Which of the following best explains the purpose of the Pyramid of Pain in threat intelligence?
Answer(s): A
The Pyramid of Pain ranks indicators by how difficult they are for an attacker to replace. IP addresses and hashes are easy to change, while tools and TTPs are much harder.
A security operations center (SOC) analyst investigates the results of a password spray test conducted by the vulnerability management team. The analyst must:-Identify Linux systems that have successful and unsuccessful logins with username "User1".-Create an output report named "linux-events" of all the events to a flat file.The analyst issues the following console command:ls /var/log/The shortened output of the command is below:Which of the following commands should the analyst use to meet the report output requirements?
Answer(s): D
/var/log/auth.log contains Linux authentication events, including successful and failed login attempts. grep selects entries for User1, and > writes them to the required flat file.
Multiple users report unexpected mouse movements and terminal windows opening. An analyst reviewing the network traffic logs observes the following:Which of the following is the most likely reason for the reported symptoms?
TCP port 5900 is the standard port for VNC, which provides interactive remote control of a system’s desktop, including mouse movement and opening terminal windows.
Which of the following best explains why sensitive data should be encrypted at rest on laptops?
Answer(s): B
Encryption at rest protects the confidentiality of stored data by preventing unauthorized access when a laptop or its storage device is lost or stolen.
A security architect works with a client on security operations center (SOC) capabilities. The security architect wants to ensure the log correlation and investigation activities are accurate across the infrastructure. Which of the following is the best for the client to implement?
NTP synchronizes system clocks across the infrastructure, ensuring log timestamps align for accurate event correlation and incident timeline analysis.
A team lead asks an analyst to integrate multiple security tools to provide an enhanced view into data that is not readily available in the tool console. Which of the following will best meet this requirement?
APIs enable security tools to exchange information and retrieve data or functionality that may not be exposed through their standard consoles.
A cybersecurity analyst requests a paid subscription to a threat intelligence feed relevant to a company's industry. Which of the following best describes this type of feed?
A paid, subscription-based threat intelligence feed is proprietary and available only to authorized subscribers, making it closed-source intelligence.
HOTSPOT (Drag and Drop is not supported)A systems administrator is reviewing the output of a vulnerability scan.INSTRUCTIONSReview the information in each tab.Based on the organization’s environment architecture and remediation standards, select the server to be patched within 14 days and select the appropriate technique and mitigation.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.Hot Area:
192.168.60.90 is an operations server with a CVSS score of 8.1, requiring remediation within 14 calendar days. Restricting the server to modern cipher suites directly mitigates the identified TLS downgrade vulnerability.
Post your Comments and Discuss CompTIA CS0-004 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-004 content, but please register or login to continue.