Online Access Free CS0-004 Practice Test

While reviewing logs, a SOC analyst notices traffic that is attempting connections to all hosts on ports 1-65535. Which of the following steps of the Cyber Kill Chain is most likely occurring?

• A.Installation
• B.Reconnaissance
• C.Weaponization
• D.Delivery

Which of the following does a phishing campaign click rate measure?

• A.The false-positive rate of data leakage prevention behavior
• B.The employees' security awareness
• C.The effectiveness of an organization's email filters
• D.The speed of responding to a social engineering attack

A security analyst is reviewing an alert about connections from an IT member to the Chief Privacy Officer's (CPO) laptop. There was abnormal network traffic from the CPO's laptop to an unknown server located in the IT legacy network and then to an unknown internet location. Based on the following information:

Which of the following best categorizes the detected activity?

• A.Malicious insider
• B.Service disruption
• C.Unauthorized access
• D.Command-and-control

An analyst receives an alert that a user clicked on a malicious link. The analyst verifies that the link is malicious and was intended to capture credentials. The analyst verifies that the user visited the website, but no evidence indicates that the credentials were used. The analyst recommends that the user take remedial training and closes the case. Which of the following steps in the incident response process did the analyst neglect?

• A.Recovery
• B.Containment
• C.Post-incident
• D.Analysis

A security analyst runs an Nmap scan against a host with multiple open ports using the following command:
nmap 10.10.10.1 -p-
The following output is obtained after the scan:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-15 15:55 UTC
Note: Host seems down.
Nmap done: 1 IP address (0 hosts up) scanned in 3.16 seconds
Which of the following is the most accurate way to scan the target IP for open ports?

• A.nmap 10.10.10.1/24 -p- -R -O --script=ssl-enum-ciphers
• B.nmap 10.10.10.1 -p80,443,445,9999,135,22,21 -b --traceroute
• C.nmap -sn -p- 10.10.10.1
• D.nmap -p- -Pn 10.10.10.1