Análisis completo de CySA+ CS0-004: lo que muestra el informe de US$39

Una pregunta real del análisis completo

Así aparece en el informe cada pregunta que fallas. La pregunta, la respuesta correcta, la explicación y la fuente son reales. La respuesta que se muestra como tuya es un ejemplo, no son datos de nadie.

A threat intelligence analyst at an MSP is documenting an intrusion with the Diamond Model. The team knows the malware family (a modified Cobalt Strike beacon) and the victim (a regional accounting client). They have not identified who is behind it or where the command servers are. Which Diamond Model vertices remain to be filled in, and which pivot is available first?

• A Adversary and Infrastructure are unfilled; pivot from the Capability vertex (the beacon configuration) to discover Infrastructure such as the C2 domains and IPs
• B Capability and Victim are unfilled; pivot from the Adversary vertex to identify the malware
• C Only Adversary is unfilled, because the Diamond Model treats infrastructure as part of Capability
• D Infrastructure and Victim are unfilled; pivot from the Adversary vertex using the malware's compile timestamp

Respuesta de ejemplo, marcada como segura: B · Respuesta correcta: A

The Diamond Model has four core vertices: Adversary, Capability, Infrastructure, and Victim, joined by edges that support analytic pivoting. The team has Capability (the beacon) and Victim (the client), so Adversary and Infrastructure are the open vertices. Extracting the beacon's embedded configuration yields C2 hostnames and addresses, which is a Capability-to-Infrastructure pivot, and infrastructure can later pivot toward Adversary through registration or reuse patterns. Options that list Capability or Victim as unfilled contradict what is already known. The model keeps Infrastructure as its own vertex rather than folding it into Capability, and a compile timestamp is a Capability attribute, not an Adversary one.

La preparación por dominio usa los pesos del examen real: Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%.