or querying the file online.
A security analyst analyzes the output of a web application access log for a company based in the United States. Given the following output:Which of the following users should be investigated first?
tlindy has a successful login from a Russian IP address between successful U.S.-based logins, indicating a potentially compromised account or impossible-travel activity. The other Russian login attempts shown were unsuccessful.
An analyst reviews the following system logs from a recent breach attempt:Which of the following techniques did the attacker attempt to use?
The attacker used sudo, su, and linpeas.sh to move from lower-privileged accounts to the root account, demonstrating privilege escalation.
An analyst reviews the following log entries:Which of the following conclusions should the analyst reach? (Choose two.)
Answer(s): A,D
ws-57 connects to many common service ports on dc-1 within seconds, indicating a port scan. It also uses HTTPS over port 53, which is a non-standard port for HTTPS.
Post your Comments and Discuss CompTIA CS0-004 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-004 content, but please register or login to continue.