CompTIA CS0-004 Questions Answers

The framework is the Diamond Model of Intrusion Analysis . The Diamond Model represents malicious activity using four core interconnected features: adversary, infrastructure, capability, and victim . This structure allows incident responders and threat-intelligence analysts to examine relationships between who conducted an intrusion, the technical resources used, the capabilities or tools involved, and the targeted organization or asset.

The original Diamond Model paper explicitly defines an intrusion event around these four core features and connects them in a diamond-shaped analytical structure. This relational approach is particularly useful for correlating separate intrusion events, identifying common infrastructure, associating capabilities with adversaries, and developing broader campaign intelligence.

STRIDE is a threat-modeling categorization method covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. MITRE ATT & CK organizes real-world adversary behavior according to tactics and techniques. The Cyber Kill Chain organizes intrusion activity into sequential attack stages. The NIST Cybersecurity Framework is a broader cybersecurity risk-management framework rather than an intrusion-event relationship model.

Therefore, a diagram or report organized around adversary–capability–infrastructure–victim relationships specifically identifies the Diamond Model.

Study Guide Reference: Incident Response and Management → Attack Methodology Frameworks → Diamond Model of Intrusion Analysis → Adversary → Infrastructure → Capability → Victim.

The log relationships support two conclusions: ws-57 is scanning dc-1 , and ws-57 is communicating with a service through a non-standard port . Network scanning is normally identified when one source system attempts connections against multiple ports or services on another host over a short period. Here, the directionality of the recorded communications identifies ws-57 as the initiating host and dc-1 as the target, supporting option A rather than B.

Port numbers then need to be interpreted in context. Standard service-port mappings provide useful baselines, but a service can technically operate on a port different from its conventional assignment. Detection logic therefore needs to consider both the actual port number and the protocol or service identified in the traffic. Nmap, for example, classifies scanned ports according to states and attempts to associate ports with known services during network reconnaissance.

The entries do not provide sufficient behavioral evidence for phishing delivery or ransomware infection. Those conclusions would require additional indicators such as SMTP message evidence, malicious attachments, encryption activity, process execution, or endpoint telemetry.

The correct analytical approach is to determine source, destination, connection pattern, and port/service relationship before assigning malicious intent.

Study Guide Reference: Security Operations → Network Log Analysis → Scanning/Enumeration → Source/Destination Interpretation → Ports and Protocols → Non-standard Service Ports.

The analyst should prioritize tlindy because the activity associated with that account presents the strongest anomaly in the supplied access-log evidence. Web access-log analysis is fundamentally contextual: an analyst compares source information, request behavior, authentication activity, timestamps, response codes, geographic indicators, user-agent characteristics, and established behavioral expectations to determine which entry warrants immediate investigation.

The fact that the organization is explicitly identified as being based in the United States is an important contextual clue. Geographic or behavioral activity inconsistent with the expected operating profile of an account can raise investigative priority, particularly when combined with unusual authentication or web-request characteristics. Importantly, geographic deviation alone does not prove compromise; VPN services, business travel, cloud infrastructure, and remote-working arrangements can produce legitimate anomalies. The correct SOC action is therefore investigation rather than immediate attribution.

This question tests the analyst's ability to distinguish normal activity from anomalous activity using log context , rather than simply searching for a particular HTTP status code or username. CySA+ expects analysts to correlate multiple data points before establishing whether activity represents an indicator of compromise.

The uploaded examination material identifies tlindy as the account requiring first investigation.

Study Guide Reference: Security Operations → Log Analysis → Web Application Logs → Behavioral Indicators → Anomaly Detection → User and Entity Context.

MITRE ATT & CK Navigator is primarily a visualization and analytical tool for understanding adversary behavior and evaluating defensive coverage against ATT & CK tactics and techniques. Analysts can create layers over ATT & CK matrices, highlight techniques associated with specific threat groups, compare adversary profiles, record detection coverage, and identify techniques for which defensive visibility or controls are insufficient.

MITRE explicitly states that ATT & CK Navigator can be used to visualize defensive coverage, support red-team and blue-team planning, and represent the frequency of detected techniques. MITRE's ATT & CK design guidance also recognizes defensive gap assessment as a means of identifying areas where an enterprise lacks sufficient defenses or visibility.

Navigator itself does not replicate adversary behavior; adversary-emulation platforms and red-team tools perform that function. It is not a malware reverse-engineering platform, nor does it independently build defensive tools or execute incident-response actions.

Its major operational value is translating ATT & CK's behavioral knowledge base into a visual map that lets defenders answer two questions: What behaviors are relevant to the threats we face, and where do our detections or controls have gaps?

Study Guide Reference: Security Operations → MITRE ATT & CK → ATT & CK Navigator → Tactics and Techniques → Threat Mapping → Detection Coverage → Gap Analysis.