CompTIA CySA+ CS0-004 (CS0-004) — Questions 76–150

SMB traffic between workstations is a strong lateral movement indicator because in a well-managed environment, peer-to-peer file sharing or remote administration between endpoints is uncommon; most SMB flows are client-to-server (e.g., accessing a domain controller or file server). Attackers commonly use tools like PsExec or WMIC that create SMB connections from one compromised workstation to another to copy malicious payloads, execute remote services, or access shared resources, making this traffic a precise behavioral signature for lateral spread.

Implementing a new firewall rule to explicitly deny all traffic from the identified malicious IP address is a precise and effective containment strategy. This action operates at the network layer, preventing further unauthorized communication without disrupting legitimate business applications or services running on the affected workstation. It directly addresses the source of the observed malicious activity, isolating the threat while maintaining operational continuity.

Sysmon Event ID 1 provides highly granular details about process creation, including the executable's full path, command-line arguments, user context, and critically, the parent process that initiated it. This rich contextual information is invaluable for tracing the execution chain and understanding how a new account might have been created, such as via an unusual script or malicious binary. It allows security analysts to quickly identify the root cause and the specific method used for account creation.

Blocking the command-and-control (C2) IP address at the firewall is a precise and effective containment strategy that minimizes impact on legitimate operations. This action specifically prevents the compromised host from communicating with the attacker's infrastructure, thereby stopping further commands or data exfiltration, while allowing all other legitimate database traffic to continue uninterrupted. This targeted approach ensures business continuity while actively mitigating the threat.

Preparation is the first phase in the NIST SP 800-61 incident response lifecycle, and it occurs before any incident actually happens. It entails building an incident response team, establishing communication plans, deploying necessary tooling (such as SIEM and EDR), creating playbooks, and conducting training and tabletop exercises. Without this pre-emptive groundwork, downstream phases like detection and analysis lack the required procedures and resources, making Preparation the non-negotiable starting point.

Trivy is purpose-built for container scanning.

This comprehensive set of information provides the third-party provider with all necessary factual details to fully understand the incident, its ramifications, and the precise expectations for resolution and future prevention. A clear timeline establishes the sequence of events, service impact quantifies the damage, and concrete evidence supports the claims, ensuring a shared understanding. Specifying required corrective actions and contractual follow-up ensures accountability and aligns remediation efforts directly with service level agreements (SLAs) and legal obligations, facilitating a structured and effective response.

Mean Time to Detect (MTTD) is the correct metric, as it measures the average elapsed time between the initial occurrence of a security incident—such as an intrusion or malware compromise—and the moment it is identified by monitoring tools or security personnel. Shorter MTTD directly reduces attacker dwell time and potential damage. This metric is specifically designed to gauge the speed and effectiveness of an organization's detection capabilities.

Upgrading Apache Struts to the latest patched version is the primary remediation because it replaces the vulnerable code with a release that includes the security fix for the specific CVE. This action directly addresses the root cause of the flaw and eliminates the attack vector for known exploit patterns. Vendor patches are thoroughly tested and are the most reliable way to restore a secure state.

RAM is the most volatile data source because it holds running code, decrypted data, cached credentials, and the current state of the operating system. This information disappears the instant the system loses power or is rebooted, so capturing a memory dump is the highest-priority step. Without it, analysts lose the only copy of in-memory malware behavior and live artifacts.

This option correctly follows the order of volatility for evidence collection in a digital forensics investigation. A 'memory dump' captures the most volatile data, the contents of RAM, which can contain critical artifacts like running processes, open files, and network connections. Subsequently, 'netstat -an' captures active network connections, which are less volatile than RAM but more dynamic than a process list. Finally, 'tasklist' captures the running processes, which are the least volatile of these three dynamic data types, ensuring that the most ephemeral evidence is preserved first.

The EPSS probability score is a data-driven metric from FIRST that estimates the likelihood a vulnerability will be exploited in the wild within 30 days. It is derived from real-world exploit data, CVE attributes, and threat intelligence, making it a strong indicator of active exploitation risk. As a correct prioritization input, it helps security teams focus on vulnerabilities that are most likely to be attacked, rather than just those with high theoretical severity. This is a valid and important factor for risk-based prioritization.

This action is the most effective initial containment strategy. Disconnecting network cables or disabling switch ports immediately prevents further lateral movement of the ransomware to other systems, including critical servers, while keeping the infected workstations powered on. This preserves volatile memory and disk state, which is crucial for forensic analysis to identify the initial infection vector, malware characteristics, and potential exfiltration attempts before remediation.

Scope (S) is a correct base metric in CVSS v3.1, measuring whether a vulnerability in one vulnerable component can impact resources beyond its security scope. A changed scope indicates that exploitation may affect other components, increasing the overall severity. OpenVAS includes Scope in the base vector, so it is a valid base metric.

An overall risk posture summary aggregates findings into a concise, qualitative rating—such as high/medium/low—or a weighted risk score that reflects the organization's relative exposure. This gives management a rapid understanding of whether immediate attention is required and how the current risk compares to prior assessments or industry benchmarks. It directly enables informed, risk-based decisions about prioritizing remediation efforts and allocating resources.

Asset criticality and business context are central to vulnerability prioritization because they determine the potential impact on operations, data confidentiality, and compliance. A critical internet-facing server, for example, represents a higher risk to the organization if compromised, even when the vulnerability's severity is moderate. Contextual factors such as exposure, sensitive data, and required availability turn a generic technical finding into a prioritized business risk.

Placing a legal hold on relevant data is a legally binding directive that suspends all normal deletion, rotation, and destruction policies for potentially relevant information. In a ransomware incident, this preserves logs, endpoint artifacts, and backup copies, ensuring a complete forensic record for litigation or regulatory investigation. Without a legal hold, automated processes such as log rotation or archive purging could destroy evidence, leading to spoliation sanctions and undermining the ability to prove the scope of the breach.

Exposure determines the likelihood of attack, considering whether the asset is internet-facing or reachable by potential adversaries. It directly influences the probability of exploitation, making it a fundamental factor in prioritizing vulnerabilities. Without exposure, even a critical vulnerability on an internal system poses less immediate risk. Therefore, asset exposure is the primary determinant for prioritizing remediation efforts.

Limiting the number of concurrent checks directly controls how many vulnerability tests or network connections the scanner initiates simultaneously against a target system or across the network. This crucial configuration reduces the immediate load placed on the target and the network infrastructure, preventing resource exhaustion. By pacing the scan, it significantly lowers the risk of inadvertently causing a denial-of-service condition or overwhelming critical services, thereby ensuring operational stability during the assessment.

Disabling unnecessary plug-ins prevents the scanner from running checks that are not relevant to the environment, such as Windows-specific tests against Linux hosts. Each plug-in produces findings, and if it probes for software or services that are absent, it can generate false positives based on erroneous banner matches. By tailoring the active plug-in set to the actual asset inventory and exposed services, the analyst reduces meaningless alerts and focuses the scan on likely vulnerabilities. This is a core tuning step that directly reduces false positives while preserving comprehensive coverage.

Creating a detailed timeline of events is a critical component of a post-incident review. This chronological reconstruction helps the team understand the exact sequence of actions taken, when key decisions were made, and the duration of various incident phases. It is essential for identifying delays, missed detection points, and opportunities for earlier containment or eradication, providing a factual basis for subsequent analysis.

GDPR Article 33(1) mandates that a data controller notify the relevant supervisory authority of a personal data breach "without undue delay and, where feasible, not later than 72 hours" after becoming aware of it. This 72-hour window is the exact compliance threshold explicitly written into the regulation, and failing to meet it without documented justification is a violation. The notification must include the nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, and the measures taken or proposed to mitigate harm.

RWX (read-write-execute) memory pages in a process are a high-confidence indicator of injected shellcode because modern operating systems enforce W^X (write XOR execute) policies; legitimate code typically resides in read-only executable regions or uses explicit VirtualProtect transitions. While some Just-In-Time (JIT) engines may briefly allocate RWX, persistent regions outside known JIT heaps warrant immediate investigation.

Normal DNS responses are typically small, often under 512 bytes when using traditional UDP limits. During DNS tunneling, attackers encode exfiltrated data into TXT records or other response fields, causing responses to be several kilobytes or larger. Such unusually large payloads are a direct and strong indicator that DNS is being used to transfer unauthorized data, making this the correct sign of data exfiltration.

A definitive sign of code injection is the presence of an executable memory region that is not backed by an on-disk file. Malicious shellcode is often allocated with VirtualAllocEx and written via WriteProcessMemory, producing a private, executable page that does not map to any section object. Memory forensics tools like Volatility's malfind enumerate the Virtual Address Descriptor (VAD) tree to identify such executable pages without a backing file, making this technique a core method for detecting fileless injection.

The classification level and handling restrictions are paramount because they directly dictate who is authorized to receive the intelligence and what protective measures must be applied. Protocols like the Traffic Light Protocol (TLP) explicitly define these boundaries, ensuring sensitive information is not inadvertently exposed, sources are protected, and legal or ethical obligations are met. Adhering to these restrictions is critical for maintaining trust within intelligence-sharing communities and preventing compromise of sensitive data.

Disabling services and daemons that are not essential for the system's intended function directly reduces the attack surface. Each active service typically listens on specific network ports or exposes APIs, creating potential entry points and increasing the likelihood of discovering exploitable vulnerabilities. By removing these unneeded components, an organization eliminates potential vectors for compromise, adhering to the principle of least functionality.

Modifying the instance's security group to deny all inbound and outbound traffic effectively isolates it from the network. This containment strategy immediately stops any ongoing malicious activity from spreading or exfiltrating data, while crucially preserving the instance's current state, memory, and disk for subsequent forensic analysis. This allows security analysts to investigate the root cause, understand the attack vector, and gather evidence without destroying critical information.

Mean time to detect measures the average duration between when an incident or attack first occurs and when the security team actually becomes aware of it. A lower MTTD indicates stronger monitoring, alerting, and threat-hunting capabilities, allowing the organization to minimize the window in which attackers can operate undetected. It is specifically focused on the detection phase of the incident response lifecycle.

This approach aligns with best-practice vulnerability management by balancing the need for security against operational availability. A compensating control, such as an internal network access control list (ACL) or an updated intrusion prevention system (IPS) signature, reduces the likelihood or impact of exploitation until the patch can be installed during a scheduled maintenance window. This ensures that the system remains functional and that the patch is tested and deployed in a controlled manner, minimizing downtime and the risk of unexpected failures. It is the correct decision because it addresses the vulnerability without disproportionate disruption to the business.

CIS Level 1 benchmarks are meticulously designed to establish a foundational security posture across various systems without significantly disrupting business operations or demanding extensive resources. These basic security configurations focus on essential hardening steps that are broadly applicable and easy to implement, ensuring a robust security baseline can be achieved with minimal risk of system instability or performance degradation. This approach makes them highly practical for widespread adoption.

Cross-site scripting (XSS): XSS is a client-side injection vulnerability where an attacker injects malicious scripts into pages viewed by other users, enabling session hijacking, defacement, or credential theft. Burp Suite is highly effective at detecting XSS because its scanner automatically probes inputs with XSS payloads and its Intercepting Proxy allows manual testing of request/response pairs to confirm sanitization gaps. Since XSS appears in reflected, stored, and DOM-based forms and is pervasive in web applications, it is a classic vulnerability that Burp identifies with high confidence.

Access review documentation is primary audit evidence because it shows a periodic recertification of user entitlements against role definitions, least privilege, and separation of duties. It provides an auditable trail of who reviewed critical systems, what discrepancies were detected, and how they were remediated, directly satisfying access control compliance requirements. Auditors frequently cite missing or outdated access reviews as a material finding, so this documentation is a cornerstone of evidence collection.

YARA rules are highly effective for endpoint detection of a known ransomware strain because they can match on multiple characteristics beyond simple hashes—such as unique strings, mutex names, byte patterns, PE section anomalies, and file metadata. By creating a rule that evaluates file content and structure, the team can identify the malicious payload regardless of filename or hash mutation (e.g., hash-busting variants), enabling rapid triage on forensic images and live systems. This directly addresses the immediate need to recognize the specific ransomware artifacts that were observed during the incident.

Patching is the definitive root-cause remediation because it closes the precise vulnerability (e.g., an unpatched remote code execution flaw in an internet-facing service) that the attacker exploited for initial access. Unlike containment actions, it eliminates the possibility of the same attack vector being reused, even after cleanup or rebuilding. Without applying the patch, any other remediation leaves the underlying weakness exposed, allowing rapid reinfection.

Describing potential financial loss, reputational damage, and regulatory fines directly maps the risk onto the board's fiduciary duties, giving them the essential information needed for risk tolerance and resource allocation. This approach quantifies or estimates impact in the same units executives use to evaluate business decisions, such as ERM frameworks and insurance. It lets the CISO argue for security investment as a business trade-off, which is the only frame that produces meaningful discussion and sign-off.

Immediately isolating the web server is crucial for containment, stopping the active reverse shell and preventing lateral movement. Capturing full disk and memory images preserves all forensic evidence, including the kernel rootkit and attacker activities, for post-incident analysis. Reimaging the server from a trusted source and restoring known clean application data ensures complete eradication of all malicious components and persistence mechanisms, preventing re-infection and ensuring system integrity.

Summarizing the vulnerability in terms of its business risk, potential financial impact, and a recommended mitigation timeline is the most effective communication strategy for management. This approach translates complex technical issues into terms that resonate with their strategic priorities, such as potential revenue loss, regulatory fines, or reputational damage. Providing a clear action plan and timeline empowers them to understand the urgency, allocate necessary resources, and make informed decisions regarding risk acceptance or mitigation.

A registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) is an autostart extension point that launches a specified executable at user logon. Malware frequently adds entries here to achieve persistence, ensuring the malicious code runs on every subsequent login. Sandbox analysis treats this as high-risk because legitimate programs rarely modify such keys during a single execution, especially with randomly named or masqueraded values.

CVSS v3 (Common Vulnerability Scoring System version 3) is the industry standard for assessing the severity of software vulnerabilities. It provides a quantitative score from 0 to 10, derived from metrics evaluating exploitability, impact, and temporal and environmental factors. This comprehensive scoring allows organizations to prioritize vulnerabilities effectively based on their potential risk and ease of exploitation, directly addressing the need for a prioritization mechanism.

Blocking the phishing domain at the email gateway is immediate containment because it prevents subsequent emails carrying the same malicious payload from reaching other recipients, thereby reducing the number of users exposed to the lure. This email gateway control is fast, reversible, and can also block outbound traffic if needed, but it does not remediate credentials that have already been stolen.

Scheduled tasks allow the operating system to launch specified commands or executables on triggers such as system startup, user logon, or defined intervals. Attackers frequently create scheduled tasks that re-download or re-execute malicious payloads, and these tasks persist across reboots by being stored in the Task Scheduler database. Osquery can enumerate them through the scheduled_tasks table, revealing the task name, path, and schedule, which helps identify malicious creations with autorun capabilities.

User and Entity Behavior Analytics (UEBA) is specifically engineered to detect anomalous activities by establishing baselines of normal behavior for users and other entities within an organization's IT environment. It employs machine learning algorithms and statistical analysis to identify deviations from these baselines, such as unusual login times, access to sensitive data, or data exfiltration attempts, which often indicate compromised accounts or insider threats. This makes UEBA the ideal technology for proactive detection of behavioral anomalies.

OAuth consent abuse can persist without password access; revoking grants and scoping exposure contains the incident. In detection and analysis, responders need action that reduces risk while preserving the investigation record.

Network isolation immediately severs all communication pathways for the compromised workstation. This critical containment step prevents the malware from exfiltrating data, receiving further command and control (C2) instructions, or attempting lateral movement to other internal systems. It effectively quarantines the threat, buying crucial time for incident responders to analyze the payload and plan remediation without further risk to the broader network.

Scheduling the patch during the next maintenance window represents the best practice for addressing high-severity vulnerabilities in production environments. This approach allows for proper change management, including testing the patch in a non-production environment, planning for potential rollbacks, and communicating downtime to stakeholders. It effectively balances the need for security remediation with the critical requirement for system availability and operational stability, minimizing unplanned service disruptions.

Vulnerability scan reports are the primary evidence that an organization is actively discovering weaknesses, as they contain the scan timestamp, authenticated or unauthenticated scan type, CVEs, and CVSS severity scores. They allow auditors to correlate the identified vulnerabilities against the organization's asset inventory and check that coverage includes critical systems. A series of scan reports demonstrates the continuous, recurring nature of the program, which is a core requirement of many compliance frameworks.

The General Data Protection Regulation (GDPR), specifically Article 33, explicitly mandates that organizations must notify the relevant supervisory authority of a personal data breach "without undue delay and, where feasible, not later than 72 hours after having become aware of it." This precise timeframe is crucial for enabling authorities to promptly assess the breach's impact and for organizations to initiate appropriate mitigation actions and fulfill their accountability obligations.

Quantifying the unpatched vulnerability in terms of potential financial loss—such as breach response costs, regulatory fines, or lost revenue from downtime—and reputational damage, like customer churn or erosion of brand trust, directly aligns the technical risk with the board's fiduciary responsibilities. This translation reassures executives that their decision allocates resources to protect shareholder value and market standing, not just IT infrastructure.

This is a core preparation activity that ensures the team is ready to respond.

GDPR Article 33(1) sets a hard, maximum deadline of 72 hours after the controller becomes aware of a personal data breach for notifying the supervisory authority, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. The obligation is phrased as 'without undue delay and, where feasible, not later than 72 hours,' meaning 72 hours is the outer statutory limit, not a target. If notification is made after 72 hours, the controller must provide the reasons for the delay under Article 33(5). Thus, 72 hours is the correct and canonical compliance reporting requirement.

Mean time to detect (MTTD) is the average elapsed time between the actual occurrence of a security incident or malicious activity and the moment it is recognized or flagged as suspicious by telemetry, analytics, or an analyst. It is the definitive metric for measuring detection velocity, because it captures the so-called "dwell time" before discovery, where the adversary may be operating unnoticed. Lower MTTD directly reduces the opportunity for attackers to achieve their objectives by limiting the window of undetected access.

Capturing and analyzing the network traffic between the EMR server and the external IP address is the most effective immediate step. This action allows security analysts to perform deep packet inspection, revealing the protocols, data payloads, and true intent of the communication. This critical evidence determines whether data exfiltration is occurring, what specific data is being sent, and if the connection is malicious or benign, enabling an informed and targeted response without premature disruption.

LiME is designed for Linux memory acquisition and minimizes interference with the running system.

This is the correct action because the scanner has mistakenly identified a web application running on port 3307 as a MySQL database, leading to a false positive vulnerability report. Marking it as a false positive and suppressing it for this asset ensures that security teams are not distracted by irrelevant alerts, allowing them to focus on genuine threats and maintain an accurate vulnerability posture.

Direct protocol validation determines whether TLS 1.0 is actually accepted.

hostPath mounts allow container access to host filesystem.

CIS Benchmarks define Level 1 as the core set of security configurations that can be implemented without significantly degrading system functionality or causing incompatibility, making them suitable for most environments. Level 2 extends these settings with more aggressive hardening, such as disabling legacy protocols or tightening file permissions, which may reduce performance, break existing workflows, or require additional operational overhead. This performance-versus-restriction trade-off is the intended distinction.

This metric offers a high-level, aggregated view of the organization's current security health, synthesizing various underlying security controls and vulnerabilities into a single, comprehensible score. Presenting this score with a trend over time allows executives to quickly grasp whether security efforts are improving or deteriorating, enabling strategic resource allocation and risk management decisions aligned with business objectives. It directly addresses the strategic need for understanding enterprise-wide risk.

For a board of directors, information regarding the financial impact, potential reputational damage, and regulatory penalties is paramount because these directly relate to their fiduciary duties and the long-term strategic health of the organization. Understanding the monetary losses, the erosion of public trust, and the legal ramifications enables the board to assess the overall business risk effectively. This critical information guides their strategic decisions on resource allocation, risk mitigation strategies, and governance improvements to protect shareholder value and ensure compliance.

Maintaining a complete chain of custody form is essential because it documents every interaction with the evidence — who collected it, when, where, and how it was handled, transferred, and secured. In court, opposing counsel will attack a gap in this record as evidence tampering or mishandling. A continuous, written log of all actions taken during acquisition and analysis preserves the integrity narrative and is what makes the forensic evidence legally admissible.

The creation of a scheduled task is a strong behavioral Indicator of Compromise (IOC) because it represents a common and critical persistence mechanism for malware. This action leaves distinct and observable artifacts within the operating system, such as registry entries or file system changes, which are consistent across different malware variants and environments. Detecting this behavior provides a robust and enduring method for identifying compromise.

Mean Time to Respond (MTTR) quantifies how quickly a SOC team takes action to contain an incident after detection. It typically measures the interval between alert triage and the first mitigation step (e.g., isolating a host, blocking a C2 domain), directly reflecting the team's readiness and playbook efficiency. Lower MTTR indicates faster containment, which reduces the attacker's dwell time and prevents lateral movement.

Validating the incident is the crucial initial step in the detection and analysis phase. This involves corroborating the initial alert by reviewing additional data sources such as logs from firewalls, intrusion detection systems, endpoint detection and response (EDR) tools, and network flow data. This process helps to confirm if the alert represents a true security incident, thereby minimizing false positives and preventing the premature allocation of valuable incident response resources to non-threats.

AWS CloudTrail is the native governance, compliance, and audit service that records every API call made within an AWS account. It captures essential details such as the identity of the requester, source IP address, request parameters, and response elements, enabling a comprehensive history of user and service activity. For a security analyst investigating unusual API actions, CloudTrail is the primary source of truth because it delivers the complete, tamper-evident audit log required to trace who did what and when.

Disconnecting the workstation from the network is the most immediate and effective short-term containment action for an active ransomware infection. This action physically isolates the compromised system, preventing the ransomware from communicating with command-and-control servers, exfiltrating data, or attempting to spread laterally to other network resources, shares, or systems. It buys critical time for incident responders to analyze the threat and plan further remediation steps without risking wider network compromise, thus limiting the overall impact of the incident.

Disconnecting the network cable immediately isolates the compromised server from the network, preventing further malicious activity such as data exfiltration, lateral movement, or command-and-control communication. This crucial containment step preserves the current volatile system state for subsequent forensic acquisition without introducing significant changes, allowing for a more accurate investigation.

Configuration drift is the gradual and often unnoticed deviation of a system's current configuration from its intended, documented baseline. It results from incremental changes such as manual edits, emergency fixes, unpatchable workarounds, or inconsistent patch deployments that accumulate over time without change-control approval. This divergence can lead to security weaknesses, compliance violations, and unpredictable behavior, making it a central concern for configuration management.

A timeline is a chronological, time-stamped listing of events, actions, observations, and findings that occurred during an incident. It is a foundational component of incident documentation because it establishes the order and timing of events, supporting correlation of security events and response actions. In an incident report, the section 'detailing the sequence' directly maps to the timeline's purpose of recording events in sequence.

Control-plane attacks are best investigated through authoritative audit events that record who changed identity and access configuration.