Pass the CompTIA CySA+ CS0-004 Questions and answers with ExamsMirror

The original scan fails because Nmap's host-discovery process concludes that the target appears offline before conducting the intended full port scan. Option C adds -Pn , instructing Nmap to skip normal host discovery and proceed with scanning the target as though it is online. The -p- option then instructs Nmap to test the complete TCP port range rather than only its default set.

This is appropriate when a live host does not respond to discovery probes because ICMP echo traffic or other discovery packets may be filtered by firewalls, host-based controls, or network policy. A system can therefore appear “down” to Nmap's discovery phase while still exposing reachable TCP services.

Option B uses -sn, which performs host discovery without a port scan and therefore contradicts the requirement. Option A scans only a limited set of explicitly identified ports and includes unrelated functionality. Option D unnecessarily changes the scope to an entire /24, performs operating-system detection and DNS resolution, and invokes an SSL cipher script; none of those modifications addresses the immediate host-discovery problem.

Study Guide Reference: Vulnerability Management → Nmap → Host Discovery → -Pn → Full Port Scanning -p- → Firewall/ICMP Filtering → Scan Troubleshooting.

ScoutSuite is specifically designed for security posture assessment of cloud environments, making it the best tool for establishing a cloud-security baseline. NCC Group describes ScoutSuite as an open-source, multi-cloud security-auditing tool that uses cloud-provider APIs to collect configuration information and identify risk areas across cloud environments.

This capability is fundamentally different from conventional host or web vulnerability scanning. A cloud baseline requires evaluation of configurations such as identity permissions, storage exposure, network controls, encryption settings, logging, cloud-native security services, and resource policies. ScoutSuite queries the cloud control plane and produces an organized view of configuration weaknesses that can be compared with security expectations.

OpenVAS is primarily a general-purpose vulnerability-assessment scanner for systems and network services. Nikto concentrates on web-server weaknesses and dangerous configurations. Metasploit is primarily an exploitation and penetration-testing framework. Although each has legitimate assessment uses, none is as directly suited to broad cloud configuration posture assessment as ScoutSuite.

The critical examination distinction is cloud configuration auditing versus traditional vulnerability scanning or exploitation .

Study Guide Reference: Vulnerability Management → Cloud Vulnerability Assessment → Configuration Baselines → ScoutSuite → Cloud APIs → Security Posture Assessment → Misconfiguration Identification.

192.168.76.5 — Patch; upgrade IIS to the current release

The correct remediation target is 192.168.76.5 , which is associated with an unsupported Microsoft IIS version and a CVSS score of 9.2 in the matching hotspot data. The remediation standard assigns vulnerabilities above 9.0 to the shortest remediation window, meaning the system requires action in seven days and therefore necessarily falls within the requested fourteen-day maximum. The corresponding remediation is to patch or upgrade IIS to a currently supported release .

The key vulnerability-management principle is that remediation priority is not determined exclusively by the existence of a vulnerability. Analysts must consider severity, asset context, exposure, business importance, exploitability, available remediation, and organizational service-level requirements. A product that has reached an unsupported state represents additional risk because standard security updates may no longer be supplied.

Upgrading the affected IIS installation directly removes the unsupported software condition rather than merely reducing exposure around it. A compensating control would be appropriate when remediation cannot immediately be performed, but it would not supersede a supported upgrade when that upgrade is operationally available.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization → CVSS → Remediation Timeframes → End-of-Life/Unsupported Software → Patching and Upgrading.

The analyst should first establish a legal hold because the suspected breach involves personnel records and evidence that may become relevant to regulatory, disciplinary, civil, or other legal proceedings. A legal hold prevents potentially relevant information from being deleted, overwritten, modified, rotated out under normal retention schedules, or otherwise destroyed before the organization's legal and investigative obligations are understood.

Preservation must precede destructive or potentially evidence-altering actions. NIST describes digital forensics as retrieving, storing, and analyzing electronic information while ensuring that evidence is captured reliably without alteration. RFC 3227 similarly emphasizes preserving evidence, following proper collection procedures, documenting handling, and maintaining chain of custody.

Log correlation and timeline construction are important investigative activities, but they should occur after preservation requirements have been established. Resetting credentials may subsequently be required for containment, but the scenario first raises an evidence-preservation obligation. Restoring files from backup would be especially premature because it could alter timestamps, overwrite artifacts, or otherwise complicate forensic analysis.

The examination principle is therefore preserve first when legal implications are reasonably foreseeable; analyze and remediate afterward under controlled procedures .

Study Guide Reference: Incident Response and Management → Evidence Acquisition → Legal Hold → Evidence Preservation → Chain of Custody → Timeline Analysis → Regulatory/Legal Considerations.

A zero-day vulnerability presents a special remediation problem because the affected organization may have confirmed exposure while no vendor patch is available. Until permanent remediation becomes possible, the organization should increase continuous monitoring for evidence that the vulnerability is being targeted or exploited. Threat-intelligence IoCs can be incorporated into SIEM, EDR, IDS/IPS, network monitoring, and threat-hunting workflows to identify suspicious connections, processes, authentication events, or other behaviors associated with the threat actor.

Continuous monitoring does not eliminate the vulnerability, but it strengthens detection capability during the exposure window and supports rapid containment if exploitation occurs. This approach should ordinarily be combined with available compensating controls such as segmentation, access restrictions, service disabling, configuration changes, or other vendor-recommended workarounds.

Sinkholing is primarily used to redirect malicious network traffic, particularly command-and-control or malicious-domain traffic, and is not a general solution for an unpatched zero-day. Eradication occurs after malicious artifacts or persistence mechanisms have been identified during incident response. Evidence acquisition is a forensic activity and does not reduce the immediate exploitation risk.

CS0-004 requires analysts to consider active exploitation/threat intelligence, patch/remediation availability, context, and compensating controls when prioritizing and mitigating vulnerabilities.

Study Guide Reference: Vulnerability Management → Prioritization → Active Exploitation → Patch Availability → Compensating Controls and Continuous Monitoring.

The CIO is implementing risk avoidance because the organization is eliminating the activity or technology that creates the risk. The legacy system no longer receives security updates, so continued operation would maintain exposure to vulnerabilities that may eventually become impossible to remediate. By phasing out and ultimately decommissioning the system, the organization removes that source of risk instead of continuing to operate it under additional controls.

NIST recognizes acceptance, avoidance, mitigation, sharing, and transfer as established risk-response approaches. Avoidance differs from mitigation because mitigation would retain the legacy system while implementing controls that reduce its likelihood or impact—for example, segmentation, strict access controls, application allowlisting, or enhanced monitoring.

Risk acceptance would involve deliberately continuing to operate the system after management acknowledges and approves the remaining exposure. Risk transference would shift some financial or operational consequences to another party, such as through insurance or contractual arrangements.

The phrase “phase out” is the decisive indicator. The organization intends to stop using the risk-producing technology entirely, making avoidance the most precise classification.

Study Guide Reference: Vulnerability Management → Risk Management → Risk Responses → Avoidance → Mitigation → Acceptance → Transference → Legacy and End-of-Life Systems.

A SIEM alert is an indication requiring validation; it is not automatically a confirmed security incident. The analyst must therefore begin with triage . Triage establishes whether the activity is legitimate or malicious, determines the affected systems or accounts, evaluates severity and business impact, and establishes the appropriate investigative and escalation path.

Typical triage activities include reviewing the underlying events, checking source and destination information, identifying affected assets, correlating supporting telemetry, evaluating detection confidence, examining threat intelligence, and determining whether the alert represents a true positive. Only after this assessment can the incident be assigned an appropriate priority and routed to the correct responders.

Contacting an incident coordinator before establishing whether the alert represents meaningful risk may create unnecessary escalation. Recovery activities occur substantially later, after detection, analysis, containment, and eradication activities have established what happened and controlled the threat. Escalating directly to the help desk is similarly premature and may be inappropriate for a security event.

NIST's current incident-response model places detection and analysis before response and recovery actions and emphasizes determining event characteristics so appropriate response actions can follow.

Study Guide Reference: Incident Response and Management → Detection → Alert Validation → Triage → Analysis → Severity Determination → Escalation.

AI usage policies establish organizational boundaries for how artificial intelligence systems may be selected, accessed, configured, and used. They allow an organization to obtain operational benefits from AI while controlling risks involving confidential information, intellectual property, regulated data, model outputs, external AI services, and inappropriate automation. A strong policy can define approved platforms, prohibited data categories, validation requirements, human oversight, retention rules, acceptable use, and escalation procedures.

Prompt engineering is a technical method for constructing inputs that produce more useful model responses. It can improve output quality but does not establish enterprise-wide safeguards for protecting business objectives or sensitive information. A non-disclosure agreement establishes contractual confidentiality obligations between parties; it cannot govern the full technical and operational use of AI systems. An incident response policy determines how security incidents are managed and escalated, but it is reactive and not designed to establish routine AI governance.

CS0-004 explicitly addresses AI within Security Operations. The objectives identify AI risks including hallucinations, data exposure, model poisoning, and malicious prompts and identify governance considerations including legal or regulatory compliance and AI usage policies . AI use cases include log analysis, artifact comparison, incident investigation, event correlation, and automation.

Study Guide Reference: Security Operations → AI in Security Operations → AI Risks → Governance → AI Usage Policies → Data Protection.

Compensating controls are appropriate when the preferred remediation cannot currently be implemented but the organization must still reduce exposure. A mission-critical system with an unpatched vulnerability for which no vendor patch exists is a classic example. The system cannot simply be removed from service because the business requires it, and conventional patching is unavailable.

The organization may therefore deploy alternative controls such as network segmentation, restrictive firewall rules, application allowlisting, disabling unnecessary services, enhanced monitoring, IPS signatures, access restrictions, or isolation of affected functionality. These measures do not eliminate the underlying defect; instead, they reduce the probability or impact of exploitation while a permanent solution is developed.

NIST's control framework is designed to allow security controls to be selected and tailored according to organizational mission requirements and risk, supporting the broader principle that organizations may apply appropriate alternative safeguards when operational constraints exist.

Option B requires no compensating control because remediation has already occurred. Option C describes a vulnerability that is not applicable to the organization's systems. Option D represents a false positive and therefore does not constitute an actual exposure requiring mitigation.

Study Guide Reference: Vulnerability Management → Mitigation → Compensating Controls → Patch Availability → Mission-Critical Systems → Segmentation and Monitoring.

The observed activity corresponds to privilege escalation , meaning the attacker attempted to move from a lower level of authorization to a more powerful security context. Privilege escalation becomes important after initial compromise because an account or process obtained during initial access frequently lacks the permissions required to disable controls, access sensitive resources, modify protected system settings, dump credentials, or establish deeper persistence.

MITRE ATT & CK defines the Privilege Escalation tactic as adversary activity intended to obtain higher-level permissions on a system or network. Techniques can include exploiting vulnerabilities, manipulating access tokens, modifying accounts or group memberships, abusing misconfigurations, or executing processes under more privileged identities.

Exfiltration specifically concerns removing information from the compromised environment. Remote code execution describes obtaining the ability to execute attacker-controlled commands or code remotely; while RCE can sometimes lead to privilege escalation, they represent different objectives. Spoofing involves impersonating or falsifying an identity, address, or other trusted characteristic.

The critical analytical distinction is therefore the attacker's objective demonstrated by the logs : attempting to obtain elevated access indicates privilege escalation rather than merely establishing execution or transferring data.

Study Guide Reference: Security Operations → Malicious Activity Analysis → MITRE ATT & CK → Privilege Escalation → Account/Permission Changes → System Log Interpretation.