CS0-004 Safe Question Preview

Question 1. An analyst identifies a vulnerable web application, but the vendor has not yet released a patch. Which action can temporarily reduce the likelihood of successful exploitation?

Question 2. A SIEM correlation rule generates thousands of alerts from an authorized vulnerability scanner. Which action should an analyst take to reduce the known-benign noise without disabling useful detection?

Question 3. An attacker creates a scheduled task that launches malware whenever a user logs in. Which incident response phase should remove this mechanism?

Question 4. A compromised workstation is actively communicating with a known command-and-control server. Which of the following should an analyst perform first to limit further damage?

Question 5. A security team suspects attackers are using PowerShell in unusual ways, but no existing detection rule has generated an alert. Which activity would best help analysts proactively search for this behavior?