CS0-004 Practice Test

Question 11

A new security operations center (SOC) manager joins a team that struggles to meet service-level agreements (SLAs). The alert backlog continues to increase daily. Which of the following will the manager most likely need to do?

1. Automate escalation.
2. Improve the triage processes.
3. Upgrade threat intelligence.
4. Enhance the customer service response.

Question 12

Which of the following should a cybersecurity analyst utilize when a notification is inaccurate?

1. Data enrichment
2. Dashboard creation
3. Threat hunting
4. Alert tuning

Question 13

A Chief Information Security Officer (CISO) evaluates a threat heat map and notices a substantial increase in custom scanning and enumeration activities. The CISO wants to gather as much information as possible about the activities targeting the company to help prioritize mitigations. Which of the following solutions is the best way to accomplish this goal?

1. Configuring a honeypot in a separate environment to gather attacker techniques
2. Leveraging canary tokens on all production systems to detect valid intrusion attempts
3. Subscribing to information-sharing and threat intelligence reports for the industry
4. Implementing a web application firewall in front of all applications and having it log attacks

Question 14

An analyst uses an AI platform to help correlate events. The AI output contains events that did not happen. This results in inaccurate correlations. Which of the following best describes what has occurred?

1. Hallucinations
2. Data exposure
3. Malicious prompts
4. Model poisoning

Question 15

A security analyst must identify documents that contain encoded ActiveMime payloads in a directory containing thousands of files. The analyst runs the following command: grep -rail ActiveMime * The command returns no output. Which of the following Yet Another Recursive Acronym (YARA) rules should the analyst use to find the suspicious files?