New Release CS0-004 CompTIA CySA+ Questions

The analyst should collect the Netstat output first because current network-connection information is highly volatile and will change immediately when the server is disconnected. netstat-type evidence can identify active TCP/UDP connections, listening services, remote endpoints, and potentially the communication channels associated with an attacker or command-and-control infrastructure.

Digital-forensic acquisition follows the order of volatility : evidence most likely to disappear or change should be captured before more persistent artifacts. RFC 3227 explicitly directs investigators to proceed from volatile to less-volatile evidence and identifies information such as routing data, ARP cache, process state, memory-related information, and network state as highly time-sensitive.

The ARP table is also volatile and should be captured early, but the wording “before disconnecting the server from the network” makes active connection state particularly important because those sessions will terminate when network connectivity is removed. ShellBags are persistent forensic artifacts stored within Windows Registry data and can be collected later from disk. A hard-disk image is critical but comparatively nonvolatile and should follow acquisition of live state.

Therefore, live network-session information takes priority.

Study Guide Reference: Incident Response and Management → Evidence Acquisition → Order of Volatility → Live Response → netstat → Network Connections → Forensic Preservation.

Residual risk is the risk that remains after security controls, safeguards, or mitigation measures have been implemented. No practical security program can eliminate every threat or vulnerability completely, so organizations evaluate the remaining exposure to determine whether additional treatment is required or whether management can formally accept it.

The distinction from inherent risk is particularly important. Inherent risk represents the level of exposure before controls are applied. For example, an internet-facing application containing sensitive information may have substantial inherent risk. After implementing strong authentication, patching, a web application firewall, monitoring, secure coding controls, and segmentation, its probability and impact of compromise may be reduced—but not eliminated. The remaining exposure is residual risk.

“Acceptable risk” describes risk that falls within an organization's approved tolerance or appetite; residual risk may or may not be acceptable. If the remaining exposure still exceeds tolerance, further controls, avoidance, transfer, or other treatment may be necessary. “Appropriate” is not a formal risk category in this context.

Risk management therefore follows a continuous cycle of identifying inherent exposure, applying controls, measuring the remaining residual exposure , and comparing that level with organizational risk tolerance.

Study Guide Reference: Vulnerability Management → Risk Analysis → Inherent Risk → Mitigating Controls → Residual Risk → Risk Acceptance → Risk Appetite and Tolerance.

Zero Trust is based on the principle that access should not be implicitly trusted merely because a user, workload, or device has already entered the enterprise environment. Access decisions are continuously evaluated using identity, authentication state, device posture, authorization, contextual information, and resource sensitivity. The scenario's emphasis on continuously validating and verifying access therefore directly describes Zero Trust.

Traditional perimeter-oriented models tend to treat internal network position as a degree of trust. Zero Trust removes that assumption and requires explicit verification before granting access to protected resources. It also supports least privilege, granular authorization, segmentation, and ongoing assessment of sessions or identities.

Secure access service edge combines networking and security capabilities delivered through a distributed service architecture and can support Zero Trust implementations, but SASE itself is not the fundamental principle described. A next-generation firewall provides application-aware traffic inspection and policy enforcement but does not by itself establish continuous identity-centric verification. Privileged access management specifically controls elevated or administrative accounts; it is an important component of access security but addresses a narrower scope than Zero Trust.

The CS0-004 objectives explicitly identify Zero Trust Network Architecture , SASE, hybrid cloud, IAM, PAM, authentication, and authorization as Security Operations architecture concepts.

Study Guide Reference: Security Operations → Network Architecture → Zero Trust Network Architecture → IAM → Authentication and Authorization → Least Privilege.

Software Composition Analysis (SCA) is specifically designed to identify third-party and open-source components incorporated into software. It can enumerate libraries and dependencies, identify their versions, associate components with known vulnerabilities, and provide licensing information. This directly satisfies the legal team's requirement to determine whether the codebase contains open-source or commercially licensed libraries.

CISA's software supply-chain guidance recognizes software composition analysis and software bills of materials as mechanisms for obtaining visibility into software components. CISA guidance also notes that SBOM information can include both open-source and commercial third-party software and licensing information.

SAST examines source or compiled code for security weaknesses such as unsafe functions, data-flow problems, or coding vulnerabilities, but dependency licensing is not its primary purpose. DAST tests a running application from the outside and generally cannot inventory the complete component dependency tree. RASP operates within a running application to detect or prevent attacks. Credentialed infrastructure scanning identifies system-level vulnerabilities and configuration issues rather than software-license composition.

The strongest clue is the requirement to identify libraries and their licensing status , which directly maps to SCA.

Study Guide Reference: Vulnerability Management → Application Security Testing → SCA → Third-Party Components → Open-Source Dependencies → SBOM → Licensing and Vulnerability Analysis.