A security analyst responds to an alert regarding identity and access management activity within the cloud environment. The attacker is currently trying to gain access from one isolated cloud subscription to another via a compromised user role.
Which of the following aspects of the MITRE ATT&CK framework is the attacker trying to perform?
Correct Answer: B
Explanation:
The attacker is attempting lateral movement because an already compromised identity is being used to move from one cloud environment or subscription into another. Lateral movement describes adversary activity intended to reach additional systems, services, accounts, or resources after an initial foothold has been established.
MITRE ATT&CK specifically includes cloud-oriented lateral movement. Its Lateral Movement tactic documents adversaries using valid accounts to access additional cloud services and resources within compromised environments. MITRE also documents cloud-role manipulation that may enable movement into additional accounts, demonstrating how identity and role relationships can become lateral-movement pathways in cloud architectures.
Privilege escalation would apply if the attacker were primarily attempting to obtain greater permissions within the current security context. Persistence concerns maintaining long-term access. Execution concerns running malicious code or commands. Credential access involves obtaining credentials or authentication material.
In this scenario, the attacker already possesses a compromised user role. The objective is to use that existing access to traverse a trust boundary and reach another isolated subscription. That movement between security domains is the decisive indicator of the Lateral Movement tactic.
Study Guide Reference: Security Operations MITRE ATT&CK Lateral Movement Cloud Services Valid Accounts IAM Roles Cross-Subscription Access.
Which of the following is the most important reason why tactics, techniques, and procedures (TTP) are beneficial to a defensive strategy?
Correct Answer: D
Explanation:
Tactics, techniques, and procedures represent the behavioral characteristics of an adversary rather than merely individual technical artifacts. A tactic describes the adversary’s objective, a technique identifies how that objective is achieved, and procedures represent the specific implementation observed during an intrusion. Consequently, TTP intelligence allows defenders to understand how an attacker operates, including patterns of reconnaissance, persistence, privilege escalation, lateral movement, command-and-control activity, and other operational behaviors.
Options A and B focus primarily on indicators of compromise such as IP addresses and hashes. These are useful for detection, but they are comparatively fragile because attackers can replace infrastructure, change domains, regenerate malware, or modify files to produce different hashes. Option C is broader than an individual IoC, but tools can likewise be replaced or modified. Behavioral knowledge is generally more durable because changing established operational methods imposes greater cost on an adversary.
The CS0-004 objectives explicitly place TTPs, Pyramid of Pain, MITRE ATT&CK, attribution, IoC analysis, and behavioral indicators within threat intelligence and threat-hunting concepts.
Study Guide Reference: Security Operations Threat Intelligence and Threat Hunting TTPs Pyramid of Pain MITRE ATT&CK Behavioral IoCs.
An analyst uses an AI platform to help correlate events. The AI output contains events that did not happen. This results in inaccurate correlations.
Which of the following best describes what has occurred?
Correct Answer: A
Explanation:
The scenario describes an AI hallucination, commonly termed confabulation in formal AI risk-management literature. The defining characteristic is that the model produces information that appears plausible but is factually incorrect or unsupported. Here, the AI system introduces events that never occurred, contaminating the event-correlation process and potentially causing analysts to reach incorrect conclusions.
NIST’s Generative AI Profile identifies confabulation as the production of confidently stated but erroneous or false content and treats it as an AI risk that requires verification and monitoring. NIST cybersecurity guidance also recognizes hallucination and confabulation as risks to information accuracy when AI is incorporated into cybersecurity workflows.
Data exposure would involve unauthorized disclosure of confidential or sensitive information. A malicious prompt involves intentionally crafted input designed to influence model behavior or bypass restrictions. Model poisoning occurs when an adversary manipulates training or model-related data to corrupt the system’s behavior. None of these conditions is required in the scenario; the critical evidence is fabrication of nonexistent events.
Security analysts therefore must treat AI-generated correlation as analytical assistance rather than unquestioned evidence and validate important conclusions against authoritative logs and telemetry.
Study Guide Reference: Security Operations Artificial Intelligence AI Risks Hallucinations Data Exposure Malicious Prompts Model Poisoning Human Validation.
A public threat intelligence report includes indicators of compromise (IoCs) for threat actors. The threat actors are exploiting a zero-day vulnerability that the vendor has not fixed.
Which of the following techniques should be used until a patch is available?
Correct Answer: C
Explanation:
A zero-day vulnerability presents a special remediation problem because the affected organization may have confirmed exposure while no vendor patch is available. Until permanent remediation becomes possible, the organization should increase continuous monitoring for evidence that the vulnerability is being targeted or exploited. Threat-intelligence IoCs can be incorporated into SIEM, EDR, IDS/IPS, network monitoring, and threat-hunting workflows to identify suspicious connections, processes, authentication events, or other behaviors associated with the threat actor.
Continuous monitoring does not eliminate the vulnerability, but it strengthens detection capability during the exposure window and supports rapid containment if exploitation occurs. This approach should ordinarily be combined with available compensating controls such as segmentation, access restrictions, service disabling, configuration changes, or other vendor-recommended workarounds.
Sinkholing is primarily used to redirect malicious network traffic, particularly command-and-control or malicious-domain traffic, and is not a general solution for an unpatched zero-day. Eradication occurs after malicious artifacts or persistence mechanisms have been identified during incident response. Evidence acquisition is a forensic activity and does not reduce the immediate exploitation risk.
CS0-004 requires analysts to consider active exploitation/threat intelligence, patch/remediation availability, context, and compensating controls when prioritizing and mitigating vulnerabilities.
Study Guide Reference: Vulnerability Management Prioritization Active Exploitation Patch Availability Compensating Controls and Continuous Monitoring.
Which of the following will inhibit remediation when attempting to resolve a vulnerability?
Correct Answer: B
Explanation:
Legacy systems commonly inhibit vulnerability remediation because they may depend on obsolete operating systems, unsupported applications, specialized hardware, outdated protocols, or vendor products for which security updates are no longer provided. Even when a vulnerability is accurately identified, the organization may be unable to apply a modern patch without breaking compatibility, interrupting a critical business process, or violating vendor support requirements.
NIST guidance explicitly recognizes that legacy systems create unique security-management challenges, while federal cybersecurity guidance warns that products remaining in service after vendor support ends may lack effective mechanisms for addressing newly discovered vulnerabilities.
In such circumstances, vulnerability-management teams may need to use compensating controls such as segmentation, firewall restrictions, application allowlisting, stronger access controls, enhanced monitoring, or service isolation while planning migration or replacement. These controls reduce exposure but do not remove the underlying software defect.
”Controlled systems,” ”shared systems,” and ”closed systems” do not inherently prevent remediation. A shared system may require greater coordination, but it can still be fully supported and patchable. The defining issue with legacy technology is that technical and vendor constraints can directly prevent normal remediation.
Study Guide Reference: Vulnerability Management Remediation Constraints Legacy Systems End-of-Life Technology Patch Availability Compensating Controls System Replacement.
Prep2Certsis a premium service offering a comprehensive collection of exam questions and answers for over 1400 certification exams. It is regularly updated and designed to help users pass their certification exams confidently.
Please contact info@Prep2Certs.com and we will provide you with alternative payment options.
You can by Contacting our sales team.