Try CompTIA CySA+ CS0-004

Q1.A multinational corporation is evaluating its AI-powered security tools for compliance with emerging AI governance requirements. The EU AI Act classifies certain AI systems as high-risk and imposes strict transparency and accountability obligations. Which TWO of the following AI security use cases would MOST likely be classified as high-risk under the EU AI Act framework?

• A.AI-based automated log aggregation from SIEM platforms
• B.AI-driven employee behavior monitoring and insider threat scoring
• C.AI-generated summaries of publicly available threat intelligence reports
• D.AI-driven access control decisions for critical infrastructure
• E.ML-based network traffic baseline analysis

Domain: Security Operations

Q2.A vulnerability analyst runs a credentialed scan against a Windows server and the scan report shows that a specific CVE has been detected by both a plugin-based check and a version-based check, but the results conflict. The plugin-based check reports the vulnerability as not present, while the version-based check reports it as present. Which interpretation is most likely correct and why?

• A.The version-based check is correct because version numbers are definitive indicators of vulnerability presence
• B.The conflict indicates a scanner malfunction that invalidates all scan results for this server
• C.Both checks are unreliable when they conflict, so the finding should be removed from the report
• D.The plugin-based check is likely correct because it actively verified the vulnerability condition, while the version-based check may be a false positive due to backported patches

Domain: Vulnerability Management

Q3.A security analyst is reviewing Volatility output from the netscan plugin on a compromised Windows server. The output shows that the process svchost.exe (PID 4820) has an established TCP connection to an external IP address on port 443. The analyst then runs the pslist plugin and confirms svchost.exe PID 4820 exists, but the psscan plugin shows an additional svchost.exe process (PID 6144) that does not appear in the pslist output. What does this discrepancy MOST likely indicate?

• A.A normal process that terminated but has not been fully cleaned from memory
• B.A hidden process using DKOM to unlink itself from the process list
• C.A child process of PID 4820 that inherited the svchost.exe name
• D.A Volatility analysis error producing duplicate process entries

Domain: Incident Response

Q4.A CISO is evaluating the security program against the Capability Maturity Model (CMM). The organization has documented security policies and procedures, security tools are deployed and operational, but processes vary significantly between teams and incident response depends heavily on individual analyst expertise. At which CMM level is this security program MOST likely operating?

• A.CMM Level 1 – Initial
• B.CMM Level 2 – Repeatable
• C.CMM Level 3 – Defined
• D.CMM Level 4 – Quantitatively Managed

Domain: Reporting and Communication

Q5.A threat intelligence analyst is building an adversary profile and needs to map a specific attack to ATT&CK. The adversary gained initial access through a supply chain compromise, executed code through a scripting interpreter, escalated privileges by exploiting a vulnerable kernel driver, and exfiltrated data over an alternative protocol. Which TWO mappings correctly pair the activity with its ATT&CK tactic?

• A.Supply chain compromise maps to the Collection tactic
• B.Exfiltration over alternative protocol maps to the Exfiltration tactic
• C.Supply chain compromise maps to the Initial Access tactic
• D.Scripting interpreter maps to the Persistence tactic
• E.Kernel driver exploitation maps to the Lateral Movement tactic

Domain: Security Operations