CompTIA CySA+ CS0-003 (CS0-003) — Questions 751–825

YARA rules are specifically designed to identify and classify malware samples based on textual or binary patterns, including unique strings and byte sequences. By testing a YARA rule against known-good and known-bad samples, the analyst can validate its accuracy and ensure it reliably detects related files from the same campaign while minimizing false positives.

Implementing a SIEM (Security Information and Event Management) system correlates alerts from various sources, reducing false positives and improving detection speed.

STIGs are detailed security configuration guides for DoD systems, providing hardening requirements.

Disconnecting the affected workstations from the network (but leaving them powered on) preserves volatile evidence in memory (e.g., encryption keys, process artifacts) and prevents the ransomware from spreading to other hosts via SMB, RDP, or other lateral movement protocols. Powering off would destroy this critical forensic data, while leaving them connected risks further encryption of network shares.

The vector indicates a remote, easily exploitable vulnerability that only affects confidentiality (e.g., information disclosure).

Option D is correct because after containment, the incident response process requires removing the persistence mechanism (the scheduled task), rotating the stolen service account credentials to prevent re-authentication, and verifying that no other hosts are compromised (lateral movement check). This aligns with the NIST SP 800-61 recovery phase, which mandates eradication before recovery to ensure the threat is fully removed.

Option B is correct because severity in incident response must be driven by business impact, privilege level, asset criticality, and spread potential. The domain admin workstation has elevated privileges and access to sensitive systems, making it a higher priority than a non-sensitive kiosk, regardless of alert order. This aligns with NIST SP 800-61 and common IR frameworks that prioritize containment based on risk, not chronology.

Option C is correct because it disables the insecure SSL 3.0 and TLS 1.0 protocols while enabling TLS 1.2, which is currently the most widely supported secure TLS version. TLS 1.2 provides strong cipher suites and has no known practical vulnerabilities like POODLE (SSL 3.0) or BEAST (TLS 1.0). This configuration balances security with compatibility for modern clients.

Tactical intelligence, such as IoCs, is most useful for frontline technical teams like the SOC, who can use it to detect and block threats. Executives typically receive strategic intelligence.

DGA domains are algorithmically generated and often have high entropy, frequent NXDOMAIN responses (because the domain may not yet be registered), and are rarely seen in the environment.

Option D is correct because correlating flow volume with database audit logs and destination reputation provides direct evidence of whether the encrypted outbound transfer is legitimate database replication or exfiltration. This approach leverages existing security controls (flow records, audit logs, threat intelligence) to validate the activity without assuming encryption implies safety or disrupting operations.

The correct first step is to disable or rotate the compromised cloud access key and review actions performed with it. This immediately revokes the attacker's access, preventing further unauthorized use, while the review of logs and API calls determines the scope of the breach. Waiting or blocking the developer's laptop does not address the exposed credential or the active threat from the unfamiliar IP.

A credentialed scan uses authenticated credentials to access the target, allowing deeper checks for missing patches and misconfigurations without intrusive techniques. This provides accurate results with less impact than non-credentialed scans that might cause crashes.

The lack of SYN-ACK responses suggests the server is not reachable or the port is closed. Repeated SYN packets without response are characteristic of a TCP port scan, as the scanner waits for a timeout and retries.

Strategic intelligence for executives helps them understand the threat landscape, while tactical intelligence for SOC teams provides IoCs for detection.

Option C is correct because tokenization or pseudonymization replaces PII with non-sensitive placeholders that retain referential integrity and analytical utility, allowing auditors to perform their review without exposing actual personal data. This approach balances transparency requirements with data minimization principles mandated by regulations like GDPR and PCI DSS, unlike full disclosure or simple encryption which still exposes the original data to the recipient.

The CVSS base score provides a standardized, quantitative measure of a vulnerability's severity based on intrinsic characteristics like attack vector and complexity. Prioritizing by CVSS score ensures that remediation efforts focus on vulnerabilities with the highest potential impact, aligning with industry best practices for risk-based vulnerability management.

PEiD or similar tools can detect packers by scanning for known signatures. High entropy and suspicious section names often indicate packing, so using a packer identifier is appropriate.

Preserving evidence before containment is crucial. Using a write blocker when imaging a hard drive ensures that the original data is not altered, maintaining the integrity of the evidence.

Process analysis looks at process trees to find anomalies like a word processor spawning a command shell.

The CVSS base score (B) provides a standardized, vendor-neutral severity rating (0-10) that reflects the intrinsic characteristics of a vulnerability, such as attack vector, complexity, and impact on confidentiality, integrity, and availability. This score is a primary factor for prioritization because it allows analysts to compare vulnerabilities across different systems and prioritize those with the highest potential for damage, independent of environmental factors.

Passive DNS allows querying historical and current IP addresses associated with a domain, revealing hosting changes.

Option B is correct because the first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.

Reporting the vulnerability to the development team ensures awareness, and implementing a WAF rule can provide temporary protection while a fix is developed.

Log normalization and field mapping in the parser ensure that source IP, user, and action fields from the new cloud log source are consistently transformed into the schema expected by the SIEM or analytics platform. Without this, the analytics engine cannot correlate or alert on the data because the fields are not recognized or are mapped to incorrect attributes, leading to failed analytics.

Internet exposure of the affected asset is a critical factor because assets reachable from the public internet have a larger attack surface and are more likely to be targeted by automated scanners and exploit kits. Risk-based prioritization weighs the likelihood of exploitation, and an internet-facing system inherently faces a higher threat level than an internal-only asset. This aligns with the CVSS environmental metrics (Modified Attack Vector) and common vulnerability scoring frameworks that adjust severity based on network accessibility.

Digital forensics follows identification, preservation, collection, examination, and presentation.

Lessons learned involves analyzing the incident to improve future response. Updating detection rules based on IOCs and conducting a root cause analysis are key activities.

Certutil can be abused to download files using the '-urlcache' and '-split' arguments (or '-f' for force). The combination of '-urlcache' with a URL and output file is typical for downloading malicious payloads. '-verify' is legitimate, '-encode' and '-decode' are used for encoding/decoding, but '-urlcache' and '-split' are key for download.

Option C is correct because removing malicious files and artifacts from affected systems is a core step in the eradication phase, ensuring that the root cause of the incident is eliminated and the system can be safely restored to normal operations. This step directly addresses the removal of malware, persistence mechanisms, and unauthorized changes that were identified during analysis.

Option D is correct because forensic acquisition requires a complete chain of custody to ensure evidence integrity and admissibility in legal proceedings. Documenting who collected the evidence, when and where it was collected, cryptographic hash values (e.g., SHA-256) to verify data integrity, transfer details (e.g., write-blocker used, network path), and storage location provides a defensible record that meets legal and organizational standards.

Option D is correct because a virtual patch via a web application firewall (WAF) can inspect and block exploit attempts against the vulnerability without modifying the legacy server's code or binaries. This allows the business-critical application to remain available while mitigating the 9.8 CVSS risk at the network layer, typically using signature-based or behavioral rules to intercept malicious payloads targeting the flaw.

Option C is correct because it directly addresses the core requirement of balancing technical details with business impact. For a critical vulnerability, the executive team needs to understand the potential financial, operational, and reputational risks, not just the technical flaw. This approach aligns with the NIST risk management framework, which emphasizes communicating risk in terms of business context to enable informed decision-making on risk treatment (e.g., accept, mitigate, transfer, avoid).

A is correct because assets supporting critical business processes have a higher impact on organizational operations if compromised. Vulnerability management prioritization frameworks, such as those aligned with the CVSS environmental score, assign greater weight to business criticality. Remediating vulnerabilities on these assets first reduces the risk of significant downtime, data loss, or regulatory non-compliance.

Operational intelligence focuses on specific campaigns, tools, and techniques to inform defenders' actions.

Proper risk acceptance documentation requires a formal sign-off by the risk owner, typically including a justification and acceptance date.

Option A is correct because in a structured remediation process, applying a patch or configuration change requires a formal change request to ensure proper testing, approval, and documentation, minimizing the risk of unintended disruptions. This aligns with change management best practices in vulnerability management, where uncoordinated changes can introduce new vulnerabilities or break existing functionality.

Common IOC types include IP addresses, file hashes, domains, URLs, and email indicators. Software versions are not typically IOCs.

The deception credential is a honeytoken—a fake credential placed in a file share to detect unauthorized use. Since no legitimate user should know it, any authentication attempt using it indicates an attacker has accessed the file share (credential access) and is attempting to move laterally (lateral movement). This warrants high-priority investigation because it directly signals a breach in progress.

OpenVAS is a well-known open-source vulnerability scanner.

Option B is correct because when a critical vulnerability cannot be patched due to legacy OS constraints, compensating controls are the best approach to reduce risk. Network segmentation isolates the server from untrusted hosts, and host-based firewall rules restrict inbound/outbound traffic to only necessary ports and IPs, mitigating the remote code execution vector without taking the server offline.

Process hollowing involves creating a legitimate process in a suspended state, replacing its memory with malicious code, and resuming it. The absence of an on-disk executable is a key indicator.

Resource Monitor (resmon.exe) provides a real-time view of network activity, including which processes are making outbound TCP and UDP connections, along with the remote addresses and ports. Unlike netstat, it directly associates network connections with specific process names and allows filtering by process, making it the most efficient tool for identifying the exact process responsible for outbound internet traffic.

Patch SLA compliance percentage measures how often patches are applied within the defined service level agreement, indicating the effectiveness of patch management processes.

Non-credentialed scans are less intrusive and less likely to cause service disruptions because they do not log into the target systems.

Option A is correct because encrypting logs in transit (e.g., using TLS/SSL for syslog over TCP 6514) and at rest (e.g., AES-256 encryption on the storage volume) ensures confidentiality and integrity, preventing unauthorized access or tampering. This aligns with security frameworks like NIST SP 800-92 and PCI DSS requirements for protecting log data.

After discovery (scanning), the next step is prioritization of vulnerabilities based on risk, exploitability, and business impact.

The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four key phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Option C (Preparation) is correct because it is the foundational phase where policies, tools (e.g., SIEM, EDR), and communication plans are established before any incident occurs. Option E (Post-Incident Activity) is correct because it includes lessons learned, evidence retention, and report generation to improve future response efforts.

Unauthenticated scans only enumerate open ports and services visible without credentials, missing the patch status of installed software because they cannot query the Windows registry or WMI for installed updates. Running authenticated scans with least-privilege credentials allows the scanner to log into each target and retrieve detailed patch data via the Windows Update Agent API or registry keys, revealing missing patches that were previously invisible. This directly addresses the security manager's suspicion of missing patch data without introducing unnecessary risk.

The scenario describes multiple failed logon attempts from a single external IP against several user accounts within a short time window. This pattern is characteristic of a brute-force attack, where an attacker systematically tries common or guessed passwords across multiple accounts to gain unauthorized access. The single source IP and rapid sequence of failures distinguish it from a password spraying attack, which spreads attempts across many accounts slowly to avoid lockout thresholds.

Large outbound data volume, connections outside business hours, and use of non-standard ports (e.g., 443 for https but custom port for tunneling) are classic exfiltration indicators.

Option B is correct because the company policy explicitly requires reporting all security incidents within one hour of detection, regardless of severity. The analyst must report the incident immediately, even if it means staying late, as policy compliance is mandatory and low-severity incidents still represent a security event that could indicate broader compromise or be part of a larger attack chain. Delaying reporting violates the policy and could lead to disciplinary action or missed escalation windows.

MySQL 5.5.62 is end-of-life (EOL) and no longer receives security patches, making it vulnerable to known exploits such as CVE-2016-6662 (privilege escalation via crafted my.cnf) and CVE-2016-6663 (privilege escalation via REPAIR TABLE). The analyst should prioritize this because the lack of vendor support means any discovered vulnerability will remain unpatched, posing a critical risk to data confidentiality and integrity.

Translating technical risk into business terms (financial, reputational, regulatory) helps executives understand the impact and make informed decisions.

A tabletop exercise (option A) is the correct choice because it simulates a realistic ransomware scenario in a discussion-based format, allowing legal, PR, IT, and executives to validate their roles and decision-making processes without impacting production systems. This aligns with NIST SP 800-61r2 guidelines for testing incident response plans through low-impact, discussion-driven exercises, ensuring cross-functional coordination without risking data integrity or availability.

Penetration testing follows a structured methodology: recon, scanning, exploitation, post-exploitation, and reporting.

PE header analysis includes examining the import table to see which Windows API functions the executable calls, revealing its potential behavior.

An incident response plan should define communication procedures; typically, the team should escalate internally to leadership who can authorize external notifications.

Credentialed scans authenticate to the target OS and can query patch levels directly, yielding more accurate results than uncredentialed scans.

Hollowing involves replacing a legitimate process's memory with malicious code, leaving no corresponding file on disk.

Database audit logs record which objects (tables, columns) were queried and by which accounts, directly revealing unauthorized access or unusual data retrieval patterns that could indicate exfiltration. NetFlow or proxy logs capture destination IP addresses, data volumes, and timing of HTTPS sessions, allowing the hunter to spot large or anomalous outbound transfers to suspicious hosts, even though the payload is encrypted.

Option A is correct because the best validation method is to independently verify the server's TLS configuration by manually testing with a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to negotiate TLS 1.0. This eliminates false positives from automated scanners that may rely on banner grabbing or outdated fingerprints, and directly confirms whether the service accepts TLS 1.0 handshakes at the protocol level.

The vulnerability is effectively mitigated by the compensating control (WAF), so it should be documented as such and tracked until the patch is applied.

Option D is correct because the best validation method is to manually test the service using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to negotiate TLS 1.0. This directly verifies whether the server truly rejects TLS 1.0 handshakes, eliminating false positives from scanner misconfiguration or version negotiation quirks. Relying on the owner's assertion or altering the finding without technical proof would violate vulnerability management best practices.

Adding a whitelist for known benign source IP addresses or user accounts is a valid approach because it directly reduces false positives by excluding traffic that is known to be safe from triggering the rule. This improves the signal-to-noise ratio by ensuring that only truly suspicious activity generates alerts, without altering the detection logic itself.

Option B is correct because the vulnerability manager must obtain objective evidence that the fix was successfully applied and the vulnerability is no longer exploitable. A retest—typically performed via authenticated scanning or manual verification—confirms the absence of the vulnerable condition, aligning with the remediation validation phase in the vulnerability management lifecycle. Closing based solely on a team's email (Option C) violates the principle of verify, not trust, and could leave residual risk unaddressed.

Option C is correct because the first step after a claimed fix is to verify the remediation by rescanning the application with the same vulnerability scanner. This provides objective evidence that the SQL injection vector is no longer exploitable, confirming the input sanitization was effective before any further actions are taken.

Option B is correct because the best next step is to validate whether the vulnerable OpenSSL binary is actually exploitable in the container's runtime context (e.g., it may be a statically linked unused library or a dead code path). If the binary is truly unused, the team should still rebuild from a patched base image where feasible to maintain a clean supply chain and avoid false-positive fatigue; if it is used, the vulnerability must be remediated. This balances security rigor with operational pragmatism, aligning with vulnerability management best practices for containerized environments.

A deception credential is a deliberately planted fake credential (e.g., a honey token) that no legitimate user should ever use. When it is used to authenticate to a server, it indicates that an attacker has discovered the credential and is attempting to use it for lateral movement or credential access. This is a high-fidelity alert that warrants immediate investigation because it directly signals unauthorized activity.

Option C is correct because CISA KEV and high EPSS indicate active exploitation in the wild, making the medium CVSS vulnerability a higher operational priority than non-exploitable high CVSS issues. The analyst must first confirm asset exposure to ensure the vulnerability actually affects the environment before recommending remediation. This aligns with risk-based vulnerability management (RBVM) principles, which prioritize exploitability and threat intelligence over CVSS base score alone.

The order of volatility dictates that volatile data in memory (CPU registers, RAM) is collected first, then less volatile data like swap, disk, and logs. The correct sequence is CPU registers, RAM, swap, disk, then logs.

A half-open TCP handshake (SYN flood) is a common DoS technique where the attacker sends many SYN packets without completing the handshake, exhausting server resources.