CompTIA CySA+ (CS0-004) — All Questions

An analyst reviewing SIEM alerts wants to reduce noise by suppressing repeated benign events from a known vulnerability scanner. Which action best preserves detection capability while cutting alert volume?

• a.Delete all log sources associated with the scanner's subnet
• b.Create a tuning rule that excludes traffic from the scanner's known IP for that specific signature✓
• c.Disable the correlation rule entirely across all hosts
• d.Lower the SIEM's overall logging retention to 7 days

Tuning to exclude a known-good source for one signature removes false positives without blinding the SIEM to real threats. Deleting log sources or disabling the rule globally would create blind spots, and shortening retention harms investigations. Targeted allow-listing keeps fidelity high while reducing analyst fatigue.

A threat hunter maps observed adversary behavior to the MITRE ATT&CK framework. Which element of ATT&CK describes the specific method an adversary uses to achieve a tactical goal such as credential access?

• a.Tactic
• b.Mitigation
• c.Technique✓
• d.Data source

In MITRE ATT&CK, tactics represent the adversary's goal (the 'why'), while techniques describe the specific method used to accomplish it (the 'how'). Credential Access is a tactic, and methods like OS Credential Dumping are techniques. Mapping observations to techniques enables precise detection engineering and gap analysis.

During endpoint analysis, an EDR agent flags a signed PowerShell process spawning encoded commands that reach out to a rare external domain. What behavior does this most likely represent?

• a.Living-off-the-land activity using a legitimate binary for malicious purposes✓
• b.A routine Windows update download
• c.A false positive caused by an expired code-signing certificate
• d.Normal administrative scripting requiring no review

Adversaries frequently abuse trusted, signed utilities such as PowerShell to blend in, a technique known as living off the land (LOLBins). Encoded commands and beaconing to rare domains are strong indicators of command-and-control activity. Because the binary is legitimately signed, signature-based tools may miss it, making behavioral EDR analysis essential.

An analyst wants to safely detonate a suspicious email attachment to observe its behavior without risking production systems. Which capability is most appropriate?

• a.A credentialed vulnerability scan of the mail server
• b.A packet capture on the perimeter firewall
• c.A static string analysis of the file only
• d.A network-isolated sandbox environment✓

A sandbox provides an isolated, instrumented environment to detonate and observe malware behavior dynamically, capturing file, registry, and network activity. Static analysis alone cannot reveal runtime behavior, and scanning or packet capture does not execute the sample. Network isolation prevents the malware from spreading or contacting live infrastructure.

A SOC receives a threat intelligence feed listing IP addresses, file hashes, and domains tied to an active campaign. How are these data points best categorized?

• a.Tactics, techniques, and procedures (TTPs)
• b.Indicators of compromise (IoCs)✓
• c.Common Vulnerabilities and Exposures (CVEs)
• d.Security control baselines

Atomic artifacts such as IPs, hashes, and domains are indicators of compromise used to detect known-bad activity. TTPs describe higher-level adversary behavior, which is more durable but harder to detect. IoCs sit low on the Pyramid of Pain because attackers can change them easily, but they remain useful for rapid matching in a SIEM or EDR.

While analyzing network flow data, an analyst notices a single internal host making consistent, small outbound connections to one external IP every 60 seconds. What technique should the analyst apply to characterize this?

• a.CVSS base scoring
• b.Credentialed scanning
• c.Beaconing detection through traffic pattern analysis✓
• d.Chain-of-custody documentation

Regular, low-volume connections at fixed intervals are a classic signature of C2 beaconing, and analyzing traffic periodicity helps distinguish it from normal traffic. Threat hunters look at connection frequency, jitter, and destination reputation. CVSS scoring and credentialed scanning address vulnerabilities, not active communications, and chain of custody applies to evidence handling.

An organization wants to proactively search its environment for undetected threats based on a hypothesis derived from recent intelligence. Which activity does this describe?

• a.Threat hunting✓
• b.Vulnerability remediation
• c.Patch management
• d.Chain-of-custody transfer

Threat hunting is a proactive, hypothesis-driven search for adversaries that have evaded automated detections. It leverages intelligence, ATT&CK techniques, and analyst intuition to uncover hidden compromise. Unlike reactive alerting, hunting assumes a breach may already exist and seeks evidence of it across logs, endpoints, and network data.

An analyst correlates authentication logs and finds a user account successfully logging in from two countries within five minutes. What analytical concept identifies this anomaly?

• a.Data enrichment
• b.Sandbox detonation
• c.Signature-based detection
• d.Impossible travel detection✓

Impossible travel flags logins from geographically distant locations within a timeframe too short to physically travel, suggesting credential compromise or session hijacking. This behavioral analytics technique relies on correlating timestamps with geolocation data. It is a common UEBA use case that signature-based detection cannot catch because no known-bad indicator is present.