CompTIA Cybersecurity Analyst (CySA+) V4 (CS0-004)

✅ Option D (Correct)
Reasoning: Tactics, Techniques, and Procedures (TTPs) fundamentally describe an attacker's overall strategy, behavioral patterns, and specific methods. This insight enables defenders to understand how adversaries operate, anticipate their next moves, and implement proactive defenses that go beyond reacting to individual artifacts. It provides a strategic advantage for building resilient security.

❌ Why the other choices are incorrect:

• Option A is incorrect: Hash values and IP addresses are specific indicators of compromise (IOCs). While related to an attacker's activity, TTPs represent the broader behavior and strategy that lead to or use these elements, rather than being defined by them.
• Option B is incorrect: Indicators of Compromise (IOCs) are forensic artifacts. TTPs provide the context and behavioral framework for why and how IOCs appear, offering a more strategic understanding than merely listing individual indicators.
• Option C is incorrect: Understanding the tools used is part of the 'Procedures' aspect of TTPs. However, TTPs encompass a much broader scope, including the overarching tactics and techniques, which are more critical for understanding the attacker's full strategy and behavior.

Network segmentation isolates business-critical assets, making them less discoverable and accessible to unauthorized entities or attackers within the network. This isolation effectively 'obfuscates' these assets, hindering lateral movement and preventing a breach in one segment from easily reaching high-value targets. It's a key defense-in-depth strategy to protect sensitive resources.

✅ Option A (Correct)

Reasoning: CyberChef is a powerful web-based tool specifically designed for data manipulation, including parsing and extracting specific patterns like IPv4 addresses from unstructured text using its various operations and regular expression capabilities. This makes it ideal for handling raw IoC documents.

❌ Why the other choices are incorrect:

• Option B is incorrect: Wireshark is a network protocol analyzer used for capturing and examining network traffic, not for extracting data from static text documents.
• Option C is incorrect: Zeek is a network analysis framework that provides high-level transaction logs and performs deep protocol analysis on network traffic, not unstructured text.
• Option D is incorrect: Open Cyber Threat Intelligence (OpenCTI) is a platform for managing and sharing threat intelligence, not for the initial extraction of IoCs from raw, unstructured text documents.

✅ Option C (Correct)

Reasoning: Traditional IT security solutions often lack compatibility with OT environments due to differing priorities (availability and safety over confidentiality), legacy systems, proprietary protocols, and real-time operational demands. Implementing standard IT tools could disrupt critical operations, leading to the necessity of compensating controls to achieve security objectives.

❌ Why the other choices are incorrect:

• Option A is incorrect: Network bandwidth usage in ICS does not inherently drive the need for compensating security controls; security compatibility issues are the primary concern.
• Option B is incorrect: Scheduled outage windows relate to maintenance and operational planning, not the fundamental technical challenges of integrating traditional IT security solutions into OT.
• Option D is incorrect: While many OT devices lack native encryption, this is a specific security weakness. The broader reason for using compensating controls is the incompatibility of traditional IT solutions to address this and other security gaps without impacting critical operations.

The metrics show a high volume of raw alerts (3701) compared to investigations (491) and incidents (5). This discrepancy indicates a significant number of non-actionable or false-positive alerts. Tuning detections addresses this by reducing alert noise at the source, allowing analysts to focus on legitimate threats and significantly improving overall operational efficiency by reducing wasted effort on irrelevant alerts.

Continuous monitoring is essential for zero-day vulnerabilities. It enables an organization to detect exploitation attempts, identify anomalous behavior, and implement temporary compensating controls or custom IPS/IDS rules until a vendor-supplied patch becomes available. This proactive vigilance minimizes the window of exposure.

A: Sinkholing is incorrect: Sinkholing redirects malicious traffic, typically for botnet command and control, but doesn't directly address the underlying zero-day vulnerability or its exploitation.
B: Eradication techniques are incorrect: Eradication focuses on removing the root cause after a compromise. While patching is an eradication technique, the question specifies 'until a patch is available'.
D: Evidence acquisition is incorrect: Evidence acquisition is a forensic step conducted after an incident or suspected compromise, not a preventative measure for an unpatched vulnerability.

✅ Option C (Correct)
Reasoning: Zero Trust operates on the principle of "never trust, always verify." It mandates continuous validation and explicit authorization for every access request to resources, irrespective of origin. This approach directly aligns with the CISO's objective of continuously validating and verifying internal access to the production environment for enhanced security.

❌ Why the other choices are incorrect:

• Option A is incorrect: Secure Access Service Edge (SASE) integrates cloud-delivered networking and security services (e.g., SD-WAN, SWG, ZTNA) for secure access, often for remote users. It's an architectural model, not primarily focused on continuous internal access validation for production.
• Option B is incorrect: A Next-Generation Firewall (NGFW) provides deep packet inspection, intrusion prevention, and application control to enforce network policies. While crucial for network segmentation, an NGFW primarily enforces rules rather than continuously validating user and device identities for access requests.
• Option D is incorrect: Privileged Access Management (PAM) specifically secures and manages accounts with elevated permissions, such as administrators. While critical for protecting production environments, it addresses a subset of access, not the comprehensive, continuous validation of all access as described.

The http display filter in tshark specifically targets unencrypted HTTP traffic (port 80). Encrypted web traffic (HTTPS) would require filtering for tls or ssl. The udp display filter captures all User Datagram Protocol traffic, which inherently includes DNS traffic (port 53). Thus, the command displays unencrypted web requests and DNS.

✅ Option B (Correct)

Reasoning: Secure Access Service Edge (SASE) converges networking and security functions into a cloud-delivered service. It enables a perimeter-less, identity-driven security model by enforcing policies based on user and device context, irrespective of location, aligning perfectly with a zero-trust or perimeter-less network topology.

❌ Why the other choices are incorrect:

• Option A is incorrect: Hybrid cloud networks typically maintain distinct perimeters between on-premises infrastructure and public cloud environments, which contradicts a perimeter-less design.
• Option C is incorrect: Cloud-native computing is an approach to building and running applications, leveraging services like containers and microservices. While it operates in the cloud, it doesn't inherently define a perimeter-less network topology for user and device access.
• Option D is incorrect: Content delivery networks (CDNs) are designed to improve content delivery speed and availability by caching data closer to users. They do not fundamentally change the security model to support a perimeter-less network for enterprise access.