CompTIA CySA+ CS0-004 (CS0-004) — Questions 151–225

Executive leadership is the primary audience for strategic intelligence because it informs high-level decisions about risk tolerance, resource allocation, and business continuity. This type of intelligence is written in non-technical language, summarizing geopolitical threats, industry-level trends, and potential impacts to the enterprise in a way that supports governance and investment choices. It helps the C-suite align cybersecurity with organizational objectives, not with day-to-day tactics.

When assessing a critical vulnerability, the asset's value and its criticality to business operations are paramount. This factor directly determines the potential impact of a successful exploit, which is a core component of risk calculation (Risk = Threat x Vulnerability x Impact). A critical vulnerability on a low-value, non-essential asset poses less overall risk than the same vulnerability on a high-value, mission-critical system, dictating immediate prioritization.

This option is correct because the policy contains an explicit Deny statement for all s3:* actions, which lacks any limiting conditions such as aws:SourceIp. According to AWS IAM policy evaluation logic, an explicit Deny always overrides any explicit Allow statements. Consequently, all S3 actions are denied for all principals, regardless of their source IP address, effectively nullifying any Allow rules.

A spike in outbound traffic from a server is inherently suspicious, necessitating immediate investigation. Querying threat intelligence platforms (TIPs) or open-source intelligence (OSINT) feeds with the destination IPs is a crucial initial step in incident response. This action quickly correlates observed indicators of compromise (IOCs) with known malicious infrastructure, such as command-and-control (C2) servers, botnet nodes, or phishing sites. This provides immediate context on the potential threat actor or malware family involved, allowing the analyst to rapidly assess the severity and nature of the incident without disrupting operations.

The executive summary is the most critical section for management because it distills the entire vulnerability assessment into a concise, high-level overview of the organization's risk posture. It should highlight the total number of vulnerabilities, the most severe threats, and the recommended strategic actions without overwhelming readers with technical CVSS vectors or exploit details. Management needs this to make informed decisions on resource allocation and risk acceptance, making it a mandatory component of any vulnerability report.

Container runtime events, such as those from an agent like Falco or eBPF, directly monitor process execution, file system access, and system calls within the container, immediately flagging an unexpected shell or host mount. Kubernetes audit logs capture API server requests, revealing if the container's configuration was modified or if a privileged pod was created, indicating orchestration-level compromise. Network flow from the pod provides crucial visibility into any attempted exfiltration or command-and-control communication initiated by the compromised container, completing the forensic picture. Together, these telemetry sources offer comprehensive detection and context for container escape attempts.

Patch SLA compliance percentage directly measures whether systems are being patched within the timeframes the organization has committed to, for example critical patches within 14 days, which is precisely what a management-facing compliance dashboard needs to show for the patch management program. It ties directly to the process being audited rather than to an adjacent security function.

WHOIS queries domain registration databases, returning registrar, registrant contact, creation and expiration dates, and nameserver records. For an IOC like a known malicious domain, WHOIS enables analysts to pivot on registration metadata, identify shared infrastructure, or detect typosquatting and recently registered domains. It is a read-only lookup service, not a traffic analysis tool, making it a first-line passive enrichment source.

Endpoint Detection and Response (EDR) telemetry provides granular, real-time visibility into system activities, including process execution, file modifications, registry changes, and network connections, often stored off-host in a centralized repository. This rich dataset is crucial for forensic analysis as it allows investigators to reconstruct the attack timeline, identify initial access vectors, track lateral movement, and pinpoint malicious binaries or scripts. EDR's continuous monitoring capabilities ensure that even ephemeral attacker actions are captured and available for post-incident investigation.

This is the correct YARA rule syntax. It defines a rule named detect_malware, declares a string identifier $a assigned to the literal byte sequence "evil" inside the strings section, and then uses that identifier as the condition. The condition $a evaluates to true if the string 'evil' is found anywhere in the scanned file. YARA requires a dollar-sign prefix for string identifiers, an equals sign to bind the literal value, and a condition that references the identifier without quotes or further assignment. This rule compiles and will trigger a match when the file contains the specified string.

Leveraging an established incident response playbook template for report drafting is a highly effective strategy, especially under time constraints. This approach ensures that critical information fields are addressed systematically, even if initial data is incomplete, and allows for the immediate documentation of known facts, timelines, and current status. By explicitly noting information gaps, the report remains transparent about its current state, facilitates timely communication to stakeholders, and provides a structured framework for subsequent updates and refinements as recovery progresses.

The A component of the CVSS v3.1 vector is H, which is the Availability Impact metric and indicates that the exploit can cause a total loss of availability, such as a denial of service. Unlike the C and I metrics, which are both N, the A metric is the only one rated high, so this option correctly identifies the finding's high impact on availability.

Network segmentation logically divides a network into smaller, isolated subnets, significantly limiting direct communication paths between different security zones. When combined with strict firewall rules that enforce a "deny by default" policy and only permit explicitly authorized traffic, this architecture severely restricts an attacker's ability to move laterally from a compromised host in one segment to other critical systems in different segments, thereby containing breaches and hindering further compromise.

Attack Vector (AV) is a base metric that describes the context by which a vulnerability can be exploited, such as network, adjacent, local, or physical. This metric directly influences the CVSS exploitability subscore and is fundamental because it determines the remote vs. local nature of the attack. A network attack vector is typically the most severe because it allows exploitation from anywhere on the internet without prior access.

Mean Time To Detect (MTTD) and Mean Time To Respond (MTTR) are crucial operational metrics that directly quantify the efficiency and effectiveness of a security program's incident management lifecycle. MTTD measures the speed at which threats are identified, reflecting the efficacy of monitoring and alerting systems. MTTR assesses the swiftness of containment, eradication, and recovery efforts, indicating the incident response team's proficiency in neutralizing threats and minimizing their impact.

72 hours is the correct timeframe under GDPR Article 33(1), which states that a data breach notification must be made to the competent supervisory authority 'without undue delay' and, where feasible, no later than 72 hours after the controller becomes aware of the breach. This period is a fixed regulatory deadline, and failure to meet it without a documented justification (e.g., complexity of investigation) can result in significant administrative fines.

mshta.exe is a Microsoft HTML Application host that runs .hta files containing VBScript or JavaScript. When invoked with a remote URL, it executes attacker-supplied script directly from the internet, bypassing many application control policies and acting as a living-off-the-land binary (LOLBin). This behavior is highly suspicious because legitimate mshta execution is typically local and user-initiated, not a network fetch of script code.

Using parameterized queries directly addresses the root cause of SQL injection by ensuring that user input is treated strictly as data, not as executable code. This method pre-compiles the SQL statement, defining placeholders for input values. When user data is then bound to these parameters, the database engine interprets it literally, preventing malicious characters from altering the query's structure and effectively eliminating SQL injection vulnerabilities.

Patching the specific vulnerability that the ransomware exploited is a definitive eradication measure because it closes the door at the root cause, preventing both the current strain and any similar variations from re-entering through the same path. This step, derived from the incident's root cause analysis, is essential for protecting not only the affected hosts but also all other unpatched systems in the environment. Without this patch, even after rebuilding or credential rotation, the same hole remains, leaving the network vulnerable to immediate reinfection.

Applying a workaround as a compensating control is the most appropriate immediate action when a critical vulnerability is discovered and a vendor patch is not yet available. A compensating control is an alternative security measure that reduces the risk to an acceptable level until a permanent solution can be implemented. This approach effectively mitigates the immediate threat without causing undue operational disruption, balancing security with business continuity.

HostPath mounts allow a pod to mount an arbitrary path from the underlying node's filesystem directly into the container. Without restrictions such as requiring read-only mounts, allowing only specific directories, or disabling hostPath when possible, a compromised container can read or modify sensitive host files, plant malicious executables, or even achieve full node compromise. This is a critical misconfiguration that directly exposes the host and is absolutely a security risk.

The number of active user accounts with privileged access is a direct measure of the privileged access attack surface and is explicitly required to be tracked by many compliance frameworks. For instance, PCI DSS Requirement 10.8 mandates logging and monitoring of access to privileged accounts, and knowing the exact count is essential for access recertification and segregation of duties. This metric enables auditors to verify that privileged access is controlled, monitored, and limited to authorized personnel.

Trivy is an open-source, fast, and comprehensive vulnerability scanner designed specifically for container images. It scans both OS packages (e.g., Alpine, Debian) and application dependencies (e.g., Python, Node.js) by comparing against a continuously updated CVE database, and it can be easily embedded into CI/CD pipelines with a simple CLI without requiring a separate server. Its low false-positive rate and support for multiple input formats (e.g., Docker, Podman, OCI) make it the most straightforward and effective choice among these options for the security team's container scanning need.

Broken Object Level Authorization (BOLA) is the most direct and correct answer because it occurs when an API fails to enforce per-object permissions, allowing an attacker to access, modify, or delete another user's data simply by substituting an object ID in an API request. For example, changing 'GET /api/user/123' to 'GET /api/user/456' can expose another user's private information if the server does not verify that the authenticated principal owns the requested object. This flaw is specifically catalogued as API1:2019 in the OWASP API Top 10 and is a primary focus of API penetration testing.

Emergency patching is a specialized, expedited process designed to rapidly deploy critical security updates to production systems, often bypassing standard testing and change management protocols due to the severe and immediate risk posed by a newly discovered vulnerability. Its primary objective is to quickly mitigate an active threat or prevent imminent exploitation, prioritizing risk reduction over typical operational considerations like extensive pre-deployment testing or scheduled maintenance windows. This approach is reserved for vulnerabilities deemed critical enough to warrant immediate action.

Apply security patches to vulnerable systems is the definitive root-cause remediation for a ransomware outbreak. If the initial infection exploited a known software flaw, patching closes the exact vulnerability the attacker used, preventing the same binary from reinfecting hosts after cleanup. This action breaks the kill chain at the exploitation stage and is mandatory before restored systems are placed back on the production network. Without patching, any unpatched host still exposed to the same entry vector will likely be re-encrypted within hours.

Sysmon Event ID 3 is the correct choice because it records every inbound and outbound TCP/UDP connection with source/destination IP and port, giving a direct network trace of lateral movement. In pass-the-hash, an attacker typically connects from one compromised host to many others on SMB port 445 (or RPC ports) to access admin shares and execute remote code; a single host rapidly spamming connections to many distinct internal IPs on port 445 is a strong indicator. Additionally, Event 3 includes the initiating process, so an analyst can link a suspicious process like a Mimikatz-injected one directly to the anomalous traffic.

The priority is exposure containment and impact assessment.

Setting password expiration to 90 days aligns with CIS Level 1 recommendations because it is a fundamental, low-impact security control that requires minimal configuration via PAM or Group Policy. It directly mitigates risk by limiting the window of opportunity for an attacker who has compromised a credential, ensuring that stolen passwords become invalid within a defined period. This setting rarely breaks applications or user workflows, making it a textbook Level 1 baseline requirement.

This captures the drive data without alteration.

Disconnecting the affected workstations from the network immediately halts the ransomware's ability to spread laterally to other systems and prevents communication with command-and-control servers. Leaving them powered on is critical for preserving volatile memory, which contains invaluable forensic artifacts like running processes, network connections, and decrypted malware components essential for root cause analysis and indicator extraction.

Tactical intelligence is time-sensitive, actionable data that directly supports day-to-day security operations. SOC teams require IoCs—such as malicious IPs, file hashes, and domain names—to detect and block immediate threats. By pushing this information to the SOC, analysts can operationalize it and update detection rules, SIEM queries, and EDR configurations in real time.

Tokenization replaces sensitive PII with a non-sensitive, algorithmically generated surrogate value (a token), while pseudonymization replaces direct identifiers with a reversible, artificial identifier. Both methods effectively mask the original PII, significantly reducing the risk of direct exposure and compromise, while still allowing auditors to perform necessary analysis, linkage, and validation using the masked data. This approach maintains data utility and analytical value for auditing purposes without compromising individual privacy or violating compliance mandates.

Checking the baseline behavior of the source IP is a crucial initial step in incident response, as it provides essential context for the triggered SIEM alert. By comparing the current activity against established normal patterns for that IP, the analyst can determine if the behavior is truly anomalous or if it represents a routine, albeit unusual, operation. This comparison helps to quickly differentiate between legitimate, expected traffic and genuinely suspicious activity, thereby reducing false positives and prioritizing actual threats.

Implementing a web application firewall (WAF) rule (e.g., using the OWASP Core Rule Set) immediately blocks known XSS payloads at the edge, providing a temporary mitigation that reduces exploitability without taking the application offline. The WAF can be tuned to inspect query strings, POST bodies, and headers for attack signatures, allowing the security team to protect users while the development team prepares a permanent patch. This is a standard first-line response for web vulnerabilities, but the WAF rule should be considered a compensating control, not a substitute for secure coding.

Conducting a root cause analysis is the central activity of the lessons-learned phase, as it systematically identifies the underlying human, technical, or procedural factors that allowed the incident. Using structured methods like "5 Whys" or fault tree analysis, the team traces the chain of events back to initial conditions, distinguishing the immediate trigger from the deeper vulnerabilities or gaps. This analysis drives targeted remediation—such as revised hardening standards or additional training—so that similar incidents are less likely to recur.

Used to download files from a URL.

Chain of custody records evidence handling and integrity from collection onward. In post-incident improvement, responders need action that reduces risk while preserving the investigation record.

Implementing a virtual patch using a Web Application Firewall (WAF) is an effective and non-disruptive mitigation strategy. A WAF can inspect incoming traffic and block malicious requests targeting known vulnerabilities, effectively shielding the application without modifying its underlying code or taking it offline. This approach allows organizations to mitigate immediate risks and maintain system availability while awaiting a vendor-supplied patch or a more permanent code fix.

Explaining a critical vulnerability in terms of its potential business impact—such as financial loss, reputational damage, operational disruption, or regulatory non-compliance—directly addresses executive concerns. Coupled with recommended risk treatment strategies (e.g., mitigation, acceptance, transfer), this approach provides decision-makers with the necessary context to understand the strategic implications and approve appropriate resource allocation. This empowers informed risk management decisions aligned with organizational objectives.

Operational intelligence is the level of threat intelligence that examines threat actor TTPs (tactics, techniques, and procedures) within the context of a specific campaign or intrusion set. Unlike raw indicators, it provides defenders with the behavioral playbook of an adversary—such as initial access vectors, lateral movement methods, and command-and-control patterns—enabling proactive threat hunting, detection engineering, and tailored mitigation strategies. This type of analysis directly informs defensive actions by revealing not just what to block, but how to anticipate and disrupt an adversary's next move.

IP addresses are fundamental network-level IOCs because they denote the source or destination of malicious traffic observed in logs, packet captures, or DNS queries. When an infection communicates with a command-and-control (C2) node or an attacker launches a brute-force attack, that IP address becomes a repeatable, searchable value in firewall logs, SIEM alerts, and threat feeds. Sharing an IP address allows other organizations to block the endpoint, but note that IPs can change quickly, making them a time-sensitive indicator.

Implementing compensating controls like network segmentation and host-based firewall rules is the most appropriate immediate action. These controls effectively reduce the attack surface and limit potential exploitation of the vulnerability without disrupting critical services, buying valuable time for a planned migration or upgrade. This strategy aligns with risk management principles by mitigating immediate threats while a long-term solution is prepared and executed.

Resource Monitor is a built-in Windows tool that provides detailed real-time information about hardware and software resource usage, including network activity. Under the "Network" tab, it clearly lists all processes with active network connections, displaying their associated Process IDs (PIDs), local and remote addresses, port numbers, and even latency. This comprehensive view allows an analyst to precisely identify which process is responsible for specific network communications, fulfilling the requirement to map network activity directly to a process.

A sudden or sustained increase in outbound data volume compared to the server's rolling baseline is one of the strongest indicators of exfiltration. Attackers often stage, compress, and encrypt data before bulk transfer to avoid detection, which typically manifests as an anomalous spike in bytes sent from the server. This signal is only meaningful when juxtaposed with the server's historical traffic patterns, so without baselining, a high volume could be dismissed as routine maintenance or backup activity.

Rescanning the application with the vulnerability scanner is the most direct, efficient, and objective method to confirm whether the reported vulnerability has been successfully remediated. This automated verification provides immediate, tangible evidence, quickly validating the development team's claim of a fix and ensuring the flaw no longer appears in subsequent reports, which is crucial before closing the vulnerability ticket and moving to the next phase of the vulnerability management lifecycle.

Container findings should consider reachability, but rebuilding from a patched base reduces inherited risk.

Random Access Memory (RAM) is the most volatile data type in a computer system, constantly being overwritten and updated by the CPU and active processes. Its contents are lost immediately upon power loss or system shutdown, making it critical to acquire during live forensic investigations before it disappears. RAM often holds crucial artifacts like running processes, open files, network connections, encryption keys, and unencrypted data that may not be written to persistent storage.

Following the identification of malware and subsequent containment (isolating the affected workstation to prevent further spread), the logical and necessary next technical step in the incident response lifecycle is eradication. This involves thoroughly removing the identified malware and any associated malicious components from the compromised system to eliminate the immediate threat and prepare for recovery.

Computing a cryptographic hash (e.g., SHA-256) of the original drive before imaging establishes a baseline integrity value. This baseline lets the examiner later hash the acquired image and confirm it is bit-for-bit identical to the source, proving the imaging process did not alter or omit data. Recording the hash in chain-of-custody documentation also provides legal defensibility.

Authenticated access matters because installed package inventory on Linux lives in local databases such as the RPM database or dpkg status file, which are only queryable by logging into the host over SSH and running commands like rpm -qa or dpkg-query -W; an unauthenticated network scan can only infer software from open ports or service banners, producing an incomplete and often inaccurate picture of actual installed packages.

CRC (Cyclic Redundancy Check) errors and frame errors are strong indicators of data corruption occurring during transmission or reception. These typically point to issues at the physical layer (Layer 1) of the OSI model, such as a damaged Ethernet cable, a loose connection, or a malfunctioning network interface card (NIC) or switch port. Such physical defects introduce noise or signal degradation, leading to corrupted frames that fail their integrity checks upon arrival.

Implementing network segmentation involves isolating the vulnerable server into a dedicated network segment, such as a specific VLAN or DMZ, to restrict its communication paths and limit potential lateral movement by an attacker. Concurrently, increasing monitoring through enhanced logging, intrusion detection/prevention systems (IDS/IPS), and security information and event management (SIEM) correlation allows for early detection of exploitation attempts or anomalous behavior. This combined approach significantly reduces the attack surface and improves incident response capabilities without disrupting critical business operations.

Whitelisting specific source IP addresses for known, trusted servers is an effective method to reduce false positives without compromising detection capabilities. By instructing the IDS to ignore or suppress alerts for traffic originating from these verified legitimate sources, the analyst can significantly decrease the volume of benign alerts. This action helps to improve the signal-to-noise ratio, allowing security personnel to focus on genuinely suspicious activities rather than expected operational traffic.

Rerouting traffic through a DDoS mitigation service or scrubbing center is the most effective response because these services employ specialized filtering, rate limiting, and behavioral analysis to distinguish legitimate user requests from malicious traffic, forwarding only clean traffic to the origin. This approach is well-suited for both volumetric floods and application-layer attacks, and it can be activated quickly by updating DNS or BGP to redirect traffic.

Disconnecting all network shares is a critical containment step because modern ransomware actively scans for mapped drives and open SMB shares, which it can encrypt just like local disks after compromising a single endpoint. By severing access to shared folders, you eliminate a large portion of the attack surface and prevent the ransomware from quickly encrypting centralized file servers and backup repositories. This action directly limits the blast radius while you deploy more comprehensive containment measures.

CVSS is a standardized severity score that synthesizes exploitability characteristics (attack vector, attack complexity, privileges required, user interaction) and impact metrics (confidentiality, integrity, availability) into a 0–10 score. In v3.x, this score provides the critical first filter for triage, allowing an analyst to quickly separate low-severity flaws from those that demand immediate attention. However, it is only a measure of intrinsic severity, not a guarantee of real-world exploitation, so it must be combined with threat likelihood and business impact. As a severity benchmark, it remains the primary initial factor in any prioritization workflow.

STIX and TAXII are open standards for threat intelligence sharing, widely used in MISP.

In the Common Vulnerability Scoring System (CVSS), an Attack Vector of Network (AV:N) means the vulnerability is exploitable from any remote system that can reach the target over a network connection. This includes sending specially crafted IP packets, protocol-specific requests, or application-layer payloads without requiring any prior authentication or local access. The attacker does not need to be co-located on the target's local subnet, merely capable of network connectivity.

Stored XSS in the comment section is an injection vulnerability because the attacker injects executable client-side script (e.g., JavaScript) that is persisted on the server and later rendered in other users' browsers. Unlike SQL injection, which targets the database layer with structured query language, XSS targets the interpretation context of HTML/JavaScript in the victim's browser. The comment field fails to sanitize or encode user input, enabling script execution that can steal session cookies, deface pages, or perform actions on behalf of the target user.

Implementing and enforcing a configuration management baseline directly addresses the root cause of a high number of open ports. Configuration management tools define the desired secure state for systems, specifying exactly which services should run and which ports should be open. By continuously monitoring and automatically remediating any deviations from this established baseline, it ensures consistent hardening, prevents configuration drift, and proactively closes unnecessary ports across the entire environment, significantly improving the security posture.

SOC analysts are the primary consumers for a report consisting of technical IoCs, as they operationalize these indicators into detection logic such as SIEM signatures and alert rules. The report should be structured to support correlation with telemetry, enabling prioritization and investigation of matching events. For the SOC, IoCs serve as the foundational input for proactive threat detection and ongoing security monitoring.

An out-of-band (OAST) SSRF test uses an external callback server like Burp Collaborator to detect when the application fetches an attacker-specified URL. If a DNS lookup or HTTP hit is received, it proves the server-side component is making the request as the victim, even when the response body is not reflected to the tester. This technique is essential for blind SSRF, where the application processes the response internally without echoing it back. It also confirms the vulnerability independently of any firewall or filtering on the inbound path.

Documenting the technical vulnerability exploited is central to root cause analysis because it identifies the specific weakness—such as an unpatched CVE, SQL injection, or misconfigured S3 bucket—that allowed the initial compromise. Without this technical detail, the response team cannot prescribe a targeted fix (e.g., patch, configuration change, or WAF rule) to prevent recurrence. The root cause is inseparable from the exact flaw that made the attack viable.

Restricting an employee's access to sensitive data is a critical, immediate containment measure during an insider threat investigation. This action adheres to the principle of least privilege, mitigating potential data exfiltration or damage without prematurely alerting the suspect. It allows the security team to safely conduct further investigation and evidence collection while minimizing ongoing risk to organizational assets.

A web shell leaves evidence across file, web, process, and network telemetry. In recovery, responders need action that reduces risk while preserving the investigation record.

Applying the principle of least privilege to user accounts is the most direct and effective countermeasure against privilege escalation. This principle ensures that users and processes are granted only the minimum necessary permissions to perform their legitimate functions, and no more. By limiting the initial access an attacker gains, even if they compromise a user account, their ability to escalate privileges to administrative or system-level access is severely restricted, significantly reducing the potential impact of a successful exploit.

The CVSS vector string 'AC:L' explicitly denotes a Low Attack Complexity. This means that a successful attack does not require specialized conditions beyond the attacker's control, nor does it demand extensive preparation or specific timing. Attackers can typically exploit such vulnerabilities with readily available techniques and resources, making the attack relatively straightforward and increasing its likelihood.