CompTIA CySA+ CS0-004 (CS0-004) — Questions 676–701

A malicious outbound HTTPS connection with no visible owning process indicates the connection is hidden from standard process enumeration, typical of rootkit or kernel-level concealment. Specialised tools such as memory or kernel inspection utilities can reveal hidden processes that Task Manager or netstat alone would miss.

Correct. Activity Logs record subscription-level control-plane operations performed by the account after authentication, so correlating them reveals whether the session was used to create, modify, or delete resources, which is a strong indicator of malicious intent versus benign access.

The primary objective of staging is to verify that the patch successfully remediates the targeted security vulnerability while ensuring it does not break existing functionality or cause system regressions. This validation phase allows administrators to observe system behavior, application dependencies, and performance metrics under realistic conditions before a full production rollout.

The KEV catalog includes a 'Date Added' field that records when a vulnerability was first identified as known exploited, allowing security teams to prioritize based on how recent and relevant the active exploitation is. This date is crucial because newer entries often warrant immediate attention, as attackers may be actively leveraging them. In contrast to CVSS or EPSS scores, this date is a distinct component of the KEV record itself, making it the right field when consulting the catalog for prioritization.

Volatile memory (RAM) contains transient data such as active network connections, running processes, and unencrypted cryptographic keys that are lost upon system shutdown or reboot. Utilizing a dedicated tool like WinPmem allows analysts to capture a physical memory dump immediately after securing the system. This adheres strictly to the Order of Volatility, ensuring critical, short-lived evidence is preserved before any disk-based collection occurs.

Tcpdump is a powerful command-line packet analyzer that captures and displays network traffic. The `host 10.0.0.1` filter expression precisely instructs `tcpdump` to capture all packets where the source IP address is `10.0.0.1` or the destination IP address is `10.0.0.1`. This effectively captures all inbound and outbound network traffic associated with the specified host, fulfilling the requirement to capture all traffic to and from it.

Performing a root cause analysis (RCA) is the definitive post-incident activity required to identify the underlying vulnerabilities and systemic failures that allowed the breach to succeed. By pinpointing the exact vector, security teams can implement permanent, strategic remediation controls to prevent similar incidents.

Authentication logs, specifically Windows Event ID 4624, are central to detecting pass-the-hash because they record successful and failed logon events, including the logon type, authentication package (e.g., NTLM), source workstation, and target account. In a PtH attack, an attacker uses an NTLM hash as if it were a password; the logon event will typically show a network logon (Type 3) using NTLM, often from a non-domain host or in conjunction with suspicious source IP addresses. Correlating these 4624 events with known user activity patterns can reveal an attacker authenticating with a hash from an unauthorized source.

Implementing credential-based scanning significantly enhances accuracy by allowing the scanner to log into target systems and perform authenticated, local checks. This enables the tool to inspect actual patch levels, system configurations, installed software versions, and internal service states directly, rather than relying solely on network-level inferences. By gaining this internal visibility, the scanner can definitively confirm the presence or absence of vulnerabilities, drastically reducing both false positives and false negatives.

Structured Threat Information Expression (STIX) is an XML/JSON-based serialization language that standardizes the representation of cyber threat intelligence. It allows organizations to share structured data about threat actors, campaigns, indicators, and tactics in a consistent, machine-readable format.

This is correct because the registry Run key is a classic persistence mechanism used to ensure malware executes automatically when a user logs in. Furthermore, legitimate "svchost.exe" binaries must execute exclusively from the System32 directory; finding an executable with this name in a user-writable directory like the Public folder strongly indicates a masquerading technique.

When direct patching is impossible due to EOL constraints, implementing compensating controls such as VLAN segmentation, firewall ACLs, and microsegmentation is the industry-standard approach. This restricts lateral movement, isolates the vulnerable system from untrusted zones, and minimizes the overall attack surface while preserving critical business operations.

Trusted Automated eXchange of Indicator Information (TAXII) is an application-layer protocol specifically designed to route cyber threat intelligence (CTI) over HTTPS. It supports common sharing models such as hub-and-spoke or peer-to-peer, allowing CSIRTs to automate the secure distribution and ingestion of STIX-formatted IoCs directly into security tools.

A comprehensive evidence package, detailing the incident's timeline, scope, and specific categories of affected data, is crucial for regulatory reporting. This structured approach ensures that all pertinent facts are presented clearly and accurately, supporting the organization's compliance efforts and demonstrating due diligence in incident response. Such a package provides verifiable information necessary for regulators to assess the incident's impact and the organization's handling of it.

Tuning the alert is the industry-standard method for managing false positives because it refines the detection logic to exclude benign, repetitive behavior. By adding specific exclusions, such as a trusted IP address or a known service account, the analyst reduces noise and alert fatigue without compromising the SIEM's ability to identify actual threats.

svchost.exe normally hosts service DLLs and does not spawn schtasks.exe. This parent-child pairing indicates a service being abused to create a scheduled task, a common lateral movement and persistence technique for executing code on a remote host.

An EPSS score of 0.1% indicates the vulnerability has near-negligible real-world exploitation likelihood in the next 30 days, and the Kubernetes NetworkPolicy restricting ingress further reduces the attack surface by limiting who can even reach the affected containers. Combining low predicted exploitation with existing compensating controls justifies routine remediation timing rather than emergency action, letting the team patch the base image and redeploy during the normal maintenance cycle.

An Attack Vector of Local (AV:L) significantly reduces the exploitability score because the attacker cannot exploit the vulnerability over the network. They must already possess local shell access, console access, or the ability to execute code locally on the container or host, creating a major barrier to entry compared to Network-based attacks.

Prioritising the KEV/high-EPSS finding reflects genuine exploitation risk rather than raw CVSS severity, since CISA KEV confirms active exploitation and high EPSS predicts imminent attacks. Confirming asset exposure first filters out non-reachable systems, satisfying the stem's requirement for a risk-based order that discounts the several high-CVSS but non-exploitable issues.

Once a Cloud Security Posture Management (CSPM) tool identifies potential public access, determining whether sensitive objects were actually accessed or downloaded is critical for incident response and impact assessment. This moves beyond a misconfiguration alert to evidence of potential data exfiltration or unauthorized access, directly informing the severity of the incident and necessary remediation steps. It helps quantify the actual damage and regulatory reporting requirements.

LiME (Linux Memory Extractor) is a kernel-mode tool specifically designed for volatile memory acquisition on Linux systems. It operates as a Kernel Loadable Module (LKM), allowing investigators to capture full RAM dumps with minimal footprint and high integrity, even bypassing restrictions that might block user-space memory access.

This sequence accurately represents the descending order of volatility according to RFC 3227 guidelines. CPU registers and cache are the most transient, followed by system RAM, then swap/paging files, local hard disks, and finally remote or archived logs. Following this order during an incident response ensures that the most fragile, short-lived digital evidence is preserved before it is overwritten by system processes or power loss.

Wireshark is a premier open-source packet analyzer that intercepts and decodes network traffic in real time. It allows security analysts to capture raw frames from a network interface card in promiscuous mode, filter traffic using display filters, and perform deep packet inspection to troubleshoot anomalies or detect malicious payloads.

Trivy is an open-source vulnerability scanner specifically designed for containers and other cloud-native targets. It quickly scans container images, filesystems, and Git repositories to detect known vulnerabilities (CVEs), misconfigurations, and leaked secrets, making it ideal for integration into CI/CD pipelines.