Free Practice Questions for CompTIA CS0-004 Exam

MITRE ATT & CK Navigator is primarily a visualization and analytical tool for understanding adversary behavior and evaluating defensive coverage against ATT & CK tactics and techniques. Analysts can create layers over ATT & CK matrices, highlight techniques associated with specific threat groups, compare adversary profiles, record detection coverage, and identify techniques for which defensive visibility or controls are insufficient.

MITRE explicitly states that ATT & CK Navigator can be used to visualize defensive coverage, support red-team and blue-team planning, and represent the frequency of detected techniques. MITRE's ATT & CK design guidance also recognizes defensive gap assessment as a means of identifying areas where an enterprise lacks sufficient defenses or visibility.

Navigator itself does not replicate adversary behavior; adversary-emulation platforms and red-team tools perform that function. It is not a malware reverse-engineering platform, nor does it independently build defensive tools or execute incident-response actions.

Its major operational value is translating ATT & CK's behavioral knowledge base into a visual map that lets defenders answer two questions: What behaviors are relevant to the threats we face, and where do our detections or controls have gaps?

Study Guide Reference: Security Operations → MITRE ATT & CK → ATT & CK Navigator → Tactics and Techniques → Threat Mapping → Detection Coverage → Gap Analysis.

The analyst must construct an accurate incident timeline . Patient zero is the earliest compromised system from which subsequent malicious activity originated or propagated. Determining it requires ordering events chronologically across all affected hosts and correlating authentication activity, process execution, network connections, malware creation times, lateral movement, and other evidence.

Raw logs alone do not communicate this sequence effectively. Logs from different systems must first use reliable timestamps and then be normalized and correlated. Once events are ordered, the analyst can work backward from known compromises to determine which host displayed the earliest credible signs of intrusion and whether subsequent systems were reached from that host.

Enabling additional monitoring helps detect future activity but does not reconstruct historical sequence by itself. Isolation is necessary during containment but does not establish which system was initially compromised. Shift-handoff improvements are useful organizationally but do not answer the forensic question. Malware composition analysis may identify relationships between samples, but it does not establish system-level chronology.

NIST's incident-response guidance emphasizes analysis, documentation, root-cause understanding, and after-action reporting as inputs to continuous improvement.

Study Guide Reference: Incident Response and Management → Timeline Analysis → Event Correlation → Patient Zero → Root Cause Analysis → After-Action Review.

Improving the triage process addresses the underlying operational bottleneck described in the scenario. SOC triage determines which alerts require investigation, their relative severity, whether they represent true or false positives, and which cases require escalation. When triage is inefficient, alerts accumulate faster than analysts can classify them, causing backlog growth and SLA violations.

A mature triage workflow applies consistent severity criteria, asset criticality, threat context, confidence levels, enrichment, deduplication, and predefined escalation thresholds. This reduces analyst effort spent on low-value events while ensuring genuinely dangerous alerts reach investigators quickly. Modern SIEM and security analytics platforms similarly emphasize grouping and correlating alerts into incidents to reduce unnecessary investigation workload. Microsoft Sentinel, for example, uses analytics and correlation to reduce noise and consolidate related alerts into incidents.

Automating escalation does not resolve poor initial classification and can simply transfer excessive noise downstream. Better threat intelligence may enrich alerts but will not inherently correct a dysfunctional queue. Customer-service response is unrelated to SOC alert processing.

Study Guide Reference: Security Operations → SOC Operations → Alert Management → Triage → Prioritization → Escalation Procedures → Process Improvement.

Mean time to close is the most relevant measurement because the manager needs to quantify how long cases or incidents remain open before all required closure activities—including after-action documentation—are completed.

An incident may already be technically contained and remediated while administrative closure remains outstanding. Mean time to remediate measures how long it takes to correct or neutralize the security problem, but it does not necessarily include final reporting and formal case closure. Mean time to respond measures how quickly responders begin or perform response activity after detection. Mean time between failures is primarily a reliability metric describing the average operating duration between failures and does not measure SOC reporting performance.

Current Microsoft Sentinel SOC guidance explicitly includes mean time to closure and time-to-closure percentiles among incident-management metrics used to evaluate SOC performance. This directly maps to the manager's concern: if after-action reports delay completion of incidents, the organization's mean closure time will increase and can be trended by analyst, severity, team, or incident category.

Therefore, B provides the quantitative evidence needed to determine whether after-action reporting is preventing incidents from being closed promptly.

Study Guide Reference: Reporting and Communication → Incident Metrics → Mean Time to Close → After-Action Reporting → SOC Performance Measurement → Continuous Improvement.

Clearly defined roles and responsibilities are foundational to incident-response preparation because responders must know in advance who has authority to make decisions and who performs specific technical, management, legal, communications, and recovery functions. Attempting to determine ownership while an active compromise is developing introduces delays, duplicated effort, communication failures, and potentially conflicting actions.

Preparation should define escalation paths, decision-making authority, contact mechanisms, incident leadership, technical responsibilities, evidence-management responsibilities, and coordination with business, legal, privacy, communications, and external parties where applicable. NIST's current incident-response guidance emphasizes preparation across organizational risk-management activities so organizations can respond and recover efficiently when incidents occur.

An after-action report is produced after an incident and documents the event, response actions, recovery, and lessons learned. Data-integrity validation is important during evidence analysis and recovery but is not the primary organizational foundation of preparation. Chain of custody must be established when evidence is collected and transferred, particularly where legal proceedings may occur, but it represents one procedure within a broader incident-response capability.

Without predefined ownership, even technically sound procedures may fail operationally.

Study Guide Reference: Incident Response and Management → Preparation → Incident Response Plan → Roles and Responsibilities → Escalation → Communication → Authority and Coordination.

The Diamond Model of Intrusion Analysis is specifically suited to visually representing relationships between a threat actor, the infrastructure used during an intrusion, the actor's capabilities, and the victim. Its four principal vertices are adversary, infrastructure, capability, and victim . IP addresses and network services naturally map to infrastructure, while malware and attack tools map to capability.

The original Diamond Model describes an intrusion event through these four interconnected features and uses their relationships to support documentation, correlation, and analysis of malicious activity. This makes it particularly useful when the analyst wants to visualize intelligence rather than simply place activity into chronological stages.

EPSS predicts the probability that a vulnerability will be exploited and therefore does not model threat-actor infrastructure. The Cyber Kill Chain represents progressive stages of an intrusion, making it useful for understanding attack progression but less suitable for relational visualization. MITRE ATT & CK provides detailed behavioral information on adversary tactics and techniques; MITRE itself notes that ATT & CK and the Diamond Model are complementary, with the Diamond Model particularly useful for clustering and relating intrusion information.

Study Guide Reference: Security Operations → Threat Intelligence → Diamond Model → Adversary → Infrastructure → Capability → Victim → Threat Visualization.

A lessons learned review evaluates how the incident was handled and identifies improvements that should be incorporated into future response activities. It examines what worked well, what created delays, where communications or escalation failed, whether tools and playbooks were effective, and which corrective actions should be assigned to reduce the likelihood or impact of similar incidents.

NIST's current incident-response guidance places strong emphasis on continuous improvement. It states that lessons identified during incident-response activities should feed into organizational improvement so policies, processes, practices, and security capabilities can be adjusted as necessary. NIST also notes that traditional post-incident activities identify required improvements and return them to preparation and broader cybersecurity risk management.

KPIs quantify operational performance but do not themselves provide the qualitative review necessary to identify process efficiencies and corrective actions. An executive summary communicates major incident facts and outcomes to leadership. Root cause analysis focuses on identifying the fundamental technical or organizational cause of the incident; it can contribute to lessons learned but is narrower in scope.

Therefore, the broader mechanism for reviewing the entire response process and developing improvement actions is the lessons-learned process.

Study Guide Reference: Reporting and Communication → Post-Incident Reporting → Lessons Learned → Corrective Actions → Process Improvement → Stakeholder Feedback.

A service-level agreement (SLA) formally establishes measurable service expectations between a provider and a customer. These expectations commonly include availability targets, response times, resolution times, service quality thresholds, escalation conditions, reporting requirements, and other measurable performance indicators. NIST describes an SLA as a document that specifies technical performance promises and how performance or disputes will be handled. NIST security-control guidance also notes that service-level agreements can define performance expectations and measurable outcomes.

That makes an SLA the appropriate document when management needs to determine whether contractual performance requirements were violated. KPIs contained in the agreement provide objective measures against which actual service performance can be compared.

TTPs describe adversary behavior and have no contractual purpose. A return-on-investment report evaluates financial effectiveness rather than service obligations. A risk management plan describes how organizational risks will be identified and treated. A memorandum of understanding records cooperation or intent between parties, but it typically does not provide the detailed operational performance guarantees associated with an SLA.

The clues are customer, signed agreement, contractual breach, and measurable KPIs —all of which strongly identify a service-level agreement.

Study Guide Reference: Reporting and Communication → Service-Level Agreements → KPIs → Contractual Requirements → Performance Metrics → Compliance and Escalation.

A zero-day vulnerability presents a special remediation problem because the affected organization may have confirmed exposure while no vendor patch is available. Until permanent remediation becomes possible, the organization should increase continuous monitoring for evidence that the vulnerability is being targeted or exploited. Threat-intelligence IoCs can be incorporated into SIEM, EDR, IDS/IPS, network monitoring, and threat-hunting workflows to identify suspicious connections, processes, authentication events, or other behaviors associated with the threat actor.

Continuous monitoring does not eliminate the vulnerability, but it strengthens detection capability during the exposure window and supports rapid containment if exploitation occurs. This approach should ordinarily be combined with available compensating controls such as segmentation, access restrictions, service disabling, configuration changes, or other vendor-recommended workarounds.

Sinkholing is primarily used to redirect malicious network traffic, particularly command-and-control or malicious-domain traffic, and is not a general solution for an unpatched zero-day. Eradication occurs after malicious artifacts or persistence mechanisms have been identified during incident response. Evidence acquisition is a forensic activity and does not reduce the immediate exploitation risk.

CS0-004 requires analysts to consider active exploitation/threat intelligence, patch/remediation availability, context, and compensating controls when prioritizing and mitigating vulnerabilities.

Study Guide Reference: Vulnerability Management → Prioritization → Active Exploitation → Patch Availability → Compensating Controls and Continuous Monitoring.