CompTIA CySA+ CS0-003 (CS0-003) — Questions 826–900

Option D is correct because the immediate priority is to stop the ransomware from encrypting more data and spreading laterally. Isolating the workstation (e.g., disabling its network interface or disconnecting the cable) and terminating its active SMB sessions to file servers cuts off the encryption process at the source, preventing further damage while preserving forensic evidence.

A detailed timeline is essential for reconstructing the sequence of events, identifying the initial compromise vector, and measuring response effectiveness. It provides a factual basis for all subsequent analysis and reporting, ensuring that the incident response team can accurately assess the scope and impact of the incident.

Option D is correct because the encoded PowerShell command is the primary indicator of malicious intent; decoding it reveals the attacker's instructions. Inspecting the process tree (winword.exe spawning powershell.exe) confirms the infection vector (phishing attachment), and analyzing the parent document and network destination identifies the payload and C2 server. This sequence directly addresses root-cause analysis by tracing the attack from initial access to execution.

A is correct because when a patch cannot be applied to a legacy application, compensating controls (e.g., network segmentation, host-based firewall rules, or input validation) must be documented to mitigate the specific vulnerabilities the patch would address. Monitoring must also be implemented to detect any exploitation attempts against those unpatched weaknesses, ensuring the residual risk is continuously observed. This aligns with the vulnerability management lifecycle where exceptions require evidence of alternative risk reduction, not just a waiver.

Authentication logs record login events including source IP, timestamp, and success/failure status, making them the best source for identifying successful authentication from unusual locations.

RAM (Random Access Memory) is the most volatile data because it loses its contents immediately when power is removed. In forensic acquisition, the order of volatility dictates that RAM must be captured first, as it contains running processes, open network connections, and decrypted data that cannot be recovered from disk. Network connections, while volatile, are a subset of the data stored in RAM and are less critical to capture first.

Option D is correct because, immediately after containment, the priority is to eradicate the malware from the workstation to prevent reinfection or lateral movement. Containment isolates the system, but eradication removes the malicious artifacts (e.g., registry keys, scheduled tasks, or malicious binaries) to ensure the system is clean before recovery. This step aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment to eliminate the threat's foothold.

Using a write blocker prevents alteration of the original disk, and computing a hash verifies that the acquired image is an exact copy.

For accurate Linux package findings, the vulnerability scanner must have authenticated access (e.g., via SSH with valid credentials) to inspect installed packages directly from the package manager database (e.g., RPM or dpkg). Without authentication, the scanner can only perform unauthenticated network-based checks, which cannot reliably determine installed software versions or patch levels. Authenticated access ensures the scanner can execute commands like 'rpm -qa' or 'dpkg -l' to enumerate packages with high accuracy.

The exhibit shows excessive CRC errors and runts on the server's network interface, which are classic symptoms of a faulty physical layer component such as a damaged cable or failing NIC. These errors indicate that frames are being corrupted during transmission, and the interface is discarding them, leading to retransmissions and degraded performance. A faulty cable or interface directly causes these physical-layer issues, unlike configuration or driver problems.

Privileges Required (PR) indicates the level of privileges an attacker must have before successfully exploiting the vulnerability.

Option D is correct because the scenario describes a classic technique where a malicious macro or script embedded in an Office document executes wscript.exe (Windows Script Host) from the user's profile. This detection logic directly identifies the suspicious parent-child process relationship of an Office application spawning a script interpreter, which is a strong indicator of a script-based attack, such as a macro virus or initial access payload.

Option B is the best approach because network segmentation isolates the vulnerable legacy server from critical assets, reducing the attack surface, while increased monitoring allows the security team to detect and respond to any exploitation attempts in real time. This balances risk acceptance with active defense, which is a core principle of vulnerability management when patching is not immediately feasible.

Risk assessment involves asset identification, threat/vulnerability identification, likelihood/impact analysis, risk calculation, and prioritization.

Whitelisting the source IP addresses of known, trusted servers reduces false positives by instructing the IDS to ignore alerts for encrypted traffic from those specific hosts. This approach preserves detection capability because the IDS continues to apply all signatures to traffic from other, potentially malicious sources. It is a targeted tuning method that does not disable detection mechanisms or alter sensitivity thresholds, which could otherwise miss real threats.

The executive summary provides a concise overview of key findings and risk posture for management.

TAXII (Trusted Automated eXchange of Indicator Information) is a protocol for exchanging cyber threat intelligence in a standardized format, often used with STIX.

Option D is correct because SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) can break credentialed scans if the scanner's account permissions, allowed authentication methods, or sudo command restrictions are not aligned with the new configuration. Reviewing these settings ensures the scanner can authenticate and execute privileged commands, restoring scan coverage without compromising security.

TLP:AMBER+STRICT restricts sharing to recipients within the organization who need to know, prohibiting further redistribution outside the organization. The SOC must use these indicators internally only with personnel who require them for detection and response, avoiding any external sharing. This ensures compliance with the Traffic Light Protocol (TLP) standard defined by FIRST.org.

Using a write blocker ensures the memory capture does not alter the storage media, preserving forensic integrity.

The patch is critical but causes performance issues. The best approach is to work with the vendor for a resolution or apply compensating controls until a fix is available. Applying the patch blindly may disrupt operations, while skipping it leaves the vulnerability unaddressed.

Endpoint Detection and Response (EDR) is essential in a SOC because it provides continuous monitoring and analysis of endpoint activities, enabling detection of advanced threats such as fileless malware and ransomware. EDR tools collect telemetry data from endpoints, correlate it with threat intelligence, and allow for automated response actions, which are critical for real-time incident detection and investigation.

Short-term containment for DDoS includes blocking attack traffic at the network perimeter and diverting traffic via a scrubbing center. Patching servers does not stop the attack, and rebuilding is recovery.

Computing the hash of the executable and querying threat intelligence (e.g., VirusTotal, AlienVault OTX) provides a definitive, objective indicator of known maliciousness by comparing the file's cryptographic fingerprint against global threat databases. This is the fastest and most reliable method to determine if the program is malicious without risking execution or relying on circumstantial evidence.

Option B is correct because container runtime events (e.g., Docker/containerd exec logs) capture the unexpected shell launch, Kubernetes audit logs record the pod creation and mount operations, and network flow logs (e.g., NetFlow, eBPF-based tools) reveal the outbound connection to the unknown IP. Together, these provide the granular, real-time telemetry needed to detect and investigate the compromise, unlike static or coarse-grained logs.

Wireshark captures and analyzes packet payloads, which is necessary for examining the content of encrypted or unencrypted traffic.

Option A is correct because identifying the initial infected host and user context is critical for understanding the attack vector, containing the threat, and preventing further spread. In ransomware incidents, the first compromised system often reveals the entry point (e.g., phishing email, RDP brute force) and the user account used, which helps scope the blast radius and prioritize remediation.

Log normalisation converts logs from different sources into a common, structured format so that the SIEM can correlate and analyse them uniformly.

DNS tunneling often uses TXT records to encode data, and the packet sizes can be larger than normal DNS queries.

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory (often in SPDX or CycloneDX format) that lists all third-party libraries, their versions, and dependencies. In a regulated environment, this provides the security team with the visibility needed to assess vulnerabilities (e.g., Log4Shell) and ensure compliance with standards like NIST SP 800-53 or FDA cybersecurity guidance. Requesting an SBOM is the standard practice for supply chain risk management.

Isolating affected systems prevents further spread, and disconnecting network shares stops lateral movement. Contacting law enforcement can be done later; paying ransom is not recommended; reimaging may destroy evidence before investigation.

Unauthenticated scans rely on network-visible services and banners, which miss registry-level patch data, OS configuration details, and installed updates. Authenticated scans with least-privilege credentials (e.g., using WMI, WinRM, or the Windows Update API) provide deep visibility into missing patches by querying the actual patch database (e.g., via the Microsoft Update Catalog or WSUS). This directly addresses the security manager's suspicion of missing patch data, making option C the correct choice.

Correlating vulnerabilities with active exploit campaigns and threat intelligence feeds is effective because it prioritizes vulnerabilities that are currently being exploited in the wild, which directly reduces the risk of a breach. This approach aligns remediation with real-world attacker behavior rather than theoretical severity.

Even if the container image has a vulnerability, the Pod Security Policy reduces risk by preventing privilege escalation. The analyst should ensure that the exploit cannot gain additional privileges due to the policy.

Prioritization should consider severity (CVSS), likelihood of exploitation (EPSS), and asset criticality. KEV is not mentioned in the data. Patch complexity and vendor reputation are secondary considerations but not primary factors in this context.

When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.

A is correct because False Positive Rate (FPR) measures the proportion of benign events incorrectly flagged as malicious, directly indicating how much noise the SIEM generates. Reducing FPR is a primary goal when tuning detection rules to minimize analyst fatigue and improve alert fidelity.

A is correct because SBOM (Software Bill of Materials) generation and review provides a detailed inventory of all components in a build, enabling teams to identify and block vulnerable dependencies before release. This aligns with supply chain security best practices, as SBOMs allow automated comparison against vulnerability databases (e.g., NVD) to enforce policy gates early in the pipeline.

Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are the core operational metrics that directly measure the effectiveness and efficiency of an incident response program. For a SOC manager assessing quarter-over-quarter improvement, these metrics provide actionable insight into detection speed, response agility, containment effectiveness, and whether incidents are being fully remediated to prevent repeats.

A compensating control (WAF) may mitigate the risk. The analyst should document it and adjust the risk rating accordingly.

Checking Azure AD logs for the authentication context, reviewing the user's recent activity history, and examining the Key Vault audit logs for any subsequent access are all relevant steps.

T1059.001 is PowerShell, which is commonly used for file downloads. The hunter should create detection rules for PowerShell download cradles.

STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Option D is correct because the immediate priority in a ransomware incident is to contain the threat by isolating the infected workstation from the network to prevent further encryption of file shares. Disabling active sessions to file servers (e.g., using SMB session termination or firewall rules) stops the lateral movement and encryption of shared data. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the spread before any other action.

Software composition analysis (SCA) is the correct control because it specifically scans open-source libraries and their dependencies for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures that vulnerable libraries are identified automatically before the code is deployed, aligning with the shift-left security principle.

Domain Generation Algorithms (DGAs) produce random-looking domain names that change frequently to evade blocklists. This behavior is typical of malware that uses DGA for command and control.

Registry persistence via Run keys is commonly achieved by modifying HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Sigma rules targeting registry add/modify events with that path will detect it.

Option A is correct because stored XSS is confirmed exploitable only when the injected payload (e.g., <script>alert(1)</script>) is persistently stored on the server (e.g., in a database or file) and then rendered and executed in the browser of another user who views the affected page. This demonstrates that the attack can impact victims beyond the tester, proving the vulnerability is not self-inflicted or limited to the attacker's session.

Revealing server version information is a form of information disclosure, which is a security misconfiguration. It is not an injection, broken access control, or cryptographic failure.

Verification ensures that remediation (patch application) was effective. It occurs after the fix is applied.

Checking the parent process of svchost.exe helps identify if it was spawned by a malicious process like a service or scheduled task, indicating compromise.

AV:N means the vulnerability can be exploited over a network, such as the internet, without requiring physical or local access.

SQL injection and Stored XSS are both injection flaws. SQL injection is classic injection, and XSS is also a form of injection.

The alert is a false positive because a single failed login followed by success is normal user behavior and not indicative of malicious activity.

A true positive occurs when an alert correctly identifies malicious activity. The IP is confirmed as a C2 server, so the alert is valid.

Multiple failed logon attempts followed by a single successful logon from the same source IP address is a classic indicator of a password spraying or brute-force attack. The attacker tries many usernames or passwords, and when one succeeds, the pattern shifts from failures to a success. This sequence is a key sign of credential compromise.

Run keys are a common persistence mechanism used by malware to ensure execution at user logon.

Implementing a configuration management baseline and enforcing it (Option A) is the most effective long-term solution because it ensures that the server is consistently provisioned with only the necessary services and configurations. This approach uses tools like Ansible, Puppet, or Chef to automatically remediate drift, preventing unnecessary services from reappearing after manual changes or reboots. It addresses the root cause by codifying the desired state, rather than relying on ad-hoc fixes.

Tactical intelligence (IoCs) is most useful for the SOC team and incident responders who can use them for detection and response. Executives need strategic intelligence, and network engineers need operational intelligence.

Even if the library is not used, it is best practice to rebuild the image with a patched base image to eliminate the vulnerability and ensure compliance.

Privileged containers combined with hostPath mounts can allow container escape, enabling an attacker to gain root access on the host node.

Software Composition Analysis (SCA) is the correct control because it specifically scans open-source libraries for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures vulnerabilities are detected and blocked before the code is deployed, aligning with the 'shift left' security principle. This directly addresses the team's goal of finding vulnerable open-source libraries pre-deployment.

The timeline component of an incident report provides a chronological sequence of events, which is essential for understanding how the incident unfolded.

Option D is correct because a post-incident review must produce actionable improvements to prevent recurrence. Delayed escalation indicates a failure in detection or notification procedures; therefore, specific playbook updates, escalation triggers, owners, and due dates directly address the root cause by refining incident response workflows and ensuring timely escalation in future incidents.

STIX (Structured Threat Information Expression) is a standardized language for describing threat intelligence, and TAXII (Trusted Automated eXchange of Indicator Information) is a transport mechanism. Together, they enable sharing.

CIS Benchmarks define two levels: Level 1 (basic) and Level 2 (comprehensive).

LiME (Linux Memory Extractor) is a loadable kernel module for acquiring volatile memory from Linux systems.

Implementing automated compliance checks using tools like AWS Config ensures that storage configurations are continuously monitored and misconfigurations are flagged or corrected.

AV:N indicates network-based attack vector, meaning the vulnerability can be exploited remotely over the network. The CIA impact ratings are all High, indicating complete compromise of confidentiality, integrity, and availability.

Sigma rules are the correct choice because they are designed as a generic, open-source signature format for log events, making them portable across multiple SIEM platforms (e.g., Splunk, Elastic, QRadar) without vendor lock-in. For suspicious rundll32 execution, a Sigma rule can describe the specific event log patterns (e.g., Event ID 4688 with CommandLine containing 'rundll32.exe') that can be converted into each SIEM's native query language. This portability directly meets the threat hunter's goal of creating a detection that can be reused across different environments.