CS0-004 Practice Questions

The organization cannot completely block the malicious URL because it is strictly tied to a required business process. Instead, the security team implements alternative measures—such as restrictive firewall rules, enhanced monitoring, and aggressive patching—to mitigate the risk. These alternative measures are known as compensating controls. Compensating controls are deployed when a primary security control (in this case, outright blocking the malicious domain) cannot be implemented due to legitimate business or technical constraints, ensuring the residual risk remains at an acceptable level.

A. Patching is only one component of the response; it does not encompass the firewall restrictions and monitoring implemented to offset the inability to block the URL.

B. Configuration management refers to maintaining systems in a desired, consistent state, not the specific act of applying alternative security measures to mitigate an unblockable threat.

D. Attack surface management involves the continuous discovery and reduction of organizational vulnerabilities, whereas this scenario describes targeted incident response using alternative risk mitigation.

1. NIST Special Publication 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations", Appendix A (Compensating Controls).

2. ISACA CISA Review Manual, 27th Edition, Section 1 (Information Systems Auditing Process - Compensating Controls).

To identify the "patient zero" (the initial point of compromise), an analyst must establish an accurate, synchronized timeline of events across all affected systems. Raw event logs from multiple systems often have disparate timestamps, clock drift, or different time zones. By normalizing these logs and constructing a unified timeline, the analyst can trace the sequence of malicious activities backward to the earliest occurrence, thereby identifying the first compromised system and the initial attack vector.

B. Enabling monitoring is a containment and preparation step; it does not help analyze historical raw logs to find the initial compromise.

C. Isolating systems is a containment action to stop ongoing attacks, which does not assist in historical log analysis for patient zero.

D. Improving shift handoff communication is an administrative process improvement, not a technical forensic analysis technique.

E. Reverse composition analysis focuses on malware structure and dependencies, not on tracing network-wide lateral movement to find patient zero.

1. NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide," Section 3.2.4 (Analyzing Incident-Related Data - Profiling and Timing).

2. MITRE ATT&CK Framework, "Incident Response Methodologies: Timeline Analysis."

Compensating controls are alternative security measures implemented when a primary security control cannot be applied due to technical, operational, or business constraints. If a mission-critical system has a vulnerability but no patch is available (or applying a patch would cause unacceptable business disruption), the organization cannot use the primary control (patching). Instead, they must deploy compensating controls—such as strict network isolation, virtual patching, or enhanced monitoring—to mitigate the risk until a permanent fix is viable.

B. A vulnerability has been fixed, tested, and deployed to production: If the vulnerability is already fixed and deployed, the primary control was successful, making compensating controls unnecessary.

C. A vulnerability is being actively exploited in the wild, but the organization does not use the affected system: If the organization does not use the affected system, there is no risk to mitigate and no controls are needed.

D. A vulnerability was detected, but the organization has determined the result is a false positive: A false positive means there is no actual vulnerability, so no security controls are required.

PCI DSS v4.0 Standard, Appendix B: Compensating Controls (Definition and Usage).

NIST Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations," Section 3.1 (Compensating Controls).

The primary purpose of encrypting sensitive data at rest on portable devices like laptops is to protect the information from unauthorized disclosure in the event the physical device is lost or stolen. Full Disk Encryption (FDE) or file-level encryption ensures that even if a malicious actor gains physical possession of the storage media, they cannot read, extract, or compromise the sensitive data without the correct decryption keys or credentials. This mitigates the highest risk associated with mobile computing assets.

Option A: Encryption at rest does not prevent authorized end users from copying data; Data Loss Prevention (DLP) solutions and endpoint controls are required for that purpose.

Option C: While encryption helps organizations achieve regulatory compliance, the fundamental technical and security reason for its implementation is to prevent data disclosure upon physical theft.

Option D: Encryption at rest on a local laptop provides confidentiality, not integrity, and it does not protect data while it is traversing the company network.

- NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices, Section 2.1: Threats to Data at Rest. https://doi.org/10.6028/NIST.SP.800-111

- CompTIA CySA+ CS0-004 Official Study Guide, Chapter 14: Data Security, Section: Encryption at Rest.

Deploying AI in security operations introduces unique governance challenges, particularly regarding trust, transparency, and accountability. The most critical governance consideration is establishing robust processes to validate the AI model's decisions and maintain explainability (understanding why an alert was generated). Security teams must also actively monitor for and mitigate algorithmic bias that could lead to false positives or missed detections. Furthermore, clear escalation procedures are required to ensure human analysts can effectively review, interpret, and act upon AI-generated findings, maintaining a necessary "human-in-the-loop" safeguard.

A. Training data must be highly relevant, accurate, and sanitized; using data without regard to its source introduces noise and poisoning risks.

C. Deploying any enterprise security tool without pilot testing violates standard change management and risk assessment protocols.

D. The proprietary nature of a model does not inherently guarantee security; in fact, closed models can hinder explainability and independent validation.

1. NIST AI 100-1, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)," Section 3.4 (Explainability and Interpretability).

2. ENISA, "Securing Machine Learning Algorithms," Section 4 (Security and Privacy in Machine Learning).

The correct answer is Medium or High (accept either as they demonstrate understanding of risk-based

prioritization). This scenario tests whether candidates understand that CVSS base scores must be

contextualized against business impact and environmental factors. While the CVSS base score is 9.8 (Critical),

the environmental score should be significantly lowered because the vulnerable system lacks access to

sensitive data, production systems, or external networks. Risk-based vulnerability prioritization (a core CS0-004

objective) means that a vulnerability on an isolated development system poses much lower actual risk than its

base CVSS score suggests.

Many organizations use CVSS environmental factors or apply their own risk scoring to downgrade these from

Critical to Medium or High based on context. Candidates should recognize that blindly remediating by CVSS

base score alone leads to poor resource allocation. The two vulnerabilities would be deprioritized below the 45

vulnerabilities (7.0-8.9) that likely exist on internet-facing or production systems, even though their base

scores are higher.

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Comptia_CS0-004/page_119_img_1.jpg

The term 'chain of custody' refers to the documented record of who has handled evidence, when, and how it

was handled. In incident response, maintaining a strict chain of custody is critical for both technical

investigations and potential legal proceedings. This ensures evidence integrity and admissibility if the incident

results in disciplinary action, litigation, or law enforcement involvement. The CySA+ exam requires candidates

to understand key incident response techniques including evidence handling, which is a foundational practice

in the eradication and recovery phases of the incident response process. This question tests knowledge of

formal incident response procedures and terminology used in professional security operations.

The correct answer is MITRE ATT&CK.

MITRE ATT&CK is the industry-standard knowledge base of adversary tactics and techniques based on real-

world observations. The framework organizes techniques by tactic (e.g., Initial Access, Persistence, Privilege

Escalation, Lateral Movement, Exfiltration, Impact) and platform (Windows, Linux, macOS, cloud, network,

containers). In this scenario, the indicators map to multiple tactics: the failed login attempts and credential

compromise relate to Initial Access and Credential Access; the successful logins from unusual locations and

times relate to Initial Access and Lateral Movement; EDR detections indicate Execution and Lateral Movement;

and data access patterns suggest Exfiltration or Impact. Using ATT&CK enables SOC teams to document

findings in a standardized way, improves threat intelligence sharing with external partners, and supports

defense planning by identifying which techniques the organization is most vulnerable to.