CS0-004 CompTIA Cybersecurity Analyst (CySA+) V4 Practice Questions

Role chaining occurs when an identity uses its permissions to assume another role, which may then assume another role, and so on. Attackers use this to escalate privileges or move laterally across cloud accounts (cross-account access). The sts:AssumeRole API call is the primary mechanism for this in AWS. While SSRF might have been used initially to steal the instance credentials, the log activity itself represents role chaining.

A credentialed (authenticated) scan uses administrative credentials to log into the target system. This allows the scanner to read the local registry, check installed software versions, and verify local file configurations. An uncredentialed scan only sees what is exposed over the network (e.g., open ports and banner grabbing) and cannot check registry keys.

In CVSS v4.0 (and previous versions), Environmental metrics allow an organization to customize the score for its own environment. The Modified Base metrics let the consumer override Base values to reflect deployment characteristics and mitigations - for example, Modified Attack Vector set to Physical because this server is isolated, with compensating controls such as application allowlisting reflected in the modified exploitability/impact values - while the Security Requirements (CR/IR/AR) express how critical the asset is to the organization. Base metrics describe the intrinsic qualities of the flaw, Threat metrics (formerly Temporal) describe Exploit Maturity, and Supplemental metrics add context without changing the score.

Since the application uses parameterized queries (which prevent SQL injection) and the finding was triggered solely by a generic error message keyword, this is a false positive. The analyst must document it as such to prevent wasted remediation efforts. Additionally, suppressing or tuning the scanner rule prevents this false alert from recurring in future scans.

Since the application uses parameterized queries (which prevent SQL injection) and the finding was triggered solely by a generic error message keyword, this is a false positive. The analyst must document it as such to prevent wasted remediation efforts. Additionally, suppressing or tuning the scanner rule prevents this false alert from recurring in future scans.

When a system cannot be patched (due to being legacy or unsupported), the standard vulnerability management approach is to implement compensating controls. Network segmentation (isolating it in a VLAN) and restricting access (using a jump-box) mitigate the risk of remote exploitation without requiring a patch. Decommissioning halts revenue, and accepting a critical remote exploit risk without mitigation is negligent.

Under PCI DSS compliance requirements, organizations that process cardholder data must conduct external vulnerability scans at least quarterly. Furthermore, these specific external scans must be performed by a PCI SSC Approved Scanning Vendor (ASV). Internal scans do not require an ASV.

Static Application Security Testing (SAST) analyzes application source code, byte code, or binaries for security vulnerabilities without executing the program. It is ideal for early CI/CD integration (shift-left). DAST tests the running application from the outside, while IAST uses instrumentation within the running app.

When utilizing public or cloud-based GenAI tools, the primary governance risk is data leakage. Submitting proprietary incident data, PII, or internal network architecture details to a public LLM can result in that sensitive data being absorbed into the model's training set and potentially exposed to unauthorized parties. The other options represent technical or workflow issues, but data privacy/leakage is the paramount governance risk.

Hypothesis-driven threat hunting is a proactive approach where the hunter creates a hypothesis (e.g., "An attacker is bypassing execution policies using PowerShell") based on threat intelligence or knowledge of adversary tactics, and then searches the environment for evidence of that specific behavior, assuming traditional defenses have failed. It relies on behavioral analysis rather than static IoC matching.

Event ID 4769 is generated every time a Kerberos service ticket (TGS) is requested. In a Kerberoasting attack, an adversary requests TGS tickets for service accounts (which have SPNs) to extract them and crack the service account passwords offline. Without Event ID 4769, detecting the anomalous volume of TGS requests associated with Kerberoasting is highly difficult. Password spraying, LLMNR poisoning, and DCSync are detected via other event IDs or network traffic.