CompTIA CySA+ CS0-004 (CS0-004) — Questions 1–75

A non-technical manager needs business context, not raw technical detail. Summarising critical vulnerabilities alongside their business risk and recommended remediation actions translates scanner output into decision-ready information, satisfying the stem's requirement to communicate findings effectively to a non-technical audience.

Attackers frequently use DNS tunneling to bypass firewalls by encapsulating non-DNS protocols and encrypted payloads inside DNS packets. Because TCP port 53 allows for larger, reliable data streams compared to UDP, persistent encrypted traffic on this port is a classic indicator of an active data exfiltration channel.

Port 54321 falls into the dynamic/private port range, typically used for ephemeral client-side connections. However, if observed as a listening port or as the destination port for an established connection to an external IP, it becomes highly anomalous. Attackers frequently utilize high, non-standard ports for command and control (C2) communication or data exfiltration to bypass basic firewall rules and blend with legitimate outbound traffic, making it a strong indicator of compromise.

Formalizing the security policy violation in a structured report ensures that the finding is properly documented for compliance and audit trails. Including specific policy references and actionable remediation steps provides the system owner with the necessary context to resolve the issue while establishing accountability and a clear path for follow-up verification.

This is the standard order of volatility used in digital forensics, ranking evidence by how quickly it is lost. CPU registers are the most volatile, holding the CPU's current working values and disappearing in nanoseconds; RAM follows, losing all data when power is removed; swap is a disk-backed file that may persist but is overwritten and purged; then disk, logs (which are written regularly but more durable), and finally archived media, which is deliberately preserved and least volatile. Following this order ensures the most fragile evidence is collected first.

This is a strong immediate mitigation strategy. A Web Application Firewall (WAF) inspects HTTP/S traffic and can block common attack patterns, including those leading to Remote Code Execution (RCE), without requiring application changes. Security groups act as a virtual firewall, limiting network access to only necessary IP addresses, significantly reducing the attack surface and potential for exploitation while a permanent fix is developed. This provides immediate protection for PCI data.

Correlating authentication logs with firewall logs allows analysts to map failed login attempts to specific external IP addresses and network traffic patterns. This combination is essential for identifying distributed brute-force attacks, as it links application-level credential failures with network-level connection attempts.

Implementing a virtual patch through WAF rules provides an immediate and non-intrusive layer of protection by inspecting and filtering malicious traffic targeting the Apache Struts vulnerability. This method blocks known exploit patterns at the network edge, preventing successful attacks from reaching the vulnerable application without requiring changes to the server or application code. It effectively buys critical time for security teams to thoroughly test and deploy the official vendor patch in a controlled manner, minimizing service disruption.

AV:N (Attack Vector: Network) means the vulnerable component is bound to the network stack and the attacker's path to exploit lies through a routable network connection, potentially even across the internet, rather than requiring physical or local access. This is the highest-severity attack vector value because it maximizes the pool of potential attackers, contributing to this vulnerability's near-maximum CVSS base score of 9.8 alongside low complexity and no required privileges or user interaction.

Implementing network segmentation isolates the vulnerable legacy application within a restricted network zone, such as a dedicated VLAN or DMZ. This control significantly reduces the attack surface by ensuring only authorized users and systems can communicate with the application, effectively mitigating the risk of lateral movement and unauthorized exploitation when no patch is available.

Updating email filtering rules and detection signatures is a direct, preventive improvement that uses indicators from the phishing campaign (such as sender domain, subject line patterns, and payload hashes) to enhance the email security gateway. This action hardens the environment against similar attacks by proactively blocking malicious emails before they reach users. It is a classic post-incident activity because it closes the specific vulnerability that allowed the phishing email to be delivered, reducing the likelihood of recurrence.

A control effectiveness report supplies measured test results and metrics, giving auditors objective proof that the control operates as intended rather than merely existing. This directly satisfies the stem's requirement to demonstrate effectiveness, since design documentation or policy statements alone cannot evidence actual performance.

Physically disconnecting the network interface card or disabling the switch port provides immediate physical-layer isolation. This action instantly halts lateral movement and command-and-control traffic without altering the volatile memory of the compromised host, preserving crucial forensic evidence.

Validating patches within a dedicated staging environment that closely replicates the production architecture is a fundamental security best practice. This process allows administrators to identify compatibility issues, assess performance impacts, and ensure system stability before deploying the updates to live, mission-critical systems.

Running containers in privileged mode grants them every Linux capability, disables seccomp and AppArmor/SELinux confinement, and exposes all host devices, effectively removing isolation between the container and the host kernel. An attacker who exploits a vulnerability in a privileged container can trivially escalate to full host control, making it one of the most dangerous container misconfigurations. During a vulnerability assessment, this should immediately be flagged as a critical finding.

AWS GuardDuty is a continuous security monitoring and threat detection service that analyzes VPC Flow Logs, AWS CloudTrail management event logs, CloudTrail S3 data events, and DNS logs. It utilizes threat intelligence feeds, machine learning, and anomaly detection to identify malicious activities, such as compromised EC2 instances, credential exfiltration, or unauthorized access within the AWS environment.

Under Article 33 of the GDPR, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the notification is delayed beyond this window, the controller must provide a reasoned justification for the delay.

The vector's Availability metric is A:H, meaning High, the only impact metric set above None in this string, indicating the vulnerability can fully deny access to the affected resource, for example through a crash or resource exhaustion condition, making Availability the clear primary impact and consistent with a 7.5 base score driven almost entirely by this single high-impact metric.

Injection vulnerabilities occur when untrusted user input is interpreted as part of a command or query, leading to unauthorized execution. In OWASP frameworks, Cross-Site Scripting (XSS) is classified as a form of injection because malicious scripts are injected into trusted web applications to execute in the victim's browser.

A risk register is the central governance artifact that catalogs identified risks alongside their likelihood, potential impact, assigned owner, and planned or in-progress mitigation actions, giving leadership a consistent, prioritized view for reporting and decision-making across the organization's entire risk landscape rather than any single risk source.

LiME (Linux Memory Extractor) is a loadable kernel module purpose-built for forensically sound live acquisition on Linux, capturing physical memory directly into a file or over the network with atomic, kernel-level access that avoids the instability and incompleteness risks of userland tools like dd, making it the appropriate low-impact choice here.

Revoking the compromised vendor account's access is the most immediate and effective containment action. This step instantly terminates active sessions and prevents the attacker from leveraging the established credentials to move laterally or exfiltrate sensitive data, aligning with the containment phase of the incident response lifecycle.

Patch SLA compliance percentage directly measures the proportion of patches applied within the stipulated timeframes, such as critical patches within 48 hours or high-severity within 30 days. It quantifies adherence to the patching policy and reflects the organization's ability to remediate known vulnerabilities on schedule. This is the most relevant benchmark because it captures timeliness, completeness, and scheduling discipline, which are the core factors of patch management effectiveness.

When patching is impossible, formal risk management dictates documenting the risk with executive sign-off while implementing compensating controls, such as network segmentation or strict access control lists. Additionally, establishing a clear migration or decommissioning timeline ensures the organization has a defined exit path to eliminate the legacy liability.

Clock drift and timezone parsing commonly distort event order in SIEM timelines.

The primary objective of a lessons learned meeting is to review the incident response and identify what went well and what needs improvement. It aims to enhance future detection, response, and recovery. This meeting often results in actionable recommendations for updating plans, training, and tools. It is a key step in the continuous improvement of the incident response capability. The focus is on process enhancement, not punishment.

During the Detection and Analysis phase of NIST SP 800-61 Rev 2, analysts must validate precursors and indicators to confirm if an actual incident has occurred. Correlating the initial alert with complementary data sources, such as firewall logs, DNS queries, and host-based intrusion detection systems, helps establish the scope, reduce false positives, and build a timeline before taking disruptive actions.

Correlating DNS query logs with endpoint process and network connection telemetry is the most effective approach to validate and understand suspicious DGA activity. This comprehensive analysis allows security analysts to pinpoint the specific process generating the unusual DNS queries, observe subsequent network connection attempts (or failures), and confirm if the host is indeed attempting outbound command-and-control communication, thereby enabling precise and targeted remediation efforts.

AWS GuardDuty actively leverages continuously updated threat intelligence feeds, including lists of known malicious IP addresses, domains, and attack signatures, to identify suspicious activity. When an EC2 instance communicates with an IP address or domain identified as a known command and control (C2) server by these feeds, GuardDuty generates a finding, indicating a high probability of compromise and C2 communication.

Watching the sample actually open a socket and beacon out to a known-bad IP during sandbox detonation is a runtime action captured by network monitoring tools like Wireshark or Cuckoo, exemplifying a behavioral IOC because it reflects what the malware does, not just what it is.

A high click rate during a phishing exercise serves as a key performance indicator (KPI) that employees are highly susceptible to social engineering attacks. To mitigate this risk, the organization must implement targeted, frequent security awareness training and follow-up simulations to educate users on identifying phishing indicators, thereby strengthening the human element of defense-in-depth.

Creating a bit-stream forensic image of the hard drive ensures that a mathematically precise copy of the non-volatile storage is preserved for analysis. This process utilizes write-blockers to prevent any modification to the original media, maintaining chain of custody and evidence integrity. It allows investigators to safely analyze deleted files, slack space, and system artifacts without altering the source system.

Nessus is a commercial vulnerability scanner developed by Tenable that actively scans hosts and network services, comparing software versions and configurations against a comprehensive plugin database of known Common Vulnerabilities and Exposures (CVEs). It supports credentialed scans, agent-based scanning, and integration with patch management and SIEM platforms, making it a primary tool for continuous vulnerability management. This directly matches the goal of identifying exploitable weaknesses across an enterprise.

The detection and analysis phase focuses on validating alerts to minimize false positives and accurately scope the potential incident. Gathering supplementary log sources, correlating event data, and conducting deeper forensic analysis are essential steps to confirm that a true compromise has occurred before initiating disruptive containment actions.

Aggregating alerts by source IP and time window groups multiple failed login attempts into a single, consolidated alert, effectively suppressing repetitive notifications while still preserving detection of brute-force or credential-stuffing activity. This correlation technique condenses dozens or hundreds of individual events into one actionable incident, reducing analyst alert fatigue and allowing the security team to focus on the actual attack pattern rather than being overwhelmed by event-level noise.

This is correct: the vector specifies S:C (Scope Changed) and C:H (high confidentiality impact), while integrity and availability are None (I:N/A:N). A Changed scope means the vulnerability affects resources outside the vulnerable component's security authority, and the only rated impact is disclosure of sensitive information. These values exactly match the analyst's finding.

Querying external threat intelligence feeds for an IP's reputation score and first-seen registration date provides critical external context. This data helps the SOAR playbook assess the likelihood of malicious activity, such as identifying newly registered domains or known command-and-control nodes, enabling automated, risk-based triaging.

Mean time to respond (MTTR) is the definitive metric for evaluating the speed of incident containment and mitigation. It measures the average time elapsed from the moment an alert is detected to when the threat is successfully isolated or neutralized, directly reflecting SOC operational efficiency during active incidents.

Deploying additional network monitoring sensors at segmentation boundaries and critical ingress/egress points eliminates the blind spots that allowed this incident to go undetected. These sensors capture full packet data, NetFlow metadata, or IDS/IPS alerts, enabling analysts to detect lateral movement and command-and-control activity that passive host-based tools might miss. This is a direct corrective action to improve visibility and reduce time-to-detection for future attacks.

The legal and compliance department is the correct first point of contact because it ensures the organization satisfies statutory and regulatory breach notification obligations (e.g., GDPR, HIPAA, SEC rules) before any public or external disclosure. They also provide legal counsel on preservation of evidence and attorney-client privilege, which directly influences containment and eradication actions. Engaging this internal team early prevents costly penalties and legal exposure from mishandled incident response.

Overly permissive RBAC bindings grant cluster-wide or wildcard permissions, letting a compromised workload escalate privileges or reach other namespaces. Auditing roles, ClusterRoleBindings and service accounts for excessive verbs and resources is a priority Kubernetes hardening check.

Logging in with valid credentials lets the scanner query installed package versions, registry keys, running services, and local patch levels directly from the OS, producing far fewer false positives and negatives than inferring vulnerabilities purely from external banners and network responses.

Encoded PowerShell launched by Office is a high-signal chain; decoding and process-tree review confirms intent and scope.

Accurate time synchronization, typically via NTP, across all log-generating systems and SIEM components is critical to prevent clock drift, which can cause events to appear out of sequence. Furthermore, correctly parsing and converting timestamps from various sources, which might use different local timezones or formats, ensures that all events are consistently represented against a common temporal baseline. This verification step is essential for building a reliable chronological incident timeline.

Implementing a suppression rule allows the SIEM to filter out or silence specific, known-benign event IDs under defined conditions. This directly reduces alert fatigue and noise in the console, allowing analysts to focus on legitimate security threats without losing the underlying log data.

Establishing a baseline of query length, Shannon entropy, and subdomain uniqueness allows analysts to detect the high-entropy, long, and highly unique subdomains typical of DNS tunneling payloads. Because DNS tunnels encode data such as SSH or VPN traffic within TXT, CNAME, or AAAA queries, these requests deviate significantly from a host's normal, structured DNS patterns. Monitoring these specific label characteristics helps identify exfiltration or command-and-control channels without generating excessive false positives.

Command and control (C2) beaconing involves an infected host periodically initiating outbound connections to a C2 server, often on a non-standard port like 4444, to check for new commands or upload data. These connections are typically regular, repetitive, and consistent in their destination and port, fitting the description of repeated connections to a single IP on port 4444. This behavior establishes a persistent communication channel for remote control of the compromised system.

DNS log analysis is the most effective method for identifying Domain Generation Algorithm (DGA) activity by examining the structural properties of queried domains. Analysts can calculate the Shannon entropy of domain strings to detect anomalous randomness and monitor query frequency for rapid bursts of failed resolutions (NXDOMAIN responses). This mathematical and behavioral analysis directly exposes the automated, algorithmic nature of DGA-based command-and-control (C2) communication.

Phishing simulation click rates are a leading indicator of user resilience to social engineering attacks, directly measuring the effectiveness of security awareness training. A high click rate signals elevated human risk, while declining clicks over successive campaigns demonstrate improved workforce behavior. This metric is strategic because it quantifies a primary attack vector—email—and supports data-driven adjustments to training content and cadence.

Asset criticality is the correct primary driver for prioritization because it directly captures the potential business impact if confidentiality, integrity, or availability is compromised. A vulnerability on a server that processes financial transactions or contains protected health information poses far greater risk than the same CVE on an internet-facing demo server with no sensitive data. This aligns with risk-based vulnerability management, where risk equals the likelihood of exploitation multiplied by the consequence to the business.

Testing a patch in a staging environment is the most prudent and recommended practice before deploying it to production systems, especially with automated patch management. This process allows administrators to thoroughly evaluate the patch's compatibility with existing applications and configurations, identify potential regressions, and confirm its effectiveness in a controlled, non-production setting. This crucial step minimizes the risk of introducing new vulnerabilities, system instability, or service outages that could arise from an untested patch in a live environment.

The timeline is the chronological reconstruction of every observable event leading up to, during, and after the security incident. It consolidates artifacts like log entries, file system changes, network flows, and user actions into a coherent sequence. This component is foundational because it enables analysts to map the attack lifecycle and determine the exact order of compromise, which is essential for effective containment and eradication.

Privileged containers run with all Linux capabilities and disable isolation mechanisms such as seccomp, AppArmor, or SELinux, effectively granting the process root-equivalent access to the host kernel and devices. This means a malicious or compromised workload inside the container can directly attempt to escape the container and compromise the underlying node. Thus, enabling privileged mode is a critical misconfiguration that should be avoided in standard deployments.

A compensating control is an alternative safeguard put in place to mitigate risk when a primary security control, such as applying a vendor patch, is technically or operationally unfeasible. By configuring the Web Application Firewall to block exploits targeting the specific vulnerability, the organization successfully reduces the associated risk to an acceptable level without modifying the underlying application code.

Correct. Level 2 benchmarks apply defense-in-depth hardening intended for high-security environments and often disable features, ports, or services that could affect usability or compatibility, so CIS explicitly recommends testing Level 2 changes before production deployment due to potential functional impact.

Static analysis is the safest initial step for evaluating an unknown file because it allows the analyst to inspect the file's metadata, PE headers, import tables, and embedded strings without executing the code. By avoiding execution, the analyst eliminates the risk of system infection or triggering anti-analysis logic embedded within the malware.

Mean Time to Detect (MTTD) is the key security metric that quantifies the average duration between the initial occurrence of a security incident or compromise and its formal identification by security tools or analysts. Minimizing MTTD is critical for reducing attacker dwell time and limiting the potential blast radius of an intrusion.

Attackers frequently leverage legitimate binaries like svchost.exe as Living off the Land Binaries (LOLBins) to evade detection and bypass application whitelisting. In a standard Windows environment, services.exe is the exclusive parent process of svchost.exe. Observing cmd.exe spawning svchost.exe represents an anomalous parent-child relationship that strongly indicates an adversary attempting to masquerade malicious execution under a trusted system process name.

SLA compliance by severity, asset owner, and business unit directly answers whether critical findings were remediated within policy timelines, and grouping by owner gives technical remediation owners the actionable view they need to address their own overdue items.

The click rate is the primary metric for assessing user susceptibility during a controlled simulation, calculated by dividing the number of users who clicked the link by the total number of emails delivered. This directly measures the effectiveness of security awareness training and identifies high-risk groups requiring targeted remediation.

Snyk scans container images for known vulnerabilities in OS packages and application dependencies, integrating into CI pipelines and registries. It is a widely adopted container image scanning tool, satisfying the selection criterion for this programme.

Isolating the hosts immediately severs the active command-and-control channel, halting data exfiltration or payload retrieval. Since the host-based firewall already permits that outbound traffic, containment must happen at the network layer; disconnecting the workstations is the fastest way to stop ongoing compromise before forensic investigation begins.

This document translates complex technical vulnerabilities into business risk and financial impact, which is essential for executive decision-making. By keeping it to a single page, it ensures that leadership can quickly grasp the organization's current risk posture and allocate resources effectively without getting bogged down in technical minutiae.

A chain of custody log documents every person who handled evidence, when, and why. It is the foundational requirement for evidence integrity and admissibility. Without it, even properly collected evidence can be challenged in court. The log should be started at the beginning of evidence collection and maintained throughout the incident. This is the first step to ensure legal defensibility.

This option correctly synthesizes business context and risk-based vulnerability management. Because the asset is a non-production development server isolated from the internet, the actual risk of exploitation is significantly mitigated. Combining this low exposure with a low EPSS score justifies scheduling the patch during routine maintenance windows rather than disrupting operations with an emergency deployment.

Sign-in logs, MFA results, device details and mailbox audit events directly evidence the impossible-travel alert and the subsequent forwarding rule creation, letting the analyst confirm or refute the UEBA detection across both authentication and post-compromise activity.

In a secure architecture, administrative traffic flows from privileged workstations to domain controllers, never the reverse. An outbound Remote Desktop Protocol (RDP) connection originating from a domain controller to a standard workstation is highly anomalous and strongly indicates an adversary is leveraging compromised domain-level credentials to pivot downstream.

Tracks the number of unresolved vulnerabilities broken down by CVSS severity level (e.g., critical, high, medium, low). This is a core patch-management metric because it directly reflects the current attack-surface exposure and backlog of unpatched systems, which compliance frameworks typically require to be monitored and reduced over time.

CloudTrail is a critical service designed to record API calls made to the cloud provider's services, whether by users, roles, or other services. It provides a comprehensive audit trail of management plane activities, including creating, modifying, or deleting resources and configurations. This makes it ideal for detecting unauthorized changes to security monitoring solutions, such as disabling or altering logging configurations, as these actions are performed via API calls.

VirusTotal is an industry-standard threat intelligence platform that aggregates antivirus engines and website scanners to analyze submitted files, URLs, and cryptographic hashes. During incident detection, analysts query VirusTotal with a file's MD5, SHA-1, or SHA-256 hash to rapidly determine if known malware has been previously identified by the security community.

Broken access control is the correct answer because it directly describes a failure to enforce restrictions on what authenticated users are allowed to do. By manipulating parameters, headers, or API endpoints in Burp Suite, testers can identify flaws like Insecure Direct Object References (IDOR) or privilege escalation, which allow unauthorized data access.

Isolating the affected network segment is the most effective short-term containment action to prevent the lateral movement of ransomware to other critical systems. By restricting network traffic at the switch, router, or firewall level, the analyst halts the spread of the infection while preserving the volatile memory of the affected server for subsequent forensic analysis.

Targeting specific Windows API functions within the Portable Executable (PE) import table, such as WriteProcessMemory and CreateRemoteThread, allows YARA rules to identify the underlying functional capabilities of the malware, such as process injection. Because these APIs are essential for the malware's injection mechanism, they serve as robust, behavior-based indicators that remain consistent across different compiled versions and packaging variations.