CompTIA CySA+ CS0-004 (CS0-004) — Questions 1–75

Port 54321 falls into the dynamic/private port range, typically used for ephemeral client-side connections. However, if observed as a listening port or as the destination port for an established connection to an external IP, it becomes highly anomalous. Attackers frequently utilize high, non-standard ports for command and control (C2) communication or data exfiltration to bypass basic firewall rules and blend with legitimate outbound traffic, making it a strong indicator of compromise.

This is the standard order of volatility used in digital forensics, ranking evidence by how quickly it is lost. CPU registers are the most volatile, holding the CPU's current working values and disappearing in nanoseconds; RAM follows, losing all data when power is removed; swap is a disk-backed file that may persist but is overwritten and purged; then disk, logs (which are written regularly but more durable), and finally archived media, which is deliberately preserved and least volatile. Following this order ensures the most fragile evidence is collected first.

This is a strong immediate mitigation strategy. A Web Application Firewall (WAF) inspects HTTP/S traffic and can block common attack patterns, including those leading to Remote Code Execution (RCE), without requiring application changes. Security groups act as a virtual firewall, limiting network access to only necessary IP addresses, significantly reducing the attack surface and potential for exploitation while a permanent fix is developed. This provides immediate protection for PCI data.

Implementing a virtual patch through WAF rules provides an immediate and non-intrusive layer of protection by inspecting and filtering malicious traffic targeting the Apache Struts vulnerability. This method blocks known exploit patterns at the network edge, preventing successful attacks from reaching the vulnerable application without requiring changes to the server or application code. It effectively buys critical time for security teams to thoroughly test and deploy the official vendor patch in a controlled manner, minimizing service disruption.

AV:N (Attack Vector: Network) means the vulnerable component is bound to the network stack and the attacker's path to exploit lies through a routable network connection, potentially even across the internet, rather than requiring physical or local access. This is the highest-severity attack vector value because it maximizes the pool of potential attackers, contributing to this vulnerability's near-maximum CVSS base score of 9.8 alongside low complexity and no required privileges or user interaction.

Updating email filtering rules and detection signatures is a direct, preventive improvement that uses indicators from the phishing campaign (such as sender domain, subject line patterns, and payload hashes) to enhance the email security gateway. This action hardens the environment against similar attacks by proactively blocking malicious emails before they reach users. It is a classic post-incident activity because it closes the specific vulnerability that allowed the phishing email to be delivered, reducing the likelihood of recurrence.

Running containers in privileged mode grants them every Linux capability, disables seccomp and AppArmor/SELinux confinement, and exposes all host devices, effectively removing isolation between the container and the host kernel. An attacker who exploits a vulnerability in a privileged container can trivially escalate to full host control, making it one of the most dangerous container misconfigurations. During a vulnerability assessment, this should immediately be flagged as a critical finding.

Patch SLA compliance percentage directly measures the proportion of patches applied within the stipulated timeframes, such as critical patches within 48 hours or high-severity within 30 days. It quantifies adherence to the patching policy and reflects the organization's ability to remediate known vulnerabilities on schedule. This is the most relevant benchmark because it captures timeliness, completeness, and scheduling discipline, which are the core factors of patch management effectiveness.

Correlating DNS query logs with endpoint process and network connection telemetry is the most effective approach to validate and understand suspicious DGA activity. This comprehensive analysis allows security analysts to pinpoint the specific process generating the unusual DNS queries, observe subsequent network connection attempts (or failures), and confirm if the host is indeed attempting outbound command-and-control communication, thereby enabling precise and targeted remediation efforts.

AWS GuardDuty actively leverages continuously updated threat intelligence feeds, including lists of known malicious IP addresses, domains, and attack signatures, to identify suspicious activity. When an EC2 instance communicates with an IP address or domain identified as a known command and control (C2) server by these feeds, GuardDuty generates a finding, indicating a high probability of compromise and C2 communication.

Nessus is a commercial vulnerability scanner developed by Tenable that actively scans hosts and network services, comparing software versions and configurations against a comprehensive plugin database of known Common Vulnerabilities and Exposures (CVEs). It supports credentialed scans, agent-based scanning, and integration with patch management and SIEM platforms, making it a primary tool for continuous vulnerability management. This directly matches the goal of identifying exploitable weaknesses across an enterprise.

Aggregating alerts by source IP and time window groups multiple failed login attempts into a single, consolidated alert, effectively suppressing repetitive notifications while still preserving detection of brute-force or credential-stuffing activity. This correlation technique condenses dozens or hundreds of individual events into one actionable incident, reducing analyst alert fatigue and allowing the security team to focus on the actual attack pattern rather than being overwhelmed by event-level noise.

This is correct: the vector specifies S:C (Scope Changed) and C:H (high confidentiality impact), while integrity and availability are None (I:N/A:N). A Changed scope means the vulnerability affects resources outside the vulnerable component's security authority, and the only rated impact is disclosure of sensitive information. These values exactly match the analyst's finding.

Deploying additional network monitoring sensors at segmentation boundaries and critical ingress/egress points eliminates the blind spots that allowed this incident to go undetected. These sensors capture full packet data, NetFlow metadata, or IDS/IPS alerts, enabling analysts to detect lateral movement and command-and-control activity that passive host-based tools might miss. This is a direct corrective action to improve visibility and reduce time-to-detection for future attacks.

This quantifies the degradation to confidentiality, integrity, and availability, including data exfiltration volume, systems compromised, financial losses, and regulatory exposure. It is critical because it drives the severity classification, escalations, and short-term mitigation priorities such as isolating affected hosts or activating business continuity plans. Impact assessment also provides stakeholders with the information needed to decide on legal reporting and customer notifications.

The legal and compliance department is the correct first point of contact because it ensures the organization satisfies statutory and regulatory breach notification obligations (e.g., GDPR, HIPAA, SEC rules) before any public or external disclosure. They also provide legal counsel on preservation of evidence and attorney-client privilege, which directly influences containment and eradication actions. Engaging this internal team early prevents costly penalties and legal exposure from mishandled incident response.

Excessive permissions in Kubernetes can lead to privilege escalation or unauthorized access.

Command and control (C2) beaconing involves an infected host periodically initiating outbound connections to a C2 server, often on a non-standard port like 4444, to check for new commands or upload data. These connections are typically regular, repetitive, and consistent in their destination and port, fitting the description of repeated connections to a single IP on port 4444. This behavior establishes a persistent communication channel for remote control of the compromised system.

Phishing simulation click rates are a leading indicator of user resilience to social engineering attacks, directly measuring the effectiveness of security awareness training. A high click rate signals elevated human risk, while declining clicks over successive campaigns demonstrate improved workforce behavior. This metric is strategic because it quantifies a primary attack vector—email—and supports data-driven adjustments to training content and cadence.

Asset criticality is the correct primary driver for prioritization because it directly captures the potential business impact if confidentiality, integrity, or availability is compromised. A vulnerability on a server that processes financial transactions or contains protected health information poses far greater risk than the same CVE on an internet-facing demo server with no sensitive data. This aligns with risk-based vulnerability management, where risk equals the likelihood of exploitation multiplied by the consequence to the business.

Testing a patch in a staging environment is the most prudent and recommended practice before deploying it to production systems, especially with automated patch management. This process allows administrators to thoroughly evaluate the patch's compatibility with existing applications and configurations, identify potential regressions, and confirm its effectiveness in a controlled, non-production setting. This crucial step minimizes the risk of introducing new vulnerabilities, system instability, or service outages that could arise from an untested patch in a live environment.

The timeline is the chronological reconstruction of every observable event leading up to, during, and after the security incident. It consolidates artifacts like log entries, file system changes, network flows, and user actions into a coherent sequence. This component is foundational because it enables analysts to map the attack lifecycle and determine the exact order of compromise, which is essential for effective containment and eradication.

Privileged containers run with all Linux capabilities and disable isolation mechanisms such as seccomp, AppArmor, or SELinux, effectively granting the process root-equivalent access to the host kernel and devices. This means a malicious or compromised workload inside the container can directly attempt to escape the container and compromise the underlying node. Thus, enabling privileged mode is a critical misconfiguration that should be avoided in standard deployments.

A file size condition in YARA, such as `filesize < 300KB`, is a fast, cheap filter that eliminates unrelated files before more expensive scanning takes place. Since many malware families produce samples with a consistent size range, imposing a size bound helps the rule avoid flagging innocuous files that happen to share other attributes. This increases precision and reduces the false-positive rate.

Snyk provides container scanning and vulnerability management.

Tracks the number of unresolved vulnerabilities broken down by CVSS severity level (e.g., critical, high, medium, low). This is a core patch-management metric because it directly reflects the current attack-surface exposure and backlog of unpatched systems, which compliance frameworks typically require to be monitored and reduced over time.

Verifying the hash of the acquired image against the original evidence is a critical step because it provides cryptographic proof that the image is an exact bit-for-bit replica. Using algorithms like SHA-256, any change to even a single bit in the image produces a completely different hash, so the match confirms no data was altered during acquisition. This verification is recorded and matched against the hash of the original, establishing the integrity and authenticity of the evidence for the chain of custody and courtroom admissibility.

Capturing a forensic image of affected systems is the correct first step because it creates a bit-for-bit copy of the storage media while preserving file slack, unallocated space, and metadata. Using a hardware write-blocker and cryptographic hashing ensures the evidence remains intact and tamper-proof for later analysis. This action is essential for identifying how the data exfiltration occurred, which files were accessed, and what remnants remain, all without altering the original source.

DNS server logs are the primary source for detecting DNS tunneling because they contain the queried domain name, client IP, timestamp, record type (e.g., A, TXT, CNAME), and response size. Tunneling often manifests as base64-encoded subdomains, unusually long FQDNs, or high volumes of TXT/ANY queries with large response payloads—all visible directly in these logs. Correlating such patterns across multiple queries to the same domain from a single internal host provides strong, specific evidence of tunneling.

Cloud application audit logs (e.g., Microsoft 365's Unified Audit Log or Google Workspace's Admin Log) provide a tamper-evident record of every file access, download, share, and permission change linked to a user or session. By correlating the CASB alert's timestamp, source IP, and geolocation with these logs, the analyst can determine definitively whether sensitive files were opened, downloaded, or shared externally. This evidence-first approach confirms or refutes exfiltration and helps scope the incident without causing business disruption.

Financial impact directly quantifies risk in monetary terms, such as lost revenue, incident response costs, or diminished asset value. It is the most universally understood language for executive stakeholders, facilitating prioritization of risk mitigation based on return on investment. Presenting risk as financial exposure enables the board to make informed decisions about risk appetite and resource allocation.

Confidentiality (C) is one of the three core impact metrics in the CVSS base score, assessing the degree of unauthorized information disclosure that results from an exploit. It measures the impact on data privacy, where a rating of High means complete loss of confidentiality, such as exposing sensitive user credentials or protected records. This metric directly reflects the impact on the CIA triad's confidentiality component, making it a valid impact metric.

Reviewing the Windows Security Event Log for event ID 4698 is the most direct and effective method to detect the creation of new scheduled tasks. This specific event ID explicitly logs when a scheduled task is registered on the system, providing crucial forensic evidence of a potential persistence mechanism established by an attacker. Analyzing these logs allows analysts to identify the task name, creator, and associated command, which are vital details for incident response.

Testing patches in a staging environment replicates the production configuration, including operating system versions, middleware, and sample data, to validate patch behavior and compatibility before any disruption. It allows security and IT teams to detect conflicts, broken dependencies, and performance degradations early, and to develop rollback procedures. This process is foundational to a mature patch management lifecycle because it directly reduces the probability of production outages and security regressions.

Testing the patch in a staging environment that mirrors production is the correct first step because it allows you to verify the patch against the exact operating system versions, applications, and configurations that exist in your live environment. This phase catches compatibility issues, dependency breaks, and security policy conflicts before they reach critical systems. It also lets you validate rollback procedures and measure any performance impact in an isolated setting. Confirming stability in staging builds the evidence needed to support a change management approval and a confident production rollout.

Email gateway logs are the primary source for identifying phishing payloads because ransomware often arrives via malicious attachments or embedded URLs. These logs capture sender metadata, subject lines, message IDs, and any verdicts (e.g., quarantined, spam, clean), so reviewing the week prior to the incident lets investigators trace the exact message that delivered the initial dropper and recover the full email thread for IoC extraction.

The alert from the Intrusion Detection System (IDS) indicates that a SQL injection attempt was detected, but the Web Application Firewall (WAF) successfully protected the application. This scenario demonstrates that the layered security controls are functioning effectively, with the WAF acting as a preventative control at the application layer. Since the WAF successfully blocked the malicious traffic, the application remains secure, and no immediate manual intervention is required for this specific incident.

An enterprise patch management tool is specifically designed to automate the entire lifecycle of security updates, from identification and testing to deployment and verification across a large number of systems. Solutions like Microsoft WSUS or SCCM streamline the process of distributing patches to operating systems and applications, ensuring a consistent security posture. This automation is crucial for efficiently remediating vulnerabilities and maintaining compliance without manual intervention.

Root cause analysis identifies the fundamental vulnerability or error that enabled the incident, forming the basis for remediation and preventive measures. An incident report is incomplete without it because understanding what went wrong is critical to preventing recurrence and fulfilling regulatory and organizational requirements.

Lessons learned should translate findings into trackable process improvements. In eradication, responders need action that reduces risk while preserving the investigation record.

This is the correct first step because incident response plans conventionally begin with detection and internal escalation, notifying personnel with the authority and expertise to manage the event. The IR team will lead subsequent actions such as containment, eradication, and recovery, and will serve as the central coordinator for all internal and external communications. Any other action—whether external notification, public statements, or documentation—must be authorized through this escalation path to maintain control and legal defensibility.

Strategic intelligence reports synthesize the threat landscape, adversary motivations, and emerging trends into high-level analysis that executives can use to align cybersecurity with business objectives. They communicate risk in terms of financial impact, reputational damage, and regulatory exposure, with recommendations for security investments and policy direction. This is the correct type because it is tailored for executive decision-making, which requires clarity on overall risk posture rather than technical detail.

Active network connections enumerated via netstat are a primary indicator of remote access tools (RATs) and command-and-control communications, which often accompany lateral movement. The artifact lists both listening and established connections, allowing the hunter to correlate suspicious external IPs and ports with the specific process IDs that own them. In Velociraptor, this yields immediate, direct evidence of an attacker's current or recent remote access session.

Password spraying is a low-and-slow attack method where an attacker attempts a small number of very common passwords (e.g., "Summer2023!", "Password123") against a large list of user accounts. The primary goal is to avoid triggering account lockout policies, which are typically configured to lock an account after a few failed attempts. By distributing the attempts across many accounts, the attacker hopes to find a match for at least one account without generating a high volume of failed logins for any single user, making it harder to detect.

Large DNS payload sizes are a classic indicator of tunneling because standard DNS queries and responses are deliberately small—classic UDP DNS is limited to 512 bytes without EDNS0, and even with EDNS0 typical resolvers rarely see TXT records exceeding a few hundred bytes. Tunneled traffic (via TXT or NULL records) packs encoded data into the payload, causing individual DNS messages to balloon in size and break from the statistical norm. This size anomaly is often detected when the maximum payload length or the distribution of payload sizes for a domain appears abnormal.

This is the most effective strategy as it leverages clean, uninfected backups for the bulk of the data, ensuring system integrity and a secure foundation. For critical files that experienced legitimate modifications between the last backup and the incident, change logs, transaction logs, or user-reported changes can be used to manually re-apply those specific updates. This meticulous process minimizes data loss by reconciling recent legitimate changes with the restored clean baseline, providing the highest level of data integrity and business continuity post-incident.

Disconnecting the system from the network is the most immediate and effective first response to suspected data exfiltration via tunneling. This action instantly severs all network communication, preventing any further data loss, command and control (C2) traffic, or lateral movement by the attacker. It provides a critical window for incident responders to analyze the system in a controlled environment without ongoing risk.

This is the strongest evidence because it demonstrates a formal, recurring process where managers or data owners explicitly certify which users have access to which systems and data, and whether that access remains appropriate. It shows that the organization systematically validates least privilege, detects orphaned accounts, and documents corrective actions after each review cycle. Auditors expect to see these review records to prove that access rights are not just assigned but continuously governed.

Tuning the vulnerability scanner's configuration is the most effective and proactive method to reduce false positives by directly refining its detection capabilities. This involves adjusting parameters such as plugin selection, sensitivity levels, authentication credentials, and exclusion rules to better match the target environment. Proper tuning ensures the scanner accurately distinguishes between actual vulnerabilities and benign conditions, significantly improving the precision of future scan results and reducing analyst workload.

The "Run" and "RunOnce" Registry keys are classic and highly effective persistence mechanisms. Entries added to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` or `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` instruct Windows to automatically launch specified programs or scripts every time a user logs on. This direct Registry modification ensures the malicious payload executes without requiring user interaction, making it a prime target for attackers seeking to maintain access.

Disabling directory listing on the web server prevents attackers from enumerating filenames and directory structure when no index file exists. Without this setting, requesting a directory returns a browsable list of all assets, exposing configuration backups, source code, or sensitive data. It is a core hardening step that reduces reconnaissance surface.

Chain of custody documentation is critical because it creates a verifiable, chronological record of every person who handled the evidence, along with the time, purpose, and condition of each transfer. In a forensic investigation, this paper trail ensures legal admissibility; if the chain is unbroken, the court can trust that the evidence has not been tampered with or substituted. Without proper documentation, even a technically perfect disk image could be ruled inadmissible, undermining the entire investigation.

This is the correct approach because DAST tools can be configured to simulate a legitimate user's interaction by logging in with a dedicated test account. By properly managing session tokens or cookies, the scanner gains access to protected areas of the application, allowing it to thoroughly test functionality behind authentication. This method ensures comprehensive coverage of the entire application, including pages requiring login, thereby identifying vulnerabilities that would otherwise remain hidden.

Recovery should follow eradication of persistence and credential exposure. In containment, responders need action that reduces risk while preserving the investigation record.

Root cause analysis identifies the fundamental underlying reason for the security incident, such as an unpatched vulnerability, misconfigured firewall rule, or successful phishing campaign. For an incident report, establishing the root cause is critical because it guides remediation efforts and prevents recurrence, and it satisfies regulatory and stakeholder requirements for understanding why the incident occurred. Without a root cause, the report is merely descriptive, not prescriptive.

This is a concrete, actionable recommendation that directly addresses a common attack vector used in ransomware incidents, such as compromised VPN credentials. It specifies the control (MFA), the scope (remote access), and the goal (risk reduction), making it a proper lesson learned. Unlike observations or causes, it provides a clear implementation step that stakeholders can act on to harden their environment.

Escalating the matter to the company's legal department is the most appropriate action because legal counsel is responsible for ensuring compliance with all applicable laws and regulations, including data protection mandates. This allows the legal team to assess the risk of non-compliance and advise on the correct course of action, potentially overriding the CISO's decision while respecting internal authority structures. It ensures the organization acts within legal boundaries.

Scheduled tasks are a native Windows mechanism that can trigger a binary or script when a user logs on, at system startup, or at regular intervals. Attackers routinely create named or hidden tasks to rerun malware or maintain command-and-control, and these tasks survive a reboot (unless disabled). Because the task description, action, triggers, and run-as user are all stored in the Task Scheduler database, examining it with Velociraptor can reveal suspicious persistence. This makes scheduled tasks an essential artifact in any threat hunt.

Capturing a memory dump is the critical next step after isolating a host because it preserves volatile data residing in RAM. This data, which includes running processes, network connections, open files, and potentially malware artifacts, would be lost upon system shutdown or reboot. Analyzing a memory dump provides invaluable forensic evidence for understanding the attacker's activities and the extent of the compromise without altering the live system state.

Without proper credentials, a vulnerability scanner performs unauthenticated scans, relying on network-level probes and banner grabbing. This method often leads to false positives because it cannot log into the target system to verify actual patch levels, installed software versions, or configuration files. For example, a service banner might display an older version string even if the underlying software has been patched or backported, causing the scanner to incorrectly flag a vulnerability as "Confirmed" on a secure system.

The registry Run key (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is a classic autostart persistence mechanism; a command using reg.exe to add a value there explicitly indicates the attacker intends to execute a payload at user logon. Inspecting this key for the malicious entry is the highest-priority action because the observed telemetry directly aligns with this persistence method, and the associated binary path or command can be identified and remediated. This is not merely incidental—the command's purpose is to modify this specific key.

GDPR Article 34 mandates that data controllers must notify affected data subjects without undue delay when a personal data breach is likely to result in a high risk to their rights and freedoms. This direct communication enables individuals to take necessary precautions to mitigate potential harm, such as identity theft or financial fraud. The 'without undue delay' clause emphasizes the urgency of informing those directly impacted by the breach.

Access review reports are a direct artifact of an identity governance process, showing that the organization periodically re-certifies user entitlements against current roles and business need. Because the reports are generated from actual access decisions and reviews, they demonstrate that the access-control control is operating as intended, which is exactly the type of evidence a compliance auditor expects to see.

Isolating the domain controller by disabling its network interface is the immediate priority in a suspected compromise. This action effectively contains the threat, preventing the attacker from further lateral movement, exfiltrating data, or causing additional damage across the network. Crucially, it preserves the system's current volatile state and disk evidence for subsequent forensic analysis, allowing investigators to understand the attack vector and scope. This containment strategy is a fundamental step in the incident response lifecycle.

SQL injection is an injection flaw that occurs when untrusted data is directly concatenated into SQL queries, allowing attackers to manipulate database logic. For example, an attacker can submit a value like `' OR '1'='1` to bypass authentication or extract sensitive data. This happens because user input is not parameterized or properly sanitized before being sent to the database interpreter.

This is the most plausible explanation for a re-infection following a successful restoration from a clean backup. After a system is restored, it often operates in a vulnerable state, potentially with reduced network connectivity or security controls temporarily relaxed for validation. An employee inserting an infected USB drive directly into the server or a connected workstation provides a direct, physical vector for malware re-introduction, bypassing network perimeter defenses that might have been re-established. This action re-establishes the infection chain.

Presenting the comprehensive risk assessment data, including the identified threats, vulnerabilities, likelihood, and impact, alongside a detailed cost-benefit analysis for various treatment options, is the most effective approach. This allows stakeholders, including the system owner, to make an informed, data-driven decision regarding risk acceptance, ensuring transparency and alignment with business objectives. It facilitates a collaborative understanding of why acceptance is the appropriate strategy, based on objective facts rather than subjective opinions.

Computing a one-way cryptographic hash (such as SHA-256) of the original drive before acquisition and of the forensic image after, then comparing the two digests, is the definitive test that the image is a bit-for-bit clone with no changes introduced during capture. A matching hash validates the image for court admissibility and provides a baseline for later re-verification as part of the chain of custody.

The potential business impact of an incident drives its priority because the goal of incident management is to minimize harm to the organization. Impact includes financial loss, operational disruption, regulatory fines, reputational damage, and customer trust. A high-impact incident, such as a ransomware attack on a core revenue system, necessitates immediate escalation regardless of other factors.

GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It ingests and analyzes VPC Flow Logs, DNS logs, and CloudTrail management events to identify threats like compromised EC2 instances, port scanning, or crypto mining. GuardDuty generates findings that a SOC can investigate, making it a core cloud-native security monitoring tool.

The immediate priority is to restrict public access to the storage bucket, effectively containing the data exposure and preventing further unauthorized access. Following containment, it is crucial to conduct a thorough investigation to determine if sensitive data was present in the bucket and whether it was accessed or exfiltrated during the period of public exposure. This two-pronged approach aligns with incident response best practices, focusing on mitigation and subsequent impact assessment.