CS0-004 Exam Dumps : CompTIA Cybersecurity Analyst CySA+ V4 (New Version)

The Diamond Model of Intrusion Analysis is specifically suited to visually representing relationships between a threat actor, the infrastructure used during an intrusion, the actor's capabilities, and the victim. Its four principal vertices are adversary, infrastructure, capability, and victim . IP addresses and network services naturally map to infrastructure, while malware and attack tools map to capability.

The original Diamond Model describes an intrusion event through these four interconnected features and uses their relationships to support documentation, correlation, and analysis of malicious activity. This makes it particularly useful when the analyst wants to visualize intelligence rather than simply place activity into chronological stages.

EPSS predicts the probability that a vulnerability will be exploited and therefore does not model threat-actor infrastructure. The Cyber Kill Chain represents progressive stages of an intrusion, making it useful for understanding attack progression but less suitable for relational visualization. MITRE ATT & CK provides detailed behavioral information on adversary tactics and techniques; MITRE itself notes that ATT & CK and the Diamond Model are complementary, with the Diamond Model particularly useful for clustering and relating intrusion information.

Study Guide Reference: Security Operations → Threat Intelligence → Diamond Model → Adversary → Infrastructure → Capability → Victim → Threat Visualization.

Operational technology environments frequently contain specialized controllers, industrial control systems, supervisory control and data acquisition equipment, embedded operating systems, and vendor-specific devices that were designed primarily for availability, safety, deterministic operation, and long service life. Traditional enterprise security controls—such as endpoint detection agents, vulnerability scanners, host-based firewalls, aggressive patching mechanisms, or modern authentication software—may not be supported and can potentially interfere with operational processes.

For this reason, organizations often implement compensating controls around OT assets when the preferred security control cannot be deployed directly. Examples include network segmentation, tightly controlled firewall rules, protocol allowlisting, passive monitoring, secure jump servers, access restrictions, enhanced logging, and additional physical controls. These measures reduce risk without requiring unsupported software to be installed on sensitive industrial devices.

High network bandwidth consumption is not the defining reason for compensating controls. Scheduled outage windows can actually facilitate maintenance rather than explain why alternative controls are required. Likewise, lack of encryption may be a weakness in some environments, but it does not explain the broader compatibility problem.

CS0-004 specifically places OT, ICS, and SCADA under critical-infrastructure concepts in Security Operations and separately recognizes compensating controls as a formal vulnerability mitigation strategy.

Study Guide Reference: Security Operations → Critical Infrastructure → OT/ICS/SCADA → Security Architecture → Compatibility Constraints and Compensating Controls.

An agent-based scan relies on software installed directly on the endpoint to collect local system state and report vulnerability or configuration information to the management platform. Because the agent has local visibility, its findings can be influenced by endpoint configuration, agent policy, update state, privileges, enabled assessment modules, or configuration changes that determine what information is collected and evaluated.

The scenario indicates that regularly scheduled assessment activity initially failed to identify the newly disclosed vulnerability, but the condition became visible after a configuration change. Among the available choices, that behavior most strongly aligns with an agent-based assessment whose local collection or assessment configuration had to be updated before the vulnerability could be detected.

An external scan evaluates systems from outside the organizational boundary and focuses primarily on externally reachable services. A network scan examines hosts and services remotely and is governed mainly by network reachability and scanner capabilities. A credentialed scan authenticates into a system to obtain deeper visibility, but the defining characteristic in the question is the persistent endpoint-based assessment affected by configuration.

CySA+ vulnerability-management objectives distinguish assessment techniques by perspective, authentication level, deployment method, and resulting visibility. Analysts must understand why different scanning architectures can produce different findings.

Study Guide Reference: Vulnerability Management → Vulnerability Scanning Methods → Agent-Based Scanning → Network Scanning → Credentialed Scanning → Scan Configuration and Coverage.