CySA+ CS0-004 Practice Questions & Answers • ExamPrepare

121 questions in this view

Page 1 of 21

Question 1

A security analyst drafts an incident response report. Which of the following will most likely be included in the executive summary? (Select two).

The cost of the incident
A detailed analysis of malware infection
Forensic analysis findings
Root cause analysis logs
The number of machines impacted
The mean time to remediate

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Which of the following describes the main benefits of MITRE ATT&CK Navigator?

Replicating adversary behavior and blocking gaps in defenses
Monitoring adversary behavior and performing malware reverse engineering
Responding to adversary behavior and building security defense tools
Understanding adversary behavior and identifying gaps in defenses

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A security operations (SOC) manager develops response mechanisms as part of playbook development efforts. The SOC manager needs to accomplish the following:

• Document adversarial activities.

• Map adversarial activities to a linear progression of sequential phases.

• Provide broad coverage of threat actions without addressing specific tactics, techniques, and procedures (TTPs).

Which of the following is the most reliable source for this information?

MITRE ATT&CK
Cyber COBRA
Diamond Model of Intrusion Analysis
Cyber Kill Chain

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Which of the following is a possible inhibitor to remediating vulnerabilities?

An organization changes its approach to prioritizing remediation, but these changes are not updated in a contractual agreement with the service provider.
An organization has a well-established approach for implementing compensating controls and decides to accept vulnerabilities that have remediations.
An organization has made a significant investment in eliminating legacy systems and automates patching and system reconfiguration.
An organization updates its malware and antivirus detection to AI-based agents, which results in fewer vulnerabilities that require remediation.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A cybersecurity team quarantines a virtual machine (VM) that has triggered alerts. However, this action does not stop the threat. Similar alerts are occurring for other VMs in the same broadcast domain. Which of the following steps in the incident response process should the team take next?

Escalate the incident to the Chief Information Security Officer and request approval to notify the legal department.
Switch back to the analysis phase and gather additional data.
Move to the eradication phase and begin deleting suspicious files.
Continue with the containment phase and isolate the subnet.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Which of the following best describes a company's risk appetite?

The number of risks that a company can accept as active after performing each risk assessment
The minimum amount of residual risk that a company can accept for any existing item after the proper risk treatment
The amount of money that a company can spend on risk treatment based on a risk assessment
The amount of risk that a company can accept based on trade-offs as defined by the company board or executive management

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.