Free CS0-004 practice test: 30 questions with answers

Correlating failed and successful authentication events over time reveals password spraying or brute force that ends in a compromise. A port scan or unrelated logs do not show the authentication sequence, and certificate dates are not relevant.

Correlation and aggregation combine related events into one alert or case, which lowers the volume analysts must triage. Longer retention does not reduce noise, disabling alerts without review hides real activity, and spreadsheets do not scale.

EDR process telemetry and command-line logging record the process tree and arguments used to launch PowerShell. Firewall lists and badge logs do not show process activity, and printer queues are unrelated.

Beaconing shows up as connections at regular intervals with similar sizes, which flow timing analysis can reveal. Wallpapers, fonts and time zones are not indicators of command-and-control communication.

Windows Security logs record logon types and service installations used during lateral movement, and domain controller logs show authentication across systems. Toner levels, document revisions and display settings do not track remote access between hosts.

Mapping indicators and tactics to detections and hunting for them turns intelligence into operational value. Collecting feeds without review creates noise, blocking every address is impractical, and infrequent reading does not inform detection.

Continuous monitoring with tuned alerts shortens detection, and automated containment for high-confidence detections shortens the time an attacker can act. Quarterly reviews, disabled firewalls and long alert backlogs all lengthen dwell time.

AI summaries can omit or invent details, so analysts should verify them against source logs and measure accuracy. Automatic closure, uncontrolled data exposure and trust based on fluency all introduce risk.

Risk-based prioritization weighs exploitability, business impact and existing controls, and an unreachable asset may be lower risk than its raw severity suggests. Logos, name lengths and scan dates do not measure risk.

Credentialed scans read installed package versions and local configuration, which reduces guessing from banners and lowers false positives. Speed, automatic elimination of all false positives and network independence are not the reasons.

Confirming whether the vulnerable code is reachable distinguishes true risk from a false positive, and documenting the reasoning supports audits. Immediate shutdown is disproportionate, permanent silent dismissal hides risk, and an unrelated patch misses the issue.

Segmentation and access restriction reduce the exposure of a system that cannot be patched, which is the purpose of a compensating control. A sign, a renamed host and faster CPU do not reduce exploitability.

A false positive occurs when the scanner reports a finding that is not actually present, which happens when backported patches keep a version string unchanged. A false negative is a missed real issue, and the other terms do not describe this case.

A non-intrusive profile during a planned window, tested first on a staging copy, limits the risk of disruption. Aggressive or frequent scans and disabling authentication can impair service or produce misleading results.

Mean time to remediate measures the elapsed time from discovery to fix, which reports remediation performance. The other metrics do not describe vulnerability management outcomes.

Exploit activity shows how likely a flaw is to be used, and asset criticality shows how much harm exploitation would cause. Report colors, title lengths and vendor names do not measure risk.

Capturing memory and a disk image before changes preserves volatile and persistent evidence, and chain-of-custody records keep it admissible. Reimaging or deleting files destroys evidence, and public posting is inappropriate.

Eradication removes malware, accounts and persistence mechanisms the attacker used. Preparation happens before incidents, detection identifies them, and lessons learned follows recovery.

MITRE ATT&CK catalogs adversary tactics and techniques, which supports detection engineering, threat modeling and reporting. The other standards cover quality, media sanitization and payment scoping.

Delivery is the stage where the weaponized payload reaches the target, such as by email or a malicious download. Reconnaissance gathers information, actions on objectives is the final goal, and command and control maintains access afterward.

Root cause analysis traces the earliest evidence of compromise across logs and records, which reveals the entry point to close. Unsupported blame, closing without investigation and cosmetic changes do not prevent recurrence.

Rotating exposed credentials and reviewing their use in logs stops misuse and reveals whether they were already abused. Leaving the leak public, comments and delayed rotation all leave the exposure active.

Isolating hosts and blocking malicious destinations limit the spread and further activity of an incident. Final reporting, future testing and training updates belong to later phases.

Mean time to detect trended over time, with volume context, shows whether detection is getting faster. Coffee counts, license tallies and policy page counts say nothing about detection performance.

System owners need to know what is affected, how serious it is for the business, and what action to take. Plugin IDs alone and unexplained port lists do not enable decisions, and tool preferences are irrelevant.

The percentage of critical findings fixed within the service level, compared over time, directly reflects remediation effectiveness. Scan counts, purchases and host totals do not show whether risk was reduced.

A traceable record of findings, owners, risk acceptances and evidence of remediation satisfies audit expectations. Personal notes, untracked email and deleting history do not provide evidence.

Risk acceptances need a defined risk, compensating controls, a named owner and an expiry so they are reviewed. A name alone or vague justifications do not support a governed decision.

Executives need business impact, status, decisions and the timing of the next update. Raw packets, unfiltered logs and command transcripts are too detailed for decision-making.

Detection timing relative to impact shows whether the team acts early enough to prevent damage. Unreviewed closures, email counts and meeting counts do not measure effectiveness.