Community Q&A
CS0-004 — frequently asked questions
Community-vetted answers to 8 common questions about this exam, each traced back to a specific practice question.
Questions from real practice questions
Each Q&A comes from a specific question — follow the link for the full analysisWhy Segment Business-Critical Assets from Legacy Systems
Why isn't asset obfuscation the reason for segmentation?
Asset obfuscation involves hiding details about assets to make discovery harder. Segmentation controls network traffic flow and access, effectively isolating segments rather than hiding the assets themselves.
How do legacy systems affect network segmentation strategies?
Legacy systems often lack support for modern security agents or patches. Segmentation isolates these high-risk, unpatchable devices to prevent attackers from using them as a foothold to reach critical assets.
Handling Zero-Day Vulnerabilities Without Patches
Why is sinkholing not the right answer for a zero-day app vulnerability?
Sinkholing specifically targets DNS-based command and control traffic. A zero-day application vulnerability may be exploited through various means (e.g., direct IP access, file uploads) that do not involve C2 domains, making sinkholing insufficient as a general protective measure.
What is the role of IoCs in this scenario?
Indicators of Compromise (IoCs) provide the specific signatures, hashes, or behaviors associated with the attacker's activity. They allow security teams to configure monitoring tools to alert on exploitation attempts, serving as the primary early warning system when the vulnerability itself cannot be fixed.
Analyzing Tshark Filters for HTTP and UDP Traffic
Does tshark decrypt HTTPS traffic automatically?
No. Tshark cannot decrypt HTTPS traffic by default. To view HTTPS contents, you must provide the server's private key or session secrets via the command line.
Why is DNS included if the filter is 'udp'?
Standard DNS queries primarily use UDP port 53. Filtering for 'udp' captures these packets, which constitute DNS traffic.
Perimeter-less Network Topology and SASE Architecture
What is the difference between SASE and Zero Trust?
Zero Trust is a security philosophy or model that assumes no trust by default. SASE is a specific cloud-based architecture that delivers Zero Trust principles by combining networking (SD-WAN) with security services (ZTNA, CASB).
Does hybrid cloud automatically mean perimeter-less?
No. Hybrid cloud refers to the mix of on-premises and cloud infrastructure. While it often requires perimeter-less security, the term itself does not define the security architecture used to achieve it.