Free CS0-004 practice questions

Time synchronization is what makes logs from different systems correlate.

Correlation depends on every source stamping events with the same clock. When devices drift, the same session appears at different times in each log and the analyst cannot tell what happened first. Pointing all devices at a common NTP hierarchy fixes the cause. Verbosity, transport encryption and retention are all real logging settings, but none changes the clock that writes the timestamp.

1. Notice the symptom: one event, several different times.
2. Ask which logging setting controls the timestamp itself.
3. Pick clock synchronization to a common source.
4. Reject options that change detail, transport or retention.

Exam tip: If the same event shows different times in different logs, fix time synchronization first.

Asset inventory is the foundation of vulnerability scanning: it defines scope, criticality and ownership.

Every later planning decision (what to scan, when, how deeply, and who remediates) depends on knowing which assets exist and who owns them. The stale CMDB and unreviewed cloud accounts mean the current scope is unknown. Credentialed scans, scheduling and baseline checks are all valid activities, but each assumes an accurate list of targets.

1. Spot that the stem describes an unknown or stale scope.
2. Recall that scan targets, windows and owners all come from the inventory.
3. Choose the activity that the others depend on.

Exam tip: No inventory, no scope: build the asset inventory before planning scans.

The Cyber Kill Chain has seven ordered phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives.

The weaponized document was transmitted to the targets, which is delivery. Exploitation begins only when the payload triggers on a victim system, and telemetry shows no recipient opened it. Weaponization came earlier and happens on attacker infrastructure, so delivery is the furthest phase reached and the point where the chain was broken.

1. List what actually happened: the file was built, sent and quarantined.
2. Check whether any code ran on a victim host. It did not.
3. Place the last completed action in its phase: transmission to the target is delivery.

Exam tip: A payload that arrives but never runs stops the chain at delivery.

A vulnerability scan report is tailored to its audience: remediators need technical, per-asset detail; leaders need summaries, trends and risk.

The Linux team's job is to apply fixes, so the useful report is the technical one: each affected host, the CVE, the vulnerable package or version and the remediation (patch, upgrade or configuration change). Trends, SLA percentages and top-risk lists are management views built from the same data, but none of them tells an administrator what to change.

1. Identify the audience and what they will do with the report.
2. Remediators act on individual findings, so they need host, vulnerability and fix detail.
3. Leaders act on priorities and resources, so they need summaries, trends and metrics.

Exam tip: Technical teams get per-host findings and fixes; executives get risk, trends and metrics.

NTP keeps clocks right; time-zone handling keeps timestamps unambiguous.

An exact one-hour shift that starts at a daylight-saving change is the signature of local-time stamps without an offset, not of clock drift. NTP already keeps the clocks correct, so a better NTP source or faster polling changes nothing. Logging in UTC (or ISO 8601 with an offset) gives the SIEM an unambiguous instant to normalize.

1. Note that all servers already use the same NTP servers.
2. Link the exact one-hour shift to the daylight-saving change.
3. Infer that the web servers record local time without an offset.
4. Recommend UTC or offset-qualified timestamps at the source.

Exam tip: Synchronized clocks still mislead if logs record local time without an offset; log in UTC.