Free Practice Questions for CompTIA CS0-004 Exam

Tactics, techniques, and procedures represent the behavioral characteristics of an adversary rather than merely individual technical artifacts. A tactic describes the adversary's objective, a technique identifies how that objective is achieved, and procedures represent the specific implementation observed during an intrusion. Consequently, TTP intelligence allows defenders to understand how an attacker operates , including patterns of reconnaissance, persistence, privilege escalation, lateral movement, command-and-control activity, and other operational behaviors.

Options A and B focus primarily on indicators of compromise such as IP addresses and hashes. These are useful for detection, but they are comparatively fragile because attackers can replace infrastructure, change domains, regenerate malware, or modify files to produce different hashes. Option C is broader than an individual IoC, but tools can likewise be replaced or modified. Behavioral knowledge is generally more durable because changing established operational methods imposes greater cost on an adversary.

The CS0-004 objectives explicitly place TTPs, Pyramid of Pain, MITRE ATT & CK, attribution, IoC analysis, and behavioral indicators within threat intelligence and threat-hunting concepts.

Study Guide Reference: Security Operations → Threat Intelligence and Threat Hunting → TTPs → Pyramid of Pain → MITRE ATT & CK → Behavioral IoCs.

The log relationships support two conclusions: ws-57 is scanning dc-1 , and ws-57 is communicating with a service through a non-standard port . Network scanning is normally identified when one source system attempts connections against multiple ports or services on another host over a short period. Here, the directionality of the recorded communications identifies ws-57 as the initiating host and dc-1 as the target, supporting option A rather than B.

Port numbers then need to be interpreted in context. Standard service-port mappings provide useful baselines, but a service can technically operate on a port different from its conventional assignment. Detection logic therefore needs to consider both the actual port number and the protocol or service identified in the traffic. Nmap, for example, classifies scanned ports according to states and attempts to associate ports with known services during network reconnaissance.

The entries do not provide sufficient behavioral evidence for phishing delivery or ransomware infection. Those conclusions would require additional indicators such as SMTP message evidence, malicious attachments, encryption activity, process execution, or endpoint telemetry.

The correct analytical approach is to determine source, destination, connection pattern, and port/service relationship before assigning malicious intent.

Study Guide Reference: Security Operations → Network Log Analysis → Scanning/Enumeration → Source/Destination Interpretation → Ports and Protocols → Non-standard Service Ports.

The original scan fails because Nmap's host-discovery process concludes that the target appears offline before conducting the intended full port scan. Option C adds -Pn , instructing Nmap to skip normal host discovery and proceed with scanning the target as though it is online. The -p- option then instructs Nmap to test the complete TCP port range rather than only its default set.

This is appropriate when a live host does not respond to discovery probes because ICMP echo traffic or other discovery packets may be filtered by firewalls, host-based controls, or network policy. A system can therefore appear “down” to Nmap's discovery phase while still exposing reachable TCP services.

Option B uses -sn, which performs host discovery without a port scan and therefore contradicts the requirement. Option A scans only a limited set of explicitly identified ports and includes unrelated functionality. Option D unnecessarily changes the scope to an entire /24, performs operating-system detection and DNS resolution, and invokes an SSL cipher script; none of those modifications addresses the immediate host-discovery problem.

Study Guide Reference: Vulnerability Management → Nmap → Host Discovery → -Pn → Full Port Scanning -p- → Firewall/ICMP Filtering → Scan Troubleshooting.

A honeypot is the strongest choice because the objective is not merely to block activity but to collect detailed intelligence about how adversaries are scanning, enumerating, and interacting with the organization. A properly isolated honeypot deliberately presents an attractive target while allowing defenders to observe attacker behavior without exposing legitimate production assets.

The resulting telemetry can reveal source infrastructure, targeted services, enumeration sequences, exploit attempts, command patterns, tools, payloads, and potentially broader TTPs. MITRE D3FEND defines a decoy environment as hosts and networks established specifically to deceive an attacker, and describes honeypots as decoy network resources that can expose an attacker's potential intent and strategy.

Canary tokens are valuable high-confidence tripwires but generally provide narrower detection evidence. Threat-intelligence subscriptions provide external intelligence and may help with prioritization, yet they will not provide the same organization-specific visibility into actors actively interacting with the company's exposed environment. A WAF can log web attacks and block malicious requests, but its visibility is primarily limited to web application traffic.

Study Guide Reference: Security Operations → Threat Intelligence → Threat Hunting → Deception Technologies → Honeypots/Honeynets → Adversary TTP Collection.

The Microsoft-Windows-PowerShell/Operational log is the appropriate source because PowerShell is commonly involved in script-based and memory-oriented attack activity, including techniques associated with fileless malware. The key requirement in the question is “requires additional configuration”: advanced PowerShell telemetry such as Script Block Logging must be enabled to provide the detailed execution visibility required by a SIEM.

Microsoft documents that enabling Script Block Logging causes PowerShell to record processed commands, functions, scripts, and script blocks in the Microsoft-Windows-PowerShell/Operational channel. In Windows PowerShell, Script Block Logging generates Event ID 4104 , which contains script-block content and can provide valuable evidence when investigating malicious PowerShell execution. Microsoft also specifically identifies malicious PowerShell scripts as a post-exploitation technique associated with fileless attack activity.

The DPAPI operational log concerns cryptographic data-protection activity. UserPnp/DeviceInstall relates to device installation events, while TerminalServices-LocalSessionManager provides Remote Desktop and terminal-session telemetry. Those sources can be valuable during investigations but are not the primary log channel for capturing PowerShell-based fileless execution.

Study Guide Reference: Security Operations → Logging and Monitoring → Windows Event Logs → PowerShell Logging → Event ID 4104 → Script Block Logging → Fileless Malware Detection.

A Privileged Access Management (PAM) solution provides the strongest control for credentials with root, domain administrator, and local administrative authority. Vulnerability scanners frequently require elevated permissions for credentialed assessments, but permanently exposing those credentials to scanning infrastructure creates substantial risk. If compromised, the scanner could provide an attacker with privileged access across a large portion of the environment.

PAM systems can protect privileged credentials through centralized vaulting, controlled checkout, tokenized or brokered authentication, rotation, session restrictions, auditing, and time-limited privilege. This aligns with the principle of least privilege, under which entities should receive only the access necessary to perform assigned functions. NIST defines least privilege in precisely this manner and applies the principle to privileged accounts.

Single sign-on improves authentication convenience but does not adequately secure highly privileged scanning credentials. A simple one-time password adds authentication assurance but lacks the credential governance and lifecycle controls provided by PAM. Agentless scanning changes scanner architecture but does not solve the underlying privileged-access requirement.

The strongest design is therefore to place high-impact administrative credentials under dedicated privileged-access controls rather than treating them as ordinary service credentials.

Study Guide Reference: Vulnerability Management → Credentialed Scanning → Scanner Permissions → PAM → Least Privilege → Credential Vaulting and Rotation.

Rebuilding the environment from infrastructure-as-code definitions is a recovery activity because the organization is restoring trusted operational capability after the ransomware incident has been controlled. IaC provides a particularly effective recovery mechanism because infrastructure can be reconstructed according to predefined, version-controlled configurations instead of attempting to repair every potentially compromised component manually.

During detection and analysis, responders establish that malicious activity occurred and determine its scope. Containment limits additional damage or spread. Eradication removes malicious artifacts, persistence, compromised credentials, and the underlying causes of the incident. Recovery then restores affected systems and services to normal operation while ensuring they are returned in a trustworthy state.

NIST defines recovery as the restoration of assets and operations affected by cybersecurity incidents and emphasizes verifying restored assets before normal operations resume. Tearing down potentially compromised infrastructure and deploying fresh resources from controlled IaC templates directly fulfills that purpose.

Post-incident activities occur after operational restoration and focus on lessons learned, reporting, process improvement, and corrective recommendations.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Recovery → Infrastructure as Code → Rebuilding from Known-Good Configurations → Validation.

The analyst completed substantial analysis by validating the URL, confirming its credential-harvesting purpose, and establishing that the user accessed the malicious site. However, the investigation was closed without performing adequate containment . Even though there is no evidence that stolen credentials were subsequently used, the user's authentication material must be considered potentially exposed because the phishing site was specifically designed to collect credentials.

Containment should reduce the immediate opportunity for an attacker to exploit that exposure. Appropriate measures can include resetting the affected password, revoking active authentication sessions or tokens, temporarily restricting the account when warranted, blocking the malicious URL or domain, and checking the endpoint for additional malicious activity. The absence of observed credential misuse does not establish that credential capture did not occur.

Remedial training is valuable, but it is principally a corrective or post-incident measure and does not neutralize the immediate technical risk. Recovery would follow containment and eradication when affected services or systems require restoration.

NIST's current incident-response guidance emphasizes effective detection, response, and recovery actions to reduce incident impact rather than stopping after validation.

Study Guide Reference: Incident Response and Management → Incident Response Process → Analysis → Containment → Eradication → Recovery → Post-Incident Activities.

Triage occurs during the analysis phase because responders must determine what an alert represents, how serious it is, which assets are affected, and what response priority should be assigned before taking broader containment or recovery actions.

Triage typically involves validating the alert, gathering supporting telemetry, establishing whether the event is a true positive, determining scope and impact, identifying affected identities or systems, correlating indicators, and assigning severity. The outcome provides the evidence required to decide whether an event should be escalated into formal incident handling and what subsequent actions are justified. NIST incident-handling guidance has historically emphasized analyzing incident-related information in order to determine the appropriate response, while the current NIST framework continues to emphasize efficient incident detection, response, and recovery.

Isolation belongs to containment because it restricts the compromised asset's ability to communicate or spread malicious activity. Reimaging normally occurs during recovery after the environment has been contained and malicious persistence addressed. Alert writing is part of detection engineering or security-monitoring operations rather than a defining incident-analysis activity.

The sequence is therefore important: detect → analyze/triage → contain → eradicate → recover → conduct post-incident activities .

Study Guide Reference: Incident Response and Management → Incident Response Process → Detection → Analysis/Triage → Containment → Eradication → Recovery.

Compensating controls are appropriate when the preferred remediation cannot currently be implemented but the organization must still reduce exposure. A mission-critical system with an unpatched vulnerability for which no vendor patch exists is a classic example. The system cannot simply be removed from service because the business requires it, and conventional patching is unavailable.

The organization may therefore deploy alternative controls such as network segmentation, restrictive firewall rules, application allowlisting, disabling unnecessary services, enhanced monitoring, IPS signatures, access restrictions, or isolation of affected functionality. These measures do not eliminate the underlying defect; instead, they reduce the probability or impact of exploitation while a permanent solution is developed.

NIST's control framework is designed to allow security controls to be selected and tailored according to organizational mission requirements and risk, supporting the broader principle that organizations may apply appropriate alternative safeguards when operational constraints exist.

Option B requires no compensating control because remediation has already occurred. Option C describes a vulnerability that is not applicable to the organization's systems. Option D represents a false positive and therefore does not constitute an actual exposure requiring mitigation.

Study Guide Reference: Vulnerability Management → Mitigation → Compensating Controls → Patch Availability → Mission-Critical Systems → Segmentation and Monitoring.