Free CS0-004 sample questions

Correct answer: Kerberoasting attacks

Event ID 4769 is generated every time a Kerberos service ticket (TGS) is requested. In a Kerberoasting attack, an adversary requests TGS tickets for service accounts (which have SPNs) to extract them and crack the service account passwords offline. Without Event ID 4769, detecting the anomalous volume of TGS requests associated with Kerberoasting is highly difficult. Password spraying, LLMNR poisoning, and DCSync are detected via other event IDs or network traffic.

Correct answer: The user connected to a corporate VPN gateway located in a different geographic region.

Impossible travel alerts trigger when the physical distance between two authentication source IP addresses cannot be traversed in the time elapsed. A common benign cause (false positive) is a user connecting to a VPN routing traffic through an exit node in another country, making their IP appear to be in Tokyo while they are physically in New York.

Correct answer: Deploying identity-aware access proxies and implementing microsegmentation for all workloads.

Zero Trust Architecture (ZTA) shifts the security perimeter from the network edge to identity and context. Deploying identity-aware proxies ensures that every access request is authenticated and authorized based on user identity and device posture, regardless of network location. Microsegmentation prevents lateral movement by isolating workloads. Upgrading firewalls or deploying NIDS still relies on network-centric boundaries, which contradicts the core mandate of ZTA.

Correct answers: Isolating the compromised workstation from the corporate network while leaving a forensic connection intact.; Analyzing the memory space of a running process to detect reflective DLL injection.

Endpoint Detection and Response (EDR) solutions are designed to monitor endpoint behavior at a deep level, including memory analysis, process trees, and registry modifications. Analyzing memory for DLL injection and isolating the endpoint from the network are core EDR capabilities. SIEMs are used for log aggregation and correlation across disparate systems (like firewalls and badge readers) and evaluating cloud identity logs.

Endpoint Detection and Response (EDR) solutions are designed to monitor endpoint behavior at a deep level, including memory analysis, process trees, and registry modifications. Analyzing memory for DLL injection and isolating the endpoint from the network are core EDR capabilities. SIEMs are used for log aggregation and correlation across disparate systems (like firewalls and badge readers) and evaluating cloud identity logs.

Correct answer: Extraction of plaintext passwords or NTLM hashes from memory.

Mimikatz is a well-known credential dumping tool used to extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory (specifically the LSASS process in Windows). The immediate risk is credential theft, which facilitates privilege escalation and lateral movement. It is not used for DoS, ransomware encryption, or SQL injection.

Correct answer: An attacker is using DNS tunneling to exfiltrate data or maintain command and control (C2).

DNS tunneling abuses the DNS protocol to bypass firewalls and proxy restrictions. Attackers often use TXT records because they allow for larger payloads of arbitrary text. The presence of base64-encoded strings in TXT responses from a non-standard external IP is a classic indicator of a Command and Control (C2) channel or data exfiltration via DNS tunneling. sequenceDiagram participant W as Compromised Workstation participant F as Firewall participant C as Attacker C2 (Rogue DNS) W->>F: DNS Query (TXT) encoded_data.evil.com F->>C: Forwards DNS Query (Port 53 allowed) C-->>F: DNS Response (TXT) Base64_C2_Command F-->>W: Delivers Command

Correct answer: SAML 2.0

Security Assertion Markup Language (SAML) 2.0 is an XML-based standard in which an Identity Provider (IdP) issues signed assertions that Service Providers (SPs) trust for web SSO. The attack described is a 'Golden SAML' attack: with the IdP's token-signing private key, the attacker forges valid signed XML assertions for any user and bypasses authentication entirely. OpenID Connect uses JSON-based JWT ID tokens, OAuth 2.0 is an authorization framework whose tokens are not XML assertions, and RADIUS is a network AAA protocol.

Correct answer: True

True. AI Hallucinations occur when a Generative AI model generates output that sounds plausible and confident but is entirely fabricated or factually incorrect. In security operations, this is a significant risk as it can result in false positives, misattribution of threats, or wasted time during incident response.

Correct answer: STIX and TAXII

Structured Threat Information Expression (STIX) is a standardized XML/JSON language for describing cyber threat information. Trusted Automated eXchange of Indicator Information (TAXII) is the transport protocol used to exchange STIX data over HTTPS. Together, they form the industry standard for automated threat intelligence sharing.

Correct answer: Security Orchestration, Automation, and Response (SOAR)

SOAR platforms are specifically designed to improve SOC efficiency by automating repetitive tasks such as data enrichment. A SOAR playbook can trigger automatically when a phishing alert arrives, query AD, firewalls and endpoints, and present the consolidated context to the analyst immediately. This drastically cuts manual triage effort and the time to respond (MTTR). DLP, NDR and XDR generate or correlate detections but do not orchestrate this enrichment workflow.