CS0-004 Real Exam Questions and Verified Answers

Question 1 Single choice

An analyst executes the top command on a Linux system for an unresponsive application and observes the following output:

Which of the following is the most likely cause of this issue?

A
Service disruption
B
Unauthorized software
C
Resource exhaustion
D
Filesystem changes

Show answer and explanation

Correct answer: C

Explanation

The Python process is consuming 91.2% CPU and 96% of memory, far exceeding the usage of the other listed processes. Such concentration of processor and memory capacity can leave the application or host unable to respond, which is the characteristic effect of resource exhaustion.

Question 2 Single choice

Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:

Which of the following choices should the analyst look at first?

A
wh4dc-748gy.lan (192.168.86.152)
B
lan (192.168.86.22)
C
imaging.lan (192.168.86.150)
D
xlaptop.lan (192.168.86.249)
E
p4wnp1_aloa.lan (192.168.86.56)

Show answer and explanation

Correct answer: E

Explanation

The host p4wnp1_aloa.lan at 192.168.86.56 stands out as a Raspberry Pi device exposing SSH, RPC, NetBIOS, SMB, and an alternate HTTP service. Its unusual name and device type are inconsistent with the ordinary Roku, laptop, workstation, and imaging assets listed nearby. In an unauthorized-activity investigation, that combination makes it the first system to verify and investigate.

Question 3 Single choice

When starting an investigation, which of the following must be done first?

A
Notify law enforcement
B
Secure the scene
C
Seize all related evidence
D
Interview the witnesses

Show answer and explanation

Correct answer: B

Explanation

Securing the scene prevents unauthorized people from entering, changing system state, removing devices, or contaminating evidence. This preservation step must occur before responders seize artifacts or begin interviews so that later findings remain tied to an intact environment. Law-enforcement notification depends on the incident and applicable requirements, rather than preceding basic scene control.

Question 4 Lab simulation

Simulation

A systems administrator is reviewing the output of a vulnerability scan.

INSTRUCTIONS

Review the information in each tab.

Based on the organization's environment architecture and remediation standards,

select the server to be patched within 14 days and select the appropriate technique and mitigation.

Show answer and explanation

Step 1: Reviewing the Vulnerability Remediation Timeframes
The remediation standards require servers to be patched based on their CVSS score: CVSS > 9.0: Patch within 7 days CVSS 7.9 - 9.0: Patch within 14 days
CVSS 5.0 - 7.9: Patch within 30 days
CVSS 0 - 5.0: Patch within 60 days

Step 2: Analyzing the Output Tab From the Output tab: Server 192.168.76.5 has a CVSS score of 9.2 for an unsupported Microsoft IIS version, indicating a critical vulnerability requiring a patch within 7 days. Server 192.168.76.6 has a CVSS score of 7.4 for a missing secure attribute on HTTPS cookies, which falls in the 5.0 - 7.9 range, requiring a patch within 30 days.
Since the question asks for the server to be patched within 14 days, we need to focus on servers with CVSS 7.9 - 9.0: None of the servers have a CVSS score that falls precisely in the 7.9 - 9.0 range. However, 192.168.76.5, with a CVSS score of 9.2, has a vulnerability that necessitates a quick response and fits as it must be patched within the shortest timeframe (7 days, which includes 14 days).
The server that fits within a 14-day urgency, based on standard practices, would be 192.168.76.5.

Step 3: Reviewing the Environment Tab
The Environment Tab provides additional context for 192.168.76.5: It's in the dev environment, which is internal and not publicly accessible. MFA is required, indicating security measures are already present. Step 4: Selecting the Appropriate Technique and Mitigation For 192.168.76.5, with the Microsoft IIS unsupported version: Patch; upgrade IIS to the current release is the most suitable option, as upgrading IIS will resolve the unsupported software vulnerability by bringing it up-to-date with supported versions.
This technique addresses the root cause, which is the unpatched, outdated software.
Summary
Server to be patched within 14 calendar days: 192.168.76.5 Appropriate technique and mitigation: Patch;
upgrade IIS to the current release This approach ensures that the most critical vulnerabilities are addressed promptly, maintaining security compliance.

Question 5 Single choice

The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals.

Which of the following will best achieve the goal and maximize results?

A
Single pane of glass
B
Single sign-on
C
Data enrichment
D
Deduplication

Show answer and explanation

Correct answer: A

Explanation

A single pane of glass consolidates information from multiple threat intelligence feeds into one operational view. Analysts can correlate and review the feeds without moving among redundant portals, improving visibility and workflow efficiency while preserving the combined value of the available intelligence.

Question 6 Single choice

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network.

Which of the following should the CSIRT conduct next?

A
Take a snapshot of the compromised server and verify its integrity
B
Restore the affected server to remove any malware
C
Contact the appropriate government agency to investigate
D
Research the malware strain to perform attribution

Show answer and explanation

Correct answer: A

Explanation

Network isolation has already contained the suspected compromise. The CSIRT should next take a snapshot and verify its integrity so investigators have a preserved, demonstrably unchanged representation of the virtual server. Restoring the server first could destroy malware, logs, and other artifacts needed to determine what occurred.

Question 7 Lab simulation

Simulation

Approximately 100 employees at your company have received a phishing email. As a security analyst, you have been tasked with handling this situation. INSTRUCTIONS Review the information provided and determine the following:

1. How many employees clicked on the link in the phishing email?
2. On how many workstations was the malware installed?
3. What is the executable file name of the malware?

If at any time you would like to bring back the initial state of the simulation. please click the Reset All button.

Show answer and explanation

7 employees clicked the link; malware was installed on 4 workstations; the executable was mailclient.exe.

Explanation

Seven internal source addresses contacted chzweb.tilapia.com after the phishing messages were delivered, establishing the number of employees who followed the link. Process-creation records then show mailclient.exe starting on four of those workstations: 192.168.0.188, 192.168.0.9, 192.168.0.24, and 192.168.0.132. Correlating the link requests with those process events separates all seven clicks from the four successful malware installations.

Question 8 Hotspot

HOTSPOT

A company recently experienced a security incident. The security team has determined a user clicked on a link embedded in a phishing email that was sent to the entire company. The link resulted in a malware

download, which was subsequently installed and run.

INSTRUCTIONS

Part 1

Review the artifacts associated with the security incident. Identify the name of the malware, the malicious IP address, and the date and time when the malware executable entered the organization.

Part 2
Review the kill chain items and select an appropriate control for each that would improve the security posture of the organization and would have helped to prevent this incident from occurring. Each control may only be used once, and not all controls will be used.

Firewall log:

File integrity Monitoring Report:

Malware domain list:

Vulnerability Scan Report:

Phishing Email:

stem image

Show answer and explanation

Explanation

Question 9 Single choice

A security analyst analyzes the output of a web application access log for a company based in the United States. Given the following output:

Which of the following users should be investigated first?

A
jschott
B
dmann
C
mschultz
D
tlindy

Show answer and explanation

Correct answer: D

Explanation

tlindy has successful access from a US address at 09:02, a successful login from a Russian address at 09:15, and another US success at 09:25. That rapid geographic change is incompatible with ordinary travel and indicates that valid credentials may be in use from two distant regions. Failed foreign attempts against other users are less urgent than tlindy's successful foreign access.

Question 10 Single choice

Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

A
Develop a call tree to inform impacted users
B
Schedule a review with all teams to discuss what occurred
C
Create an executive summary to update company leadership
D
Review regulatory compliance with public relations for official notification

Show answer and explanation

Correct answer: B

Explanation

A review involving all participating teams creates a shared account of what occurred, how the response proceeded, which decisions were effective, and where coordination or procedures failed. Those findings can be converted into corrective actions for future incidents. A call tree or executive summary handles communication but does not provide the same cross-team improvement process.