CompTIA CS0-004 - CompTIA CySA+ V4 Exam
Page: 3 / 17
Total 82 questions
Question #11 (Topic: Topic 1, Security Operations
)
A new security operations center (SOC) manager joins a team that struggles to meet service-level agreements (SLAs). The alert backlog continues to increase daily. Which of the following will the manager most likely need to do?
A. Automate escalation.
B. Improve the triage processes.
C. Upgrade threat intelligence.
D. Enhance the customer service response.
Answer: B
Question #12 (Topic: Topic 1, Security Operations
)
Which of the following should a cybersecurity analyst utilize when a notification is inaccurate?
A. Data enrichment
B. Dashboard creation
C. Threat hunting
D. Alert tuning
Answer: D
Question #13 (Topic: Topic 1, Security Operations
)
A Chief Information Security Officer (CISO) evaluates a threat heat map and notices a substantial increase in custom scanning and enumeration activities. The CISO wants to gather as much information as possible about the activities targeting the company to help prioritize mitigations. Which of the following solutions is the best way to accomplish this goal?
A. Configuring a honeypot in a separate environment to gather attacker techniques
B. Leveraging canary tokens on all production systems to detect valid intrusion attempts
C. Subscribing to information-sharing and threat intelligence reports for the industry
D. Implementing a web application firewall in front of all applications and having it log attacks
Answer: A
Question #14 (Topic: Topic 1, Security Operations
)
An analyst uses an AI platform to help correlate events. The AI output contains events that did not happen. This results in inaccurate correlations. Which of the following best describes what has occurred?
A. Hallucinations
B. Data exposure
C. Malicious prompts
D. Model poisoning
Answer: A
Question #15 (Topic: Topic 1, Security Operations
)
A security analyst must identify documents that contain encoded ActiveMime payloads in a directory containing thousands of files. The analyst runs the following command:
grep -rail ActiveMime *
The command returns no output. Which of the following Yet Another Recursive Acronym (YARA) rules should the analyst use to find the suspicious files?
grep -rail ActiveMime *
The command returns no output. Which of the following Yet Another Recursive Acronym (YARA) rules should the analyst use to find the suspicious files?
A. 
B. 
C. 
D. 
B.
C.
D.
Answer: C
