Free CS0-004 sample questions

Correct answer: Sensitive organizational data and Indicators of Compromise (IoCs) could be inadvertently used to train the public model.

When utilizing public or cloud-based GenAI tools, the primary governance risk is data leakage. Submitting proprietary incident data, PII, or internal network architecture details to a public LLM can result in that sensitive data being absorbed into the model's training set and potentially exposed to unauthorized parties. The other options represent technical or workflow issues, but data privacy/leakage is the paramount governance risk. flowchart TD SOC[SOC Analyst] -->|Pastes alert data| AI[Public GenAI Tool] AI -->|Absorbs data| Model[(Training Model)] Model -.->|Potential Exposure| Ext[External Actors] style Model fill:#f9f,stroke:#333,stroke-width:2px

Correct answer: Hypothesis-driven threat hunting

Hypothesis-driven threat hunting is a proactive approach where the hunter creates a hypothesis (e.g., "An attacker is bypassing execution policies using PowerShell") based on threat intelligence or knowledge of adversary tactics, and then searches the environment for evidence of that specific behavior, assuming traditional defenses have failed. It relies on behavioral analysis rather than static IoC matching.

Correct answer: Kerberoasting attacks

Event ID 4769 is generated every time a Kerberos service ticket (TGS) is requested. In a Kerberoasting attack, an adversary requests TGS tickets for service accounts (which have SPNs) to extract them and crack the service account passwords offline. Without Event ID 4769, detecting the anomalous volume of TGS requests associated with Kerberoasting is highly difficult. Password spraying, LLMNR poisoning, and DCSync are detected via other event IDs or network traffic.

Correct answer: The user connected to a corporate VPN gateway located in a different geographic region.

Impossible travel alerts trigger when the physical distance between two authentication source IP addresses cannot be traversed in the time elapsed. A common benign cause (false positive) is a user connecting to a VPN routing traffic through an exit node in another country, making their IP appear to be in Tokyo while they are physically in New York.

Correct answer: Deploying identity-aware access proxies and implementing microsegmentation for all workloads.

Zero Trust Architecture (ZTA) shifts the security perimeter from the network edge to identity and context. Deploying identity-aware proxies ensures that every access request is authenticated and authorized based on user identity and device posture, regardless of network location. Microsegmentation prevents lateral movement by isolating workloads. Upgrading firewalls or deploying NIDS still relies on network-centric boundaries, which contradicts the core mandate of ZTA.

Correct answers: Analyzing the memory space of a running process to detect reflective DLL injection.; Isolating the compromised workstation from the corporate network while leaving a forensic connection intact.

Endpoint Detection and Response (EDR) solutions are designed to monitor endpoint behavior at a deep level, including memory analysis, process trees, and registry modifications. Analyzing memory for DLL injection and isolating the endpoint from the network are core EDR capabilities. SIEMs are used for log aggregation and correlation across disparate systems (like firewalls and badge readers) and evaluating cloud identity logs.

Endpoint Detection and Response (EDR) solutions are designed to monitor endpoint behavior at a deep level, including memory analysis, process trees, and registry modifications. Analyzing memory for DLL injection and isolating the endpoint from the network are core EDR capabilities. SIEMs are used for log aggregation and correlation across disparate systems (like firewalls and badge readers) and evaluating cloud identity logs.

Correct answer: Extraction of plaintext passwords or NTLM hashes from memory.

Mimikatz is a well-known credential dumping tool used to extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory (specifically the LSASS process in Windows). The immediate risk is credential theft, which facilitates privilege escalation and lateral movement. It is not used for DoS, ransomware encryption, or SQL injection.

Correct answer: An attacker is using DNS tunneling to exfiltrate data or maintain command and control (C2).

DNS tunneling abuses the DNS protocol to bypass firewalls and proxy restrictions. Attackers often use TXT records because they allow for larger payloads of arbitrary text. The presence of base64-encoded strings in TXT responses from a non-standard external IP is a classic indicator of a Command and Control (C2) channel or data exfiltration via DNS tunneling. sequenceDiagram participant W as Compromised Workstation participant F as Firewall participant C as Attacker C2 (Rogue DNS) W->>F: DNS Query (TXT) encoded_data.evil.com F->>C: Forwards DNS Query (Port 53 allowed) C-->>F: DNS Response (TXT) Base64_C2_Command F-->>W: Delivers Command

Correct answer: SAML 2.0

Security Assertion Markup Language (SAML) 2.0 is an XML-based standard in which an Identity Provider (IdP) issues signed assertions that Service Providers (SPs) trust for web SSO. The attack described is a 'Golden SAML' attack: with the IdP's token-signing private key, the attacker forges valid signed XML assertions for any user and bypasses authentication entirely. OpenID Connect uses JSON-based JWT ID tokens, OAuth 2.0 is an authorization framework whose tokens are not XML assertions, and RADIUS is a network AAA protocol.

Correct answer: True

True. AI Hallucinations occur when a Generative AI model generates output that sounds plausible and confident but is entirely fabricated or factually incorrect. In security operations, this is a significant risk as it can result in false positives, misattribution of threats, or wasted time during incident response.