https://www.passcert.com/CS0-004.html Page 2 13 questions selected from source version V8.02 COMPTIA CYBERSECURITY ANALYST Question 1 The Chief Information Security Officer wants to improve internal security measures by continuously validating and verifying access to the production environment. Which of the following concepts best describes this practice? A. Secure access service edge B. Next-generation firewall C. Zero Trust D. Privileged access management Answer: C COMPTIA CYBERSECURITY ANALYST Question 2 Which of the following network architectures would best implement a perimeter-less network topology? A. Hybrid cloud networks B. Secure access service edge C. Cloud-native computing D. Content delivery networks Answer: B COMPTIA CYBERSECURITY ANALYST Question 3 A security analyst uses a full pcap solution to extract all traffic from the last two days associated with the 10.213.4.27 file server. This file server is under investigation due to concerns about potential data exfiltration using Domain Name System (DNS) traffic. Which of the following commands should the analyst use to extract any potentially leaked data from the suspicious.pcap file? A. strings suspicious.pcap | grep 10.213.4.27 B. zeek -r suspicious.pcap; grep 10.213.4.27 file.log C. snort -r suspicious.pcap; grep eve.log 10.213.4.27 D. tcpdump -r suspicious.pcap port 53 and host 10.213.4.27 Answer: D https://www.passcert.com/CS0-004.html Page 3 COMPTIA CYBERSECURITY ANALYST Question 4 A security operations center (SOC) analyst investigates the results of a password spray test conducted by the vulnerability management team. The analyst must: Identify Linux systems that have successful and unsuccessful logins with username "User1". Create an output report named "linux-events" of all the events to a flat file. The analyst issues the following console command: ls /var/log/ The shortened output of the command is below: Which of the following commands should the analyst use to meet the report output requirements? A. cat /var/log/sssd | grep "User1" > linux-events.txt B. cat /var/log/faillog.log | grep "User1" > linux-events.txt C. cat /var/log/syslog | grep "User1" > linux-events.txt D. cat /var/log/auth.log | grep "User1" > linux-events.txt Answer: D COMPTIA CYBERSECURITY ANALYST Question 5 Multiple users report unexpected mouse movements and terminal windows opening. An analyst reviewing the network traffic logs observes the following: Which of the following is the most likely reason for the reported symptoms? A. Activity is on an internally addressable network. B. A reverse tunnel is being used to send commands. https://www.passcert.com/CS0-004.html Page 4 Question 5 continued C. Remote Desktop Protocol (RDP) is being used to remotely control the impacted computers. D. Virtual Network Computing is being used to connect to systems. Answer: D COMPTIA CYBERSECURITY ANALYST Question 6 A security team deploys a new scanning solution that requires root, domain administrator, and local server administrator permissions on all systems. Which of the following is the best way to help mitigate the risk for this level of access? A. Enabling single sign-on for all administrators B. Integrating token-based authentication using a privileged access management (PAM) solution C. Using temporary, one-time passwords as part of the login process D. Configuring agentless scanning for critical targets Answer: B COMPTIA CYBERSECURITY ANALYST Question 7 An analyst receives the following output: Which of the following is the correct number of discovered systems that are allowing unencrypted traffic? A. 1 B. 2 C. 3 D. 5 Answer: B https://www.passcert.com/CS0-004.html Page 5 COMPTIA CYBERSECURITY ANALYST Question 8 An analyst reviews a summarized vulnerability report through a governance, risk, and compliance (GRC) reporting tool. The following report correlates asset information from the configuration management database (CMDB) against detected vulnerabilities: Which of the following servers should the analyst prioritize based on the target value, the risk, and the likelihood of exploitation? A. PRODWEB-02 B. MPC-Control C. DEVWIN11-01 D. PRODWEB-01 Answer: D COMPTIA CYBERSECURITY ANALYST Question 9 There is an alert coming from the security information and event management system. Which of the following is the first task an analyst should complete? A. Contact the incident coordinator to communicate the vulnerability. B. Conduct remediation activities within the recovery phase. C. Escalate the issue to the help desk team. D. Perform triage activities that will identify the risk. Answer: D https://www.passcert.com/CS0-004.html Page 6 COMPTIA CYBERSECURITY ANALYST Question 10 A security analyst isolates a Windows 11 workstation from the network after known malware is detected. The list of security information and event management (SIEM) events during the malware installation and timeline does not identify a specific user who was logged in. The security analyst uses the local administrative account to log in and would like a list of logins to the machine. Which of the following PowerShell commands should the analyst use? A. Eventvwr.exe -LogType "Security" EventID "*" | Export-Csv c:\temp\Seclog.csv -NoTypeInformation B. Get-WinEvent -FilterHashTable @{ Logname="Security" ED=4624; } | Sort-Object TimeCreated -Descending | Export-Csv c:\temp\Seclog.csv -NoTypeInformation C. Get-WinEvent -FilterHashTable @{ Logname="System" ED=9754; } | Sort-Object TimeCreated -Descending | Export-Csv c:\temp\Seclog.csv -NoTypeInformation D. Get-WinEvent -FilterHashTable @{ Logname="Application" ED=7124; } | Sort-Object TimeCreated -Descending | Export-Csv c:\temp\Seclog.csv -NoTypeInformation Answer: B COMPTIA CYBERSECURITY ANALYST Question 11 Which of the following occurs during the analysis phase of the incident response process? A. Triage B. Alert writing C. Reimaging D. Isolation Answer: A COMPTIA CYBERSECURITY ANALYST Question 12 A security architect reviews a report from a third-party incident response consultant and observes the following: Which of the following frameworks did the consultant use to perform analysis? A. Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege (STRIDE) https://www.passcert.com/CS0-004.html Page 7 Question 12 continued B. MITRE ATT&CK C. Diamond Model of Intrusion Analysis D. National Institute of Standards and Technology (NIST) Cybersecurity Framework E. Cyber Kill Chain Answer: C COMPTIA CYBERSECURITY ANALYST Question 13 Which of the following is commonly used after an incident has been resolved to identify efficiencies and corrective actions related to activities performed during the incident response process? A. Lessons learned B. Key performance indicators (KPIs) and performance metrics C. Executive summary D. Root cause analysis Answer: A