CompTIA CySA+ CS0-004 (CS0-004) — Questions 151–225

By implementing a baseline of authorized parent-child process relationships or whitelisting known-good command-line arguments, analysts can significantly suppress benign positive alerts. This targeted tuning preserves the SIEM's ability to detect anomalous or unauthorized executions of the binary while minimizing alert fatigue.

Examining the Portable Executable (PE) header and its Import Address Table (IAT) is a fundamental static analysis technique that reveals the specific dynamic-link libraries (DLLs) and functions the executable requests from the operating system. This structural analysis allows the analyst to infer the program's intended capabilities, such as network communication or registry modification, without executing the code.

Chain of custody documentation is critical because it creates a verifiable, chronological record of every person who handled the evidence, along with the time, purpose, and condition of each transfer. In a forensic investigation, this paper trail ensures legal admissibility; if the chain is unbroken, the court can trust that the evidence has not been tampered with or substituted. Without proper documentation, even a technically perfect disk image could be ruled inadmissible, undermining the entire investigation.

This is the correct approach because DAST tools can be configured to simulate a legitimate user's interaction by logging in with a dedicated test account. By properly managing session tokens or cookies, the scanner gains access to protected areas of the application, allowing it to thoroughly test functionality behind authentication. This method ensures comprehensive coverage of the entire application, including pages requiring login, thereby identifying vulnerabilities that would otherwise remain hidden.

The Exploit Prediction Scoring System (EPSS) estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This data-driven metric allows analysts to prioritize high-probability threats immediately and decide whether to deploy rapid patches or implement temporary compensating controls.

Applying an isolation security group with no inbound or outbound rules immediately cuts off network communication at the hypervisor level. This effectively contains the threat and prevents further data exfiltration or command-and-control traffic while preserving the volatile memory and disk state of the EC2 instance for forensic analysis.

DNS tunneling abuses the DNS protocol by encoding non-DNS traffic, such as SSH or HTTP payloads, into the subdomains of queries sent to an attacker-controlled authoritative name server. The combination of high-volume, large-sized TXT or CNAME queries containing randomized subdomains directed to a consistent IP address is a classic signature of this exfiltration technique.

Root cause analysis identifies the fundamental underlying reason for the security incident, such as an unpatched vulnerability, misconfigured firewall rule, or successful phishing campaign. For an incident report, establishing the root cause is critical because it guides remediation efforts and prevents recurrence, and it satisfies regulatory and stakeholder requirements for understanding why the incident occurred. Without a root cause, the report is merely descriptive, not prescriptive.

An unauthenticated critical vulnerability on an internet-facing VPN appliance represents an extremely high-risk exposure, demanding immediate attention. This scenario indicates a direct path for attackers to gain unauthorized access to the internal network without needing credentials, making it a prime target for active exploitation. Prioritizing this remediation is crucial because its internet exposure and critical impact far outweigh other findings, necessitating an emergency patch or mitigation to remove the threat immediately.

This is a concrete, actionable recommendation that directly addresses a common attack vector used in ransomware incidents, such as compromised VPN credentials. It specifies the control (MFA), the scope (remote access), and the goal (risk reduction), making it a proper lesson learned. Unlike observations or causes, it provides a clear implementation step that stakeholders can act on to harden their environment.

AV:L confines the attacker to the local system, AC:H means conditions outside the attacker's control must align, PR:H demands administrative-level privileges beforehand, and UI:R requires a user to interact, matching every clause of this option exactly.

Escalating the matter to the company's legal department is the most appropriate action because legal counsel is responsible for ensuring compliance with all applicable laws and regulations, including data protection mandates. This allows the legal team to assess the risk of non-compliance and advise on the correct course of action, potentially overriding the CISO's decision while respecting internal authority structures. It ensures the organization acts within legal boundaries.

A Configuration Management Database (CMDB) integrated with business service mapping allows security teams to trace a physical or virtual asset directly to the critical business processes it supports. This visibility ensures that a vulnerability on a seemingly minor server is prioritized correctly if that server hosts a dependency for a revenue-generating application.

Containment status directly satisfies the CISO's need for situational awareness during active containment, showing what isolation or blocking steps are done versus outstanding. This prevents leadership assuming the threat is fully contained when gaps remain, enabling informed decisions on resource allocation and escalation while response continues.

Scheduled tasks are a native Windows mechanism that can trigger a binary or script when a user logs on, at system startup, or at regular intervals. Attackers routinely create named or hidden tasks to rerun malware or maintain command-and-control, and these tasks survive a reboot (unless disabled). Because the task description, action, triggers, and run-as user are all stored in the Task Scheduler database, examining it with Velociraptor can reveal suspicious persistence. This makes scheduled tasks an essential artifact in any threat hunt.

Scheduling the firmware upgrade during an established maintenance window is the best practice because it balances security remediation with operational continuity. Firmware updates modify low-level hardware instructions and almost always require a system reboot, which causes temporary downtime. Planning this during a scheduled window minimizes business disruption while ensuring the vulnerability is permanently resolved.

Capturing a memory dump is the critical next step after isolating a host because it preserves volatile data residing in RAM. This data, which includes running processes, network connections, open files, and potentially malware artifacts, would be lost upon system shutdown or reboot. Analyzing a memory dump provides invaluable forensic evidence for understanding the attacker's activities and the extent of the compromise without altering the live system state.

AWS GuardDuty is a continuous security monitoring service that actively analyzes CloudTrail management events, VPC flow logs, and DNS query logs using threat intelligence and machine learning. It is specifically engineered to detect anomalous API operations, credential compromise, and malicious activity within an AWS environment, generating actionable security findings.

The Incident Response Plan (IRP) provides a structured approach for an organization to prepare for, detect, contain, eradicate, recover from, and post-incident review security incidents. While an IRP will include steps for notifying relevant parties and escalating issues, its core focus is on the technical and procedural actions required to mitigate the incident itself. It details the technical steps for analysis and remediation, rather than the overarching strategic framework for stakeholder communication.

Without proper credentials, a vulnerability scanner performs unauthenticated scans, relying on network-level probes and banner grabbing. This method often leads to false positives because it cannot log into the target system to verify actual patch levels, installed software versions, or configuration files. For example, a service banner might display an older version string even if the underlying software has been patched or backported, causing the scanner to incorrectly flag a vulnerability as "Confirmed" on a secure system.

Trivy is a highly specialized, open-source vulnerability and misconfiguration scanner designed specifically for containers and other cloud-native targets. It excels at scanning container images, Git repositories, and Kubernetes configurations to detect OS package vulnerabilities and application dependency flaws directly within CI/CD pipelines.

GDPR Article 34 mandates that data controllers must notify affected data subjects without undue delay when a personal data breach is likely to result in a high risk to their rights and freedoms. This direct communication enables individuals to take necessary precautions to mitigate potential harm, such as identity theft or financial fraud. The 'without undue delay' clause emphasizes the urgency of informing those directly impacted by the breach.

The Exploit Prediction Scoring System (EPSS) is a data-driven model that estimates the probability, ranging from 0 to 1, that a software vulnerability will be exploited in the wild within the next 30 days. By combining real-world threat intelligence with machine learning, EPSS allows security analysts to prioritize remediation efforts based on actual threat likelihood rather than theoretical severity alone.

Access review reports are a direct artifact of an identity governance process, showing that the organization periodically re-certifies user entitlements against current roles and business need. Because the reports are generated from actual access decisions and reviews, they demonstrate that the access-control control is operating as intended, which is exactly the type of evidence a compliance auditor expects to see.

This behavior represents the definitive, high-fidelity signature of ransomware during dynamic analysis. The rapid opening, cryptographic overwriting of user data, appending of a unique file extension, and subsequent creation of a text or HTML ransom note uniquely identify the payload's destructive intent to extort the victim.

Segmenting scans by operating system allows the analyst to apply targeted credentials, which enables deep, authenticated configuration audits without generating excessive network noise. Implementing distinct scan windows and performance tuning prevents resource exhaustion on production servers and ensures that workstation scans do not disrupt business operations.

Isolating the domain controller by disabling its network interface is the immediate priority in a suspected compromise. This action effectively contains the threat, preventing the attacker from further lateral movement, exfiltrating data, or causing additional damage across the network. Crucially, it preserves the system's current volatile state and disk evidence for subsequent forensic analysis, allowing investigators to understand the attack vector and scope. This containment strategy is a fundamental step in the incident response lifecycle.

A contact list and escalation matrix is a critical incident response document that explicitly outlines key personnel, their contact information, and the hierarchical path for decision-making and approvals. This matrix clearly defines who needs to be informed and, crucially, who possesses the authority to approve specific actions or communications at each stage of an incident. It directly addresses the problem of unknown approval authority by providing a structured, actionable guide for incident responders.

Preparation is the foundational phase of the NIST incident response lifecycle that occurs before any security event begins. It involves establishing incident response capabilities, drafting playbooks, training personnel, securing communication channels, and deploying defensive tools. Implementing the incident response plan itself is a core component of this proactive readiness phase.

Post-incident reviews (PIRs) often highlight breakdowns in coordination and reporting. Updating the incident response plan (IRP) to explicitly detail communication protocols, designated channels (such as out-of-band messaging), and escalation matrices directly addresses these organizational bottlenecks. This ensures that future incidents are handled with clear lines of authority and minimal delay.

This is the most plausible explanation for a re-infection following a successful restoration from a clean backup. After a system is restored, it often operates in a vulnerable state, potentially with reduced network connectivity or security controls temporarily relaxed for validation. An employee inserting an infected USB drive directly into the server or a connected workstation provides a direct, physical vector for malware re-introduction, bypassing network perimeter defenses that might have been re-established. This action re-establishes the infection chain.

Active incidents require immediate, synchronous communication to coordinate containment efforts and share threat intelligence rapidly. Utilizing out-of-band, pre-established secure channels (such as encrypted chat or direct phone lines) ensures that the escalation is received instantly by the correct personnel without alerting the adversary who may be monitoring the primary network.

Presenting the comprehensive risk assessment data, including the identified threats, vulnerabilities, likelihood, and impact, alongside a detailed cost-benefit analysis for various treatment options, is the most effective approach. This allows stakeholders, including the system owner, to make an informed, data-driven decision regarding risk acceptance, ensuring transparency and alignment with business objectives. It facilitates a collaborative understanding of why acceptance is the appropriate strategy, based on objective facts rather than subjective opinions.

This is a true positive because the execution represents a classic Living off the Land (LotL) attack where a legitimate system binary (powershell.exe) is leveraged to bypass security controls. The parent-child relationship of svchost.exe spawning PowerShell with encoded arguments is a highly reliable indicator of compromise (IoC) pointing to privilege escalation or lateral movement.

DAST needs valid authentication and session management to test protected functionality.

Persistent SLA breaches usually stem from underlying operational bottlenecks rather than simple negligence. Investigating who owns the system, whether the team has adequate staff and tools, and if restrictive maintenance windows prevent timely patching allows security analysts to identify and resolve the root causes of remediation delays.

For rundll32.exe, the command-line arguments are paramount for distinguishing legitimate system operations from malicious activity. Attackers frequently leverage rundll32.exe to execute arbitrary DLLs, often from unusual or temporary paths, or even to initiate network connections to command-and-control (C2) servers via embedded URLs. Detecting these anomalous patterns within the command line is a high-fidelity indicator of compromise, as it directly reveals the attacker's intended payload or communication channel. This approach effectively identifies abuse of a legitimate binary.

Computing a one-way cryptographic hash (such as SHA-256) of the original drive before acquisition and of the forensic image after, then comparing the two digests, is the definitive test that the image is a bit-for-bit clone with no changes introduced during capture. A matching hash validates the image for court admissibility and provides a baseline for later re-verification as part of the chain of custody.

The potential business impact of an incident drives its priority because the goal of incident management is to minimize harm to the organization. Impact includes financial loss, operational disruption, regulatory fines, reputational damage, and customer trust. A high-impact incident, such as a ransomware attack on a core revenue system, necessitates immediate escalation regardless of other factors.

SLA compliance by severity, asset owner, and business unit directly evidences whether critical findings were remediated inside policy timelines, and its grouping by owner and unit gives the SOC manager the accountability view they need.

YARA is primarily a pattern-matching tool designed to identify malware families based on textual or hexadecimal patterns. Defining unique strings, such as specific registry keys, user-agent strings, or unique function names within the rule's string section, allows the engine to reliably flag files belonging to that specific malware family.

The immediate priority is to restrict public access to the storage bucket, effectively containing the data exposure and preventing further unauthorized access. Following containment, it is crucial to conduct a thorough investigation to determine if sensitive data was present in the bucket and whether it was accessed or exfiltrated during the period of public exposure. This two-pronged approach aligns with incident response best practices, focusing on mitigation and subsequent impact assessment.

Data exfiltration involves the unauthorized transfer of sensitive information from an internal network to an external, attacker-controlled destination. In NetFlow analysis, this is typically flagged by an anomalous, large-volume outbound connection (north-south traffic) originating from an internal host to an unfamiliar external IP address, especially outside of normal business hours.

Outbound traffic to IP addresses matching known command-and-control infrastructure is a direct indicator that a compromised host is actively communicating with attacker-controlled systems, which is frequently the channel used to receive further instructions or stage stolen data before it leaves the network, making C2 IP matches a high-confidence exfiltration signal when correlated with threat intelligence feeds.

An escalation contact list is a foundational element of an incident communication plan, defining the specific internal and external stakeholders to notify as an incident's severity or impact increases. It establishes clear lines of authority, contact methods, and backup personnel to prevent communication bottlenecks during high-pressure response phases.

Modern vulnerability management relies on risk-based prioritization, which integrates threat intelligence, asset value, and vulnerability severity. EPSS provides a dynamic, data-driven estimate of exploit probability in the wild, which helps analysts filter out thousands of vulnerabilities that are unlikely to ever be leveraged. When combined with CVSS severity and internal asset criticality, EPSS enables security teams to allocate remediation resources to the highest-risk areas first.

Containers are designed to be immutable, meaning that patching a running instance directly is a major operational anti-pattern. The correct remediation workflow requires updating the Dockerfile or base image to a secure version, rebuilding the container image, and redeploying it to eliminate the vulnerabilities at their source.

Running a container in privileged mode grants it nearly all capabilities of the host's root user, disabling Linux namespaces and cgroups protections. When paired with a hostPath mount, an attacker can easily escape the container boundaries, access the host's sensitive system files, and execute arbitrary commands with root privileges on the underlying node.

Authenticated scanning gives the scanner access to installed software and patch state, improving accuracy.

Disabling the network interface card (NIC) via software, such as through the operating system's network settings or command-line tools, immediately severs the system's network connectivity. This action effectively contains the threat by preventing further propagation or data exfiltration while preserving the system's volatile memory and disk state for subsequent forensic analysis. It is a controlled and reversible method for initial containment.

Implementing a new firewall rule to explicitly deny all traffic from the identified malicious IP address is a precise and effective containment strategy. This action operates at the network layer, preventing further unauthorized communication without disrupting legitimate business applications or services running on the affected workstation. It directly addresses the source of the observed malicious activity, isolating the threat while maintaining operational continuity.

Sysmon Event ID 1 provides highly granular details about process creation, including the executable's full path, command-line arguments, user context, and critically, the parent process that initiated it. This rich contextual information is invaluable for tracing the execution chain and understanding how a new account might have been created, such as via an unusual script or malicious binary. It allows security analysts to quickly identify the root cause and the specific method used for account creation.

Correct. A defensible risk acceptance record requires compensating controls that reduce residual risk, a documented business justification explaining why remediation is deferred, and an expiration or review date so the acceptance does not persist indefinitely without reassessment.

When a permanent patch cannot be immediately deployed, implementing compensating controls—such as restricting network access via firewall rules or enabling specific intrusion prevention signatures—actively reduces the risk of exploitation. Documenting this risk and the associated temporary mitigations ensures compliance, maintains operational visibility, and establishes a clear path toward eventual remediation.

Conducting a root cause analysis (RCA) is the critical post-incident activity required to pinpoint the exact initial infection vector, such as a phishing email, compromised credential, or unpatched edge device. Identifying this entry point allows the incident response team to implement targeted, permanent security controls to prevent the same exploit from being used in future attacks.

During the eradication phase of incident response, the primary objective is to eliminate the root components of the threat. Patching or closing the exploited vulnerability must occur before system restoration to prevent attackers from immediately re-entering the network. This ensures the environment is secure before returning to normal operations.

The UI:N metric stands for User Interaction: None, which explicitly confirms that the vulnerability can be exploited without any active participation or assistance from a local user. This means the attack can be executed entirely out-of-band and automatically, making it highly dangerous compared to vulnerabilities requiring social engineering or user actions like clicking a link.

A CISO operates at the executive level and must translate technical vulnerabilities into business risk to allocate resources and make strategic decisions. An executive dashboard that quantifies the vulnerability in terms of potential financial loss, operational downtime, and regulatory non-compliance penalties provides the exact high-level business context required for executive leadership.

This scenario represents a false positive because the SIEM generated an alert for a standard, benign user login. The detection rule incorrectly flagged normal, authorized workstation access as a potential security incident, requiring analysts to investigate and tune the rule to reduce noise.

To verify the integrity of a forensic acquisition, the analyst must calculate a cryptographic hash (such as MD5, SHA-1, or SHA-256) of both the source media and the destination image. Matching hash values mathematically prove that no data was altered, added, or lost during the imaging process, establishing a verifiable chain of custody.

Blocking the command-and-control (C2) IP address at the firewall is a precise and effective containment strategy that minimizes impact on legitimate operations. This action specifically prevents the compromised host from communicating with the attacker's infrastructure, thereby stopping further commands or data exfiltration, while allowing all other legitimate database traffic to continue uninterrupted. This targeted approach ensures business continuity while actively mitigating the threat.

SQL injection lets an attacker insert untrusted input into a database query so it is executed as code rather than data, which is the exact definition of the OWASP Injection category and explains the payload and error message in the output.

DNS query logs record every domain resolution request made by internal hosts, capturing the specific high-entropy, randomized domain names characteristic of Domain Generation Algorithms (DGAs). Analyzing these logs allows security analysts to detect anomalous NXDOMAIN spikes and identify compromised systems attempting to contact dynamic command-and-control servers.

During dynamic analysis in a sandbox, observing a malware sample attempt to establish outbound connections to specific external IP addresses provides critical network indicators. These IP addresses serve as network-based indicators of compromise (IOCs) that security analysts can use to configure firewalls, intrusion detection systems, and blocklists to prevent further communication with command-and-control (C2) servers.

SLA compliance by severity, asset owner and business unit directly evidences whether critical findings were remediated inside policy timelines, satisfying the programme's reporting goal. Grouping by owner and business unit also gives legal and privacy stakeholders accountability context without exposing raw vulnerability detail.

Examining pod specification fields like 'privileged: true', 'hostPath', and 'hostNetwork' is critical because these parameters allow containers to bypass isolation boundaries. If a compromised service account deploys a pod with these configurations, it can access the underlying host node's filesystem, network namespace, and devices, potentially leading to a full cluster takeover. Security teams must scrutinize these fields to detect container escape attempts and privilege escalation.

Preparation is the first phase in the NIST SP 800-61 incident response lifecycle, and it occurs before any incident actually happens. It entails building an incident response team, establishing communication plans, deploying necessary tooling (such as SIEM and EDR), creating playbooks, and conducting training and tabletop exercises. Without this pre-emptive groundwork, downstream phases like detection and analysis lack the required procedures and resources, making Preparation the non-negotiable starting point.

Script Block Logging (Event ID 4104) records the actual PowerShell code executed, so loading the ActiveDirectory module and running its cmdlets is captured verbatim. This satisfies the hypothesis by surfacing AD reconnaissance commands that module-loading events alone would miss.

Mean time to detect (MTTD) measures the duration between the initial security compromise and the moment security analysts identify the threat. Minimizing this metric is crucial because reducing dwell time directly limits an attacker's lateral movement and data exfiltration opportunities. By prioritizing MTTD, the organization can initiate containment protocols much earlier in the attack lifecycle, significantly mitigating overall business impact.

The CIS Level 1 Benchmark is designed to deliver a basic, essential security posture that can be rapidly implemented across systems with minimal disruption to business operations. It focuses on disabling unnecessary services, configuring basic logging, and enforcing standard access controls without breaking application functionality. This makes it the ideal starting point for general enterprise configuration management.

This approach is correct because it reframes a purely technical finding in terms executives already use to make decisions: revenue at risk, reputational damage from lost customer trust, and quantifiable regulatory fines. Framing risk this way lets leadership weigh remediation cost against concrete business consequences instead of abstract technical severity.

A documented risk acceptance with a named owner, business justification, expiry date and compensating controls keeps the delayed patch defensible. This satisfies the stakeholder-management requirement by evidencing informed, time-bound approval rather than an undocumented decision to breach the contractual deadline.

Implementing a default deny (or implicit deny) rule at the end of the firewall policy ensures that any traffic not explicitly permitted by a preceding rule is dropped. This foundational security posture prevents unauthorized inbound connections and restricts rogue outbound communications, significantly reducing the success of command-and-control (C2) channels.

An SBOM lists software components and versions, supporting dependency risk analysis.