CompTIA Cybersecurity Analyst (CySA+) Certification - CS0-004 Exam Questions

QUESTION NO: 1
A security operations center (SOC) analyst investigates the results of a password spray test conducted by the vulnerability management team. The analyst must:
- Identify Linux systems that have successful and unsuccessful logins
with username "User1".
- Create an output report named "linux-events" of all the events to a
flat file.
The analyst issues the following console command:
ls /var/log/
The shortened output of the command is below:

Which of the following commands should the analyst use to meet the report output requirements?

QUESTION NO: 2
A sales application was remediated to address a critical vulnerability. The process took five business hours and was ultimately successful. However, the change advisory board informed the company's leadership team that the process resulted in a considerable financial loss. Which of the following best explains the reason for the financial loss?

QUESTION NO: 3
Which of the following best describes the reason a root cause analysis is an important part of the incident response process?

QUESTION NO: 4
An analyst must provide a visualization of data received from threat intelligence sources. The data includes the Internet Protocols, services, and tools used by threat actors. Which of the following is the best framework for the analyst to follow to display this data?

QUESTION NO: 5
Hotspot Question
A systems administrator is reviewing the output of a vulnerability scan.
INSTRUCTIONS
Review the information in each tab.
Based on the organization's environment architecture and remediation standards, select the server to be patched within 14 days and select the appropriate technique and mitigation.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

QUESTION NO: 6
An analyst reviews alerts that indicate a number of different users had a spike in login attempts from the same IP. Using the security information and event management (SIEM) system, the analyst finds that a number of users received the following email:

Which of the following best describes this activity?

QUESTION NO: 7
A security analyst isolates a Windows 11 workstation from the network after known malware is detected. The list of security information and event management (SIEM) events during the malware installation and timeline does not identify a specific user who was logged in. The security analyst uses the local administrative account to log in and would like a list of logins to the machine. Which of the following PowerShell commands should the analyst use?

QUESTION NO: 8
A security analyst is scanning an ICS host (192.168.1.5) in an industrial plant for insecure ports while minimizing the impact to uptime or performance. Which of following commands should the analyst use to perform the task?

QUESTION NO: 9
A security analyst is prioritizing vulnerabilities that were identified in a recent scan of the company's systems. Given the following data:

Which of the following vulnerabilities should the analyst prioritize first for remediation?

QUESTION NO: 10
Current playbooks for incident response mention resources that have been decommissioned.
Which of the following actions should an analyst take?

QUESTION NO: 11
Which of the following is the best strategy for prioritizing vulnerabilities for remediation?

QUESTION NO: 12
The Chief Information Security Officer wants to improve internal security measures by continuously validating and verifying access to the production environment. Which of the following concepts best describes this practice?

QUESTION NO: 13
Which of the following refers to several identified issues that need remediation after a recent audit?

QUESTION NO: 14
An analyst reviews the following list of vulnerabilities:

The analyst determines that CVE-2023-8524 is the highest priority for remediation and should be patched immediately. Which of the following did the analyst use to determine the priority of remediation efforts?