CompTIA CS0-004 CompTIA Cybersecurity Analyst CySA+ V4 (New Version) Exam Practice Test

The common underlying weakness is insufficient handling and validation of untrusted application input . XSS occurs when attacker-controlled content is processed and subsequently rendered in a manner that allows script execution. SQL injection occurs when untrusted values become part of database commands without appropriate separation between code and data.

OWASP recommends validating untrusted input early in the processing workflow and applying syntactic and semantic validation. For SQL injection specifically, OWASP identifies parameterized queries as the primary defensive technique and recommends allow-list input validation as an additional defensive layer. For XSS, context-appropriate output encoding and sanitization must also be applied; therefore input validation should be viewed as part of secure application handling rather than the sole technical control.

A WAF can provide defense in depth but does not correct vulnerable application code. HSTS forces browsers to use HTTPS and protects transport security; it does not prevent malicious input from being interpreted by an application. Endpoint protection similarly operates on hosts and does not repair web application data-handling flaws.

Study Guide Reference: Vulnerability Management → Application Vulnerabilities → XSS → SQL Injection → Input Validation → Output Encoding → Parameterized Queries → Secure Coding.

/var/log/auth.log is the appropriate source because it records authentication and authorization activity on Debian/Ubuntu-style Linux systems, including password-related events, SSH logins, PAM authentication, and other authorization events. Canonical's Ubuntu documentation specifically identifies /var/log/auth.log as the authorization log used for password prompts, sudo, and remote logins.

The command performs three operations. cat /var/log/auth.log sends the log contents to standard output. The pipe forwards that data to grep "User1", which selects records containing the required username. Finally, > linux-events.txt redirects the resulting matching records into the requested flat-file report. Because auth.log can contain both accepted and rejected authentication activity, the command can capture successful and unsuccessful events associated with User1.

sssd is not the general authentication log path shown in the scenario and may contain only SSSD-specific events. A faillog-oriented source emphasizes failed logins and therefore does not satisfy the requirement to collect both successful and failed activity. /var/log/syslog contains broad system messages but is less precise than the dedicated authentication log.

Study Guide Reference: Security Operations → Linux Log Analysis → /var/log/auth.log → cat → grep → Output Redirection → Authentication Investigation.

Zero Trust is based on the principle that access should not be implicitly trusted merely because a user, workload, or device has already entered the enterprise environment. Access decisions are continuously evaluated using identity, authentication state, device posture, authorization, contextual information, and resource sensitivity. The scenario's emphasis on continuously validating and verifying access therefore directly describes Zero Trust.

Traditional perimeter-oriented models tend to treat internal network position as a degree of trust. Zero Trust removes that assumption and requires explicit verification before granting access to protected resources. It also supports least privilege, granular authorization, segmentation, and ongoing assessment of sessions or identities.

Secure access service edge combines networking and security capabilities delivered through a distributed service architecture and can support Zero Trust implementations, but SASE itself is not the fundamental principle described. A next-generation firewall provides application-aware traffic inspection and policy enforcement but does not by itself establish continuous identity-centric verification. Privileged access management specifically controls elevated or administrative accounts; it is an important component of access security but addresses a narrower scope than Zero Trust.

The CS0-004 objectives explicitly identify Zero Trust Network Architecture , SASE, hybrid cloud, IAM, PAM, authentication, and authorization as Security Operations architecture concepts.

Study Guide Reference: Security Operations → Network Architecture → Zero Trust Network Architecture → IAM → Authentication and Authorization → Least Privilege.

Reimaging the disk is a recovery activity because it restores the compromised endpoint to a trusted operational state after malicious activity has been identified and contained. Reimaging replaces the affected operating environment with a known-good system image, removing uncertainty about hidden persistence mechanisms, modified system files, unauthorized software, or other residual effects of compromise.

Verification that malicious activity occurred belongs to the detection and analysis stage. Taking the system offline is a containment measure intended to prevent additional propagation, command-and-control communication, or damage. Writing the final report occurs during post-incident documentation and lessons-learned activities rather than operational restoration.

NIST's Recover function focuses on restoring affected assets and operations and verifying that restored systems are suitable for return to normal business use. A clean reimage is particularly appropriate where the integrity of the compromised operating system cannot be reliably established through selective malware removal.

After rebuilding, analysts should verify configuration, patch levels, security controls, credentials, and monitoring before reconnecting the machine to production.

Study Guide Reference: Incident Response and Management → Recovery → Reimaging → Known-Good Baselines → Restoration Validation → Return to Production.

Attack methodology frameworks help defenders analyze security from an adversary-centric perspective . Rather than focusing exclusively on individual vulnerabilities, these frameworks organize how attackers pursue objectives, which behaviors they use, and how their activity progresses or relates across an intrusion.

MITRE ATT & CK is a representative example. MITRE describes ATT & CK as a knowledge base based on real-world adversarial behavior and states that tactics represent why an adversary performs an action, while techniques represent how the adversary achieves that objective. By understanding these behaviors, defenders can design detections, controls, threat hunts, and response procedures that address realistic attacker methods rather than isolated theoretical weaknesses.

Option A describes continuous vulnerability remediation or rapid operational deployment. Option B describes risk-based vulnerability prioritization using probability and consequence. Option D describes Zero Trust architecture, which assumes that access should not be trusted solely because of network location or prior authentication.

The central purpose of an attack methodology framework is therefore to model and understand adversary behavior so defensive controls can be aligned against realistic attack techniques and objectives .

Study Guide Reference: Security Operations → Attack Methodology Frameworks → MITRE ATT & CK → Adversary Behavior → Tactics → Techniques → Procedures → Defensive Mapping.

Application programming interfaces (APIs) provide the most direct mechanism for retrieving, exchanging, and integrating information between separate security technologies. A product console normally exposes only the information and workflows chosen by the vendor for its graphical interface. An API can provide programmatic access to underlying alerts, events, asset information, telemetry, configuration objects, or investigation data, allowing an analyst to combine information from multiple systems into a richer analytical view.

CISA describes security-analysis workflows in which integration enables defenders to connect existing analytical tools and automate data-handling processes, while modern security platforms commonly expose APIs specifically to ingest or exchange telemetry.

SOAR can certainly integrate multiple tools, but its primary purpose is orchestration and automation of security workflows. If the requirement is specifically to access and combine information not readily exposed in individual consoles , APIs are the underlying capability most directly suited to retrieving that data. Infrastructure as code defines and provisions infrastructure through machine-readable templates; it does not primarily aggregate security telemetry. Playbooks establish standardized investigation or response procedures but do not themselves provide interfaces into external product data.

The key phrase is “enhanced view into data.” This requires programmatic access and integration rather than merely workflow documentation or automation.

Study Guide Reference: Security Operations → Security Tool Integration → APIs → Data Enrichment → Automation/Orchestration → SOC Process Improvement.

The scan results identify two systems exposing services that permit communications without transport encryption, making B the correct count. The analyst must examine each discovered service rather than merely count open ports, because the security property being evaluated is whether the identified protocol transmits its session or application data without adequate encryption.

Common examples include HTTP instead of HTTPS, Telnet instead of SSH, and legacy FTP rather than protected file-transfer alternatives. The presence of an unencrypted service does not automatically prove that sensitive information is currently being transmitted, but it identifies a configuration that can expose credentials, commands, session content, or application data to interception when used.

The correct vulnerability-management workflow is to map discovered ports to services, determine the security characteristics of those protocols, verify whether encryption is available and enforced, and then prioritize remediation according to asset exposure and business requirements. Where possible, administrators should disable unnecessary cleartext services or replace them with cryptographically protected equivalents.

This question therefore tests interpretation of vulnerability or port-scan output , not simple arithmetic. The two affected systems are those whose discovered services permit cleartext communications.

Study Guide Reference: Vulnerability Management → Scan Result Interpretation → Ports and Protocols → Cleartext Services → Encryption in Transit → Remediation and Secure Configuration.

MITRE ATT & CK Navigator is primarily a visualization and analytical tool for understanding adversary behavior and evaluating defensive coverage against ATT & CK tactics and techniques. Analysts can create layers over ATT & CK matrices, highlight techniques associated with specific threat groups, compare adversary profiles, record detection coverage, and identify techniques for which defensive visibility or controls are insufficient.

MITRE explicitly states that ATT & CK Navigator can be used to visualize defensive coverage, support red-team and blue-team planning, and represent the frequency of detected techniques. MITRE's ATT & CK design guidance also recognizes defensive gap assessment as a means of identifying areas where an enterprise lacks sufficient defenses or visibility.

Navigator itself does not replicate adversary behavior; adversary-emulation platforms and red-team tools perform that function. It is not a malware reverse-engineering platform, nor does it independently build defensive tools or execute incident-response actions.

Its major operational value is translating ATT & CK's behavioral knowledge base into a visual map that lets defenders answer two questions: What behaviors are relevant to the threats we face, and where do our detections or controls have gaps?

Study Guide Reference: Security Operations → MITRE ATT & CK → ATT & CK Navigator → Tactics and Techniques → Threat Mapping → Detection Coverage → Gap Analysis.

Triage occurs during the analysis phase because responders must determine what an alert represents, how serious it is, which assets are affected, and what response priority should be assigned before taking broader containment or recovery actions.

Triage typically involves validating the alert, gathering supporting telemetry, establishing whether the event is a true positive, determining scope and impact, identifying affected identities or systems, correlating indicators, and assigning severity. The outcome provides the evidence required to decide whether an event should be escalated into formal incident handling and what subsequent actions are justified. NIST incident-handling guidance has historically emphasized analyzing incident-related information in order to determine the appropriate response, while the current NIST framework continues to emphasize efficient incident detection, response, and recovery.

Isolation belongs to containment because it restricts the compromised asset's ability to communicate or spread malicious activity. Reimaging normally occurs during recovery after the environment has been contained and malicious persistence addressed. Alert writing is part of detection engineering or security-monitoring operations rather than a defining incident-analysis activity.

The sequence is therefore important: detect → analyze/triage → contain → eradicate → recover → conduct post-incident activities .

Study Guide Reference: Incident Response and Management → Incident Response Process → Detection → Analysis/Triage → Containment → Eradication → Recovery.

Eradication addresses the root causes and malicious mechanisms that allow an attacker to remain inside the environment. Typical eradication actions include deleting malware, removing persistence mechanisms, disabling unauthorized accounts, resetting compromised credentials, eliminating malicious scheduled tasks or services, correcting exploited vulnerabilities, and rebuilding systems when trust cannot be restored.

This differs fundamentally from containment. Containment is intended to limit immediate damage or prevent further spread , such as isolating an infected workstation, blocking an IP address, disabling a network segment, or temporarily suspending an account. These measures can interrupt attacker activity, but they do not necessarily remove the underlying foothold. Microsoft security architecture guidance similarly distinguishes containment from eradication and describes eradication procedures as completely removing the threat from the environment.

Detection identifies that suspicious or malicious activity exists; it does not remove access. Denial of service is an attack or availability condition rather than a recognized incident-response phase.

Therefore, if the examination asks which phase permanently removes the adversary's access , the correct answer is eradication because this is where attacker persistence and the enabling compromise are eliminated before normal operations are fully restored.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Persistence Removal → Credential Reset → Malware Removal → Vulnerability Remediation.

Secure access service edge is specifically designed for environments in which users, devices, applications, and workloads are distributed beyond a traditional enterprise network perimeter. SASE integrates networking and security functions into a service-oriented architecture so policy enforcement can follow the user or workload rather than depend solely on traffic traversing a centralized corporate boundary.

This makes SASE particularly suitable for a perimeter-less topology , where employees may work remotely, applications may reside in multiple cloud providers, and services may be accessed directly over the internet. Typical SASE implementations combine software-defined wide-area networking with cloud-delivered security controls such as secure web gateways, cloud access security brokerage, firewall-as-a-service, and Zero Trust-oriented access controls.

A hybrid cloud network connects private and public cloud resources but can still operate using conventional network boundaries. Cloud-native computing describes an application and infrastructure design approach based on cloud technologies such as containers, microservices, and automation; it does not inherently define perimeter-less access security. A content delivery network distributes content geographically for performance and availability and is not an enterprise access-security architecture.

The CS0-004 Security Operations objectives explicitly identify SASE, Zero Trust Network Architecture, and hybrid cloud as network architecture concepts analysts must understand.

Study Guide Reference: Security Operations → Network Architecture Concepts → SASE → Zero Trust Network Architecture → Distributed/Cloud Security.

The analyst completed substantial analysis by validating the URL, confirming its credential-harvesting purpose, and establishing that the user accessed the malicious site. However, the investigation was closed without performing adequate containment . Even though there is no evidence that stolen credentials were subsequently used, the user's authentication material must be considered potentially exposed because the phishing site was specifically designed to collect credentials.

Containment should reduce the immediate opportunity for an attacker to exploit that exposure. Appropriate measures can include resetting the affected password, revoking active authentication sessions or tokens, temporarily restricting the account when warranted, blocking the malicious URL or domain, and checking the endpoint for additional malicious activity. The absence of observed credential misuse does not establish that credential capture did not occur.

Remedial training is valuable, but it is principally a corrective or post-incident measure and does not neutralize the immediate technical risk. Recovery would follow containment and eradication when affected services or systems require restoration.

NIST's current incident-response guidance emphasizes effective detection, response, and recovery actions to reduce incident impact rather than stopping after validation.

Study Guide Reference: Incident Response and Management → Incident Response Process → Analysis → Containment → Eradication → Recovery → Post-Incident Activities.

A phishing simulation click rate measures user susceptibility to phishing and is therefore primarily an indicator of employee security awareness and behavior . If a simulated phishing message is delivered to employees and a percentage of recipients click the embedded malicious-style link, that percentage provides evidence about how effectively users are recognizing and resisting social-engineering attempts.

NIST research specifically identifies phishing-simulation click rates as a commonly used measure for evaluating the effectiveness of phishing-related security-awareness programs. NIST also cautions that raw click rates should be interpreted in context because phishing messages differ substantially in difficulty; the Phish Scale was developed to provide context for click-rate and report-rate results.

The metric does not primarily measure email-filter effectiveness because a controlled simulation may intentionally bypass or be allowlisted through technical filtering so employee behavior can be evaluated. It is unrelated to data-loss prevention false positives. It also does not directly measure response speed; metrics such as reporting time or mean time to respond would be more appropriate for that purpose.

Therefore, click rate is fundamentally a human-risk and awareness metric .

Study Guide Reference: Reporting and Communication → Security Metrics → Security Awareness → Phishing Simulations → Click Rate → Reporting Rate → Human Risk Measurement.

The CIO is implementing risk avoidance because the organization is eliminating the activity or technology that creates the risk. The legacy system no longer receives security updates, so continued operation would maintain exposure to vulnerabilities that may eventually become impossible to remediate. By phasing out and ultimately decommissioning the system, the organization removes that source of risk instead of continuing to operate it under additional controls.

NIST recognizes acceptance, avoidance, mitigation, sharing, and transfer as established risk-response approaches. Avoidance differs from mitigation because mitigation would retain the legacy system while implementing controls that reduce its likelihood or impact—for example, segmentation, strict access controls, application allowlisting, or enhanced monitoring.

Risk acceptance would involve deliberately continuing to operate the system after management acknowledges and approves the remaining exposure. Risk transference would shift some financial or operational consequences to another party, such as through insurance or contractual arrangements.

The phrase “phase out” is the decisive indicator. The organization intends to stop using the risk-producing technology entirely, making avoidance the most precise classification.

Study Guide Reference: Vulnerability Management → Risk Management → Risk Responses → Avoidance → Mitigation → Acceptance → Transference → Legacy and End-of-Life Systems.

The original scan fails because Nmap's host-discovery process concludes that the target appears offline before conducting the intended full port scan. Option C adds -Pn , instructing Nmap to skip normal host discovery and proceed with scanning the target as though it is online. The -p- option then instructs Nmap to test the complete TCP port range rather than only its default set.

This is appropriate when a live host does not respond to discovery probes because ICMP echo traffic or other discovery packets may be filtered by firewalls, host-based controls, or network policy. A system can therefore appear “down” to Nmap's discovery phase while still exposing reachable TCP services.

Option B uses -sn, which performs host discovery without a port scan and therefore contradicts the requirement. Option A scans only a limited set of explicitly identified ports and includes unrelated functionality. Option D unnecessarily changes the scope to an entire /24, performs operating-system detection and DNS resolution, and invokes an SSL cipher script; none of those modifications addresses the immediate host-discovery problem.

Study Guide Reference: Vulnerability Management → Nmap → Host Discovery → -Pn → Full Port Scanning -p- → Firewall/ICMP Filtering → Scan Troubleshooting.

Compensating controls are appropriate when the preferred remediation cannot currently be implemented but the organization must still reduce exposure. A mission-critical system with an unpatched vulnerability for which no vendor patch exists is a classic example. The system cannot simply be removed from service because the business requires it, and conventional patching is unavailable.

The organization may therefore deploy alternative controls such as network segmentation, restrictive firewall rules, application allowlisting, disabling unnecessary services, enhanced monitoring, IPS signatures, access restrictions, or isolation of affected functionality. These measures do not eliminate the underlying defect; instead, they reduce the probability or impact of exploitation while a permanent solution is developed.

NIST's control framework is designed to allow security controls to be selected and tailored according to organizational mission requirements and risk, supporting the broader principle that organizations may apply appropriate alternative safeguards when operational constraints exist.

Option B requires no compensating control because remediation has already occurred. Option C describes a vulnerability that is not applicable to the organization's systems. Option D represents a false positive and therefore does not constitute an actual exposure requiring mitigation.

Study Guide Reference: Vulnerability Management → Mitigation → Compensating Controls → Patch Availability → Mission-Critical Systems → Segmentation and Monitoring.

The attacker is attempting lateral movement because an already compromised identity is being used to move from one cloud environment or subscription into another. Lateral movement describes adversary activity intended to reach additional systems, services, accounts, or resources after an initial foothold has been established.

MITRE ATT & CK specifically includes cloud-oriented lateral movement. Its Lateral Movement tactic documents adversaries using valid accounts to access additional cloud services and resources within compromised environments. MITRE also documents cloud-role manipulation that may enable movement into additional accounts, demonstrating how identity and role relationships can become lateral-movement pathways in cloud architectures.

Privilege escalation would apply if the attacker were primarily attempting to obtain greater permissions within the current security context. Persistence concerns maintaining long-term access. Execution concerns running malicious code or commands. Credential access involves obtaining credentials or authentication material.

In this scenario, the attacker already possesses a compromised user role. The objective is to use that existing access to traverse a trust boundary and reach another isolated subscription. That movement between security domains is the decisive indicator of the Lateral Movement tactic.

Study Guide Reference: Security Operations → MITRE ATT & CK → Lateral Movement → Cloud Services → Valid Accounts → IAM Roles → Cross-Subscription Access.

Rebuilding the environment from infrastructure-as-code definitions is a recovery activity because the organization is restoring trusted operational capability after the ransomware incident has been controlled. IaC provides a particularly effective recovery mechanism because infrastructure can be reconstructed according to predefined, version-controlled configurations instead of attempting to repair every potentially compromised component manually.

During detection and analysis, responders establish that malicious activity occurred and determine its scope. Containment limits additional damage or spread. Eradication removes malicious artifacts, persistence, compromised credentials, and the underlying causes of the incident. Recovery then restores affected systems and services to normal operation while ensuring they are returned in a trustworthy state.

NIST defines recovery as the restoration of assets and operations affected by cybersecurity incidents and emphasizes verifying restored assets before normal operations resume. Tearing down potentially compromised infrastructure and deploying fresh resources from controlled IaC templates directly fulfills that purpose.

Post-incident activities occur after operational restoration and focus on lessons learned, reporting, process improvement, and corrective recommendations.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Recovery → Infrastructure as Code → Rebuilding from Known-Good Configurations → Validation.

A comprehensive asset inventory is required because the discrepancy demonstrates that the organization lacks a reliable common understanding of which systems actually exist and should be covered by vulnerability and patch-management processes. Effective vulnerability management begins with asset discovery and inventory. Without accurate asset records, teams cannot determine whether missing systems represent decommissioned devices, unmanaged assets, duplicate IP addresses, dynamic addressing, scanning gaps, or endpoints that are not enrolled in the patch platform.

Reconciliation with the infrastructure team allows the organization to establish authoritative records for hostnames, IP addresses, operating systems, ownership, business function, physical or cloud location, patching status, and vulnerability-scanner coverage. Once that inventory exists, each security tool can be compared against the same source of truth.

Verbose scanner logging might explain specific scanning failures but cannot resolve discrepancies caused by unknown or unmanaged assets. Rebuilding report filters risks masking the real coverage problem. Rerunning patch deployment does not help when the organization has not established which assets should be receiving patches.

The governing principle is simple: an organization cannot reliably assess or patch assets it has not accurately inventoried .

Study Guide Reference: Vulnerability Management → Asset Discovery → Asset Inventory → Vulnerability Scanner Coverage → Patch Management → CMDB/Reconciliation → Shadow and Unmanaged Assets.

A tabletop exercise is the most appropriate method because the objective is to collaboratively validate an updated incident-response plan with relevant stakeholders. Tabletop exercises are discussion-driven simulations in which participants work through a realistic incident scenario, explain their expected actions, identify dependencies, evaluate communication paths, and expose procedural or organizational gaps without performing disruptive live attacks.

CISA states that tabletop exercises are used to validate or improve understanding of plans and procedures, rehearse concepts, assess incident-response and recovery requirements, and identify areas requiring improvement. CISA also provides Tabletop Exercise Packages specifically to help stakeholders conduct collaborative exercises and organizational discussions.

A red-team event involves active adversary simulation and focuses primarily on testing defensive capabilities against realistic attacker behavior. A penetration test evaluates exploitable technical weaknesses. Security awareness training teaches users security knowledge but does not collaboratively validate incident-response roles, escalation paths, communications, and decision-making.

Because the manager recently made significant plan updates , a tabletop exercise provides a controlled mechanism for all stakeholders to determine whether those procedures actually function as intended before a real incident occurs.

Study Guide Reference: Incident Response and Management → Preparation → Incident Response Plan → Tabletop Exercises → Stakeholder Coordination → Testing Plans and Procedures.

The analyst should prioritize 10.203.10.11 because the scan output identifies that host as presenting the Windows SMB exposure relevant to the critical vulnerability. Vulnerability prioritization requires matching the vulnerability's technical prerequisites against the characteristics discovered on each host rather than simply patching every responding system indiscriminately.

Modern SMB services commonly use TCP port 445 . Microsoft documents TCP 445 as a required port for SMB-based file services, with port 139 associated with older NetBIOS-based implementations. Therefore, a Windows host exposing the affected SMB service satisfies an essential condition for applicability and should be prioritized when the vulnerability specifically targets open SMB ports.

The -Pn option is also significant operationally because it instructs Nmap to treat targets as online without relying on normal host-discovery probes. The analyst can consequently inspect reachable service ports even when systems do not respond to standard discovery methods.

The remaining hosts either do not expose the vulnerable SMB service or do not match the required Windows/service profile described by the scenario. Priority should follow confirmed applicability, exposure, severity, and exploitability.

Study Guide Reference: Vulnerability Management → Nmap → Port Scanning → SMB → TCP 445/139 → Vulnerability Applicability → Remediation Prioritization.

A Privileged Access Management (PAM) solution provides the strongest control for credentials with root, domain administrator, and local administrative authority. Vulnerability scanners frequently require elevated permissions for credentialed assessments, but permanently exposing those credentials to scanning infrastructure creates substantial risk. If compromised, the scanner could provide an attacker with privileged access across a large portion of the environment.

PAM systems can protect privileged credentials through centralized vaulting, controlled checkout, tokenized or brokered authentication, rotation, session restrictions, auditing, and time-limited privilege. This aligns with the principle of least privilege, under which entities should receive only the access necessary to perform assigned functions. NIST defines least privilege in precisely this manner and applies the principle to privileged accounts.

Single sign-on improves authentication convenience but does not adequately secure highly privileged scanning credentials. A simple one-time password adds authentication assurance but lacks the credential governance and lifecycle controls provided by PAM. Agentless scanning changes scanner architecture but does not solve the underlying privileged-access requirement.

The strongest design is therefore to place high-impact administrative credentials under dedicated privileged-access controls rather than treating them as ordinary service credentials.

Study Guide Reference: Vulnerability Management → Credentialed Scanning → Scanner Permissions → PAM → Least Privilege → Credential Vaulting and Rotation.

Software Composition Analysis (SCA) is specifically designed to identify third-party and open-source components incorporated into software. It can enumerate libraries and dependencies, identify their versions, associate components with known vulnerabilities, and provide licensing information. This directly satisfies the legal team's requirement to determine whether the codebase contains open-source or commercially licensed libraries.

CISA's software supply-chain guidance recognizes software composition analysis and software bills of materials as mechanisms for obtaining visibility into software components. CISA guidance also notes that SBOM information can include both open-source and commercial third-party software and licensing information.

SAST examines source or compiled code for security weaknesses such as unsafe functions, data-flow problems, or coding vulnerabilities, but dependency licensing is not its primary purpose. DAST tests a running application from the outside and generally cannot inventory the complete component dependency tree. RASP operates within a running application to detect or prevent attacks. Credentialed infrastructure scanning identifies system-level vulnerabilities and configuration issues rather than software-license composition.

The strongest clue is the requirement to identify libraries and their licensing status , which directly maps to SCA.

Study Guide Reference: Vulnerability Management → Application Security Testing → SCA → Third-Party Components → Open-Source Dependencies → SBOM → Licensing and Vulnerability Analysis.

The server output indicates an initiated unauthorized session , which is the most significant security condition among the available answers. During compromise analysis, login/session data must be evaluated for unexpected users, remote origins, terminals, login times, active processes, and activity inconsistent with the server's expected operational baseline.

Linux session utilities provide precisely this type of evidence. The who utility reports users who are currently logged into a system, while w provides additional information such as the login name, terminal, remote host, login time, idle time, and currently associated process. An unexpected active session on a web application server—particularly one inconsistent with normal administrative activity—is therefore a material indicator of possible unauthorized access.

“Too many users” would require evidence that session volume itself exceeded an established threshold. High resource consumption would instead require CPU, memory, load-average, or process-utilization evidence. Abnormal idle times might warrant investigation but do not independently establish compromise.

The analyst should treat the unauthorized session as an investigative pivot and correlate it with authentication logs, source addresses, process execution, privilege changes, and network connections.

Study Guide Reference: Incident Response and Management → Analysis → Host-Based Evidence → User Sessions → Authentication Activity → Unauthorized Access → Event Correlation.