CompTIA CySA+ CS0-004 (CS0-004) — Questions 226–300

Trivy scans container images for known vulnerabilities in OS packages and application dependencies, integrating into CI pipelines before deployment. This satisfies the requirement for a tool specifically designed for container image vulnerability scanning, unlike general-purpose scanners.

Establishing a coordinated approach to evidence collection and preservation is the critical first step to ensure all digital forensics remain legally admissible. This collaboration prevents the organization from inadvertently altering or destroying volatile data, such as RAM or active network logs, which law enforcement needs to establish a proper chain of custody.

A CVSS base score reflects theoretical severity in a vacuum and does not account for environmental factors such as the WAF filtering malicious payloads and network ACLs restricting access to internal IPs; a documented risk assessment weighs these compensating controls against exploitability and business impact to set an appropriate remediation timeline.

Automated alerting driven by threat intelligence continuously matches live telemetry against known indicators of compromise and behavioral patterns in near real time, directly closing the gap between when malicious activity occurs and when it is surfaced to an analyst, which is precisely the mechanism that lowers mean time to detect.

Structured Threat Information Expression (STIX) is an industry-standard language specifically designed to standardize the representation of cyber threat intelligence. It enables organizations to share structured threat data—including indicators, adversaries, and tactics—in a consistent, machine-readable format that security tools like SIEMs, SOAR platforms, and firewalls can automatically ingest and operationalize.

Deploying additional EDR sensors directly addresses visibility gaps by expanding host-level monitoring across the enterprise. This allows the security team to collect real-time telemetry, analyze behavioral anomalies, and rapidly detect malicious activities, thereby significantly reducing the mean time to detect (MTTD) future incidents.

DNS tunneling abuses the DNS protocol to bypass network security controls by encoding exfiltrated data or command-and-control (C2) payloads within DNS queries and responses (such as TXT, CNAME, or MX records). Because firewalls typically allow unrestricted outbound UDP port 53 traffic to resolve domain names, attackers can establish a covert bidirectional communication channel to slowly leak sensitive information without triggering traditional perimeter defenses.

Effective vulnerability management requires aligning technical severity with business impact. Prioritizing remediation based on asset criticality ensures that high-value systems containing sensitive data or supporting mission-critical operations are patched first. Additionally, evaluating network exposure, such as whether an asset is internet-facing, helps security teams address the most immediate and viable attack vectors.

Correlating EDR file-read telemetry with the timing of outbound TLS connections links sensitive document access to subsequent transmission. That temporal association distinguishes genuine staging and exfiltration from benign encrypted traffic, directly supporting the exfiltration hypothesis.

By utilizing the s3:* wildcard action, the policy grants unrestricted administrative permissions across the entire Simple Storage Service. This allows unauthorized users or compromised roles to perform destructive operations like deleting entire buckets, modifying access control lists, or exfiltrating sensitive data, directly leading to severe data exposure.

This comprehensive set of information provides the third-party provider with all necessary factual details to fully understand the incident, its ramifications, and the precise expectations for resolution and future prevention. A clear timeline establishes the sequence of events, service impact quantifies the damage, and concrete evidence supports the claims, ensuring a shared understanding. Specifying required corrective actions and contractual follow-up ensures accountability and aligns remediation efforts directly with service level agreements (SLAs) and legal obligations, facilitating a structured and effective response.

A comprehensive incident report must identify the fundamental vulnerability or failure vector that allowed the security incident to occur. Conducting a root cause analysis ensures that remediation efforts target the source of the compromise rather than just treating superficial symptoms, preventing future exploitation of the same vector.

WinPmem is an open-source, dedicated physical memory acquisition tool designed specifically for Windows operating systems. It utilizes a kernel driver to safely bypass operating system restrictions and read raw physical memory (RAM), dumping it into standard formats like RAW or ELF for subsequent forensic analysis. This makes it the ideal choice for capturing volatile memory on a Windows host.

YARA rules define combinations of strings, byte sequences, and boolean logic that describe a malware family's known characteristics, and running a rule against a file set flags any files whose content matches those defined patterns, which is precisely why the analyst got a hit here.

MITRE ATT&CK technique T1053.005 specifically represents the abuse of the Windows Task Scheduler to achieve persistence or elevate privileges. Threat actors leverage utilities like `schtasks.exe` or the Task Scheduler API to register malicious tasks that execute periodically or under specific trigger conditions, ensuring continuous access to the compromised host.

A software bill of materials enumerates every included library and its version, directly satisfying the requirement for visibility into third-party components within the regulated product. This transparency lets the security team identify vulnerable or outdated dependencies, supporting accurate risk assessment rather than concealing exposure behind vendor assurances.

Removing the unused library directly eliminates the vulnerability from the container image, adhering to the principle of least utility and minimizing the attack surface. This approach prevents potential exploitation, reduces the overall image size, and streamlines future vulnerability scanning processes. It represents the most secure and efficient remediation strategy for unused dependencies.

Using approved safe-check profiles ensures that vulnerability scans are configured with non-intrusive settings specifically designed for sensitive OT equipment, minimizing the risk of operational disruption. Passive discovery methods, such as network traffic analysis, further reduce impact by observing system behavior without direct interaction, which is crucial for maintaining the stability and safety of critical industrial control systems.

Prioritising by asset criticality and exploitability directs remediation to vulnerabilities on business-critical systems that attackers can realistically exploit, satisfying the stem's demand for the best prioritisation method rather than ranking by raw CVSS score or scan order alone.

Memory injection techniques, such as process hollowing or DLL injection, require allocating memory with write permissions to copy payload code, and then execute permissions to run it. Legitimate software rarely allocates memory regions with concurrent Read-Write-Execute (RWX) permissions due to security mitigations like Data Execution Prevention (DEP) or W^X (Write XOR Execute). Finding an RWX memory region strongly indicates that shellcode has been injected and is prepared for execution.

Mean Time to Detect (MTTD) is the correct metric, as it measures the average elapsed time between the initial occurrence of a security incident—such as an intrusion or malware compromise—and the moment it is identified by monitoring tools or security personnel. Shorter MTTD directly reduces attacker dwell time and potential damage. This metric is specifically designed to gauge the speed and effectiveness of an organization's detection capabilities.

Upgrading Apache Struts to the latest patched version is the primary remediation because it replaces the vulnerable code with a release that includes the security fix for the specific CVE. This action directly addresses the root cause of the flaw and eliminates the attack vector for known exploit patterns. Vendor patches are thoroughly tested and are the most reliable way to restore a secure state.

This comprehensive document delivers the exact technical artifacts, such as file hashes, malicious IP addresses, and registry modifications, alongside step-by-step recovery instructions. This level of detail allows the operations team to effectively purge threats, update firewall rules, and harden systems against future incursions.

External scans are conducted from outside the organization's network perimeter, directly simulating the perspective of an external attacker targeting public-facing assets. This approach identifies exposed ports, misconfigured firewalls, and unpatched vulnerabilities in public web applications without requiring internal network access or system credentials.

This finding maps directly to the CIS Benchmark recommendation that requires no world-writable files to exist in system directories, since files writable by any user create a path for unprivileged accounts or compromised processes to modify binaries, configuration files, or scripts that later run with elevated privileges.

SLA compliance by severity, asset owner and business unit shows whether critical findings were remediated within policy timelines, grouped by accountable owner and business area. This directly answers the executive audience's question about remediation performance against agreed targets.

Querying external threat intelligence feeds allows the analyst to quickly determine if the originating IP address has a known history of malicious activity, such as being part of a botnet or hosting malware. This external context helps validate the severity and likelihood of a true positive alert.

A false positive occurs when benign or authorized activity, such as an approved internal vulnerability scan, triggers a security alert as if it were malicious. Analysts must tune SIEM rules to recognize these authorized sources to prevent alert fatigue from these non-threatening events.

A full Packet Capture (PCAP) provides a complete, byte-for-byte recording of all network traffic, including the entire headers and payloads of DNS queries and responses. This granular level of detail is crucial for detecting DNS tunneling, as it allows analysts to inspect the specific fields within DNS packets (e.g., query names, TXT records) for unusually long strings, non-standard characters, or encoded data that signifies covert communication. PCAP enables deep forensic analysis necessary to uncover such sophisticated exfiltration methods.

Strategic intelligence provides high-level, non-technical insights into long-term threat landscapes, emerging risk trends, and geopolitical motivations. It is tailored specifically for C-level executives and board members to guide long-term financial planning, risk management, and organizational security posture alignment.

While a Web Application Firewall (WAF) rule serves as an effective compensating control, it must be rigorously validated to ensure attackers cannot bypass it using encoding or alternative payloads. Additionally, testing prevents the rule from generating excessive false positives that could disrupt legitimate application traffic.

This section is the primary driver of continuous improvement in the incident response lifecycle. It translates the findings of the post-incident review into actionable security controls, policy updates, and architectural modifications designed to eliminate vulnerabilities and prevent similar security incidents from recurring.

When modifying the severity of a vulnerability, formal approval and a documented rationale are required to maintain compliance and governance. This ensures that any deviation from standard CVSS scores is justified by business context or compensating controls, preventing unauthorized or arbitrary risk acceptance.

Assigning a named owner ensures accountability for the corrective action, while a due date provides a timeline for completion. Clearly defined acceptance criteria establish what constitutes a successful resolution, making the outcome measurable and verifiable. Finally, a retest plan is crucial to validate that the implemented fix effectively addresses the original issue and does not introduce new vulnerabilities, thereby ensuring the long-term efficacy of the security improvement.

Correct. Signed and dated reports establish accountability, a specific date of execution, and the reviewer's attestation that access was examined and adjudicated, which is the direct, verifiable artifact auditors require to confirm a control operated as designed.

Volatile memory contains critical, ephemeral evidence such as active network connections, running processes, decrypted ransomware keys, and unencrypted payloads. According to the Order of Volatility (RFC 3227), RAM must be captured first because any subsequent system interaction or shutdown will permanently destroy or alter this highly perishable data.

A named owner closes the accountability gap the report identified, while the due date enforces timely remediation. Acceptance criteria define what a successful alert integration looks like, and the retest plan verifies the fix actually works, preventing the same unowned failure recurring.

Ensures that alerts are monitored around the clock.

Physically disconnecting the network cable or disabling the network interface card (NIC) is the fastest way to achieve network isolation. This immediate containment action instantly severs the connection to external malicious servers, preventing further data exfiltration and stopping lateral movement within the enterprise network.

OpenVAS, now maintained under the Greenbone Vulnerability Management project, is fully open-source and free to use, with a continuously updated feed of network vulnerability tests maintained by the community and Greenbone. It performs authenticated and unauthenticated network scans and is widely deployed by organizations that want scanning capability without commercial licensing costs.

When a user opens a malicious spearphishing attachment, embedded VBA macros often execute and spawn child processes such as PowerShell, cmd.exe, or lolbins to download secondary payloads. Detecting Microsoft Word (winword.exe) spawning these command-line interpreters via osquery is a classic indicator of this initial access technique.

RAM is the most volatile data source because it holds running code, decrypted data, cached credentials, and the current state of the operating system. This information disappears the instant the system loses power or is rebooted, so capturing a memory dump is the highest-priority step. Without it, analysts lose the only copy of in-memory malware behavior and live artifacts.

This technique precisely describes the action of an adversary transferring tools, utilities, or malware payloads from an external system into the target environment. When a threat hunter focuses on detecting PowerShell-based file downloads, they are specifically hunting for evidence of this ingress activity to identify initial staging or tool installation.

This option correctly follows the order of volatility for evidence collection in a digital forensics investigation. A 'memory dump' captures the most volatile data, the contents of RAM, which can contain critical artifacts like running processes, open files, and network connections. Subsequently, 'netstat -an' captures active network connections, which are less volatile than RAM but more dynamic than a process list. Finally, 'tasklist' captures the running processes, which are the least volatile of these three dynamic data types, ensuring that the most ephemeral evidence is preserved first.

A Domain Generation Algorithm (DGA) is a technique used by malware to periodically generate a large number of pseudo-random domain names that can be used as rendezvous points for command-and-control (C2) servers. This allows attackers to evade static domain blocking and IP reputation lists, as the malware and the attacker only need to register a single domain from the generated list to establish a successful connection.

An executive dashboard aggregates complex security data into high-level key performance indicators (KPIs) and risk metrics, such as overall compliance posture and mean time to detect (MTTD). This visual format allows non-technical leadership to quickly grasp the organization's current security posture and make informed resource allocation decisions.

DNS tunneling utilities typically encode stolen data or command-and-control instructions into the subdomain portion of a query, resulting in highly randomized, high-entropy character strings. Using a YARA rule or similar detection mechanism to analyze DNS logs for high-entropy domains allows security analysts to precisely identify anomalous, machine-generated queries indicative of exfiltration without disrupting legitimate network traffic.

This section is designed specifically for leadership and non-technical stakeholders, distilling complex technical findings into a high-level overview of critical risks, business impacts, and strategic recommendations. It provides the necessary context for resource allocation and risk management decisions without overwhelming the reader with granular vulnerability data.

SLA compliance by severity, asset owner, and business unit provides the most comprehensive view for a vulnerability program. It directly measures the timeliness of critical vulnerability remediation against established service level agreements, broken down by the responsible parties and their organizational context. This granular reporting enables accountability, highlights areas of non-compliance, and effectively demonstrates whether critical risks are being addressed promptly, aligning security efforts with business objectives.

The EPSS probability score is a data-driven metric from FIRST that estimates the likelihood a vulnerability will be exploited in the wild within 30 days. It is derived from real-world exploit data, CVE attributes, and threat intelligence, making it a strong indicator of active exploitation risk. As a correct prioritization input, it helps security teams focus on vulnerabilities that are most likely to be attacked, rather than just those with high theoretical severity. This is a valid and important factor for risk-based prioritization.

This action is the most effective initial containment strategy. Disconnecting network cables or disabling switch ports immediately prevents further lateral movement of the ransomware to other systems, including critical servers, while keeping the infected workstations powered on. This preserves volatile memory and disk state, which is crucial for forensic analysis to identify the initial infection vector, malware characteristics, and potential exfiltration attempts before remediation.

This CIS control checks bucket ACLs and bucket policies for statements granting access to 'Everyone' or 'AuthenticatedUsers' groups, which is precisely the misconfiguration exposing sensitive customer data, making it the check that flags and drives remediation of the finding.

Credentialed scans utilize valid administrative or user credentials to authenticate directly to the target system. This allows the scanner to query the local registry, inspect the file system, and query package managers to verify the exact patch levels and configuration settings. Consequently, this approach provides the most accurate assessment with minimal false positives.

NIST SP 800-61 explicitly places the lessons-learned meeting within Post-Incident Activity, where the team reviews the full incident timeline, evaluates response effectiveness, updates playbooks and detection rules, and produces a formal report once containment and recovery are complete.

Scope (S) is a correct base metric in CVSS v3.1, measuring whether a vulnerability in one vulnerable component can impact resources beyond its security scope. A changed scope indicates that exploitation may affect other components, increasing the overall severity. OpenVAS includes Scope in the base vector, so it is a valid base metric.

Threat actors frequently utilize PowerShell to execute obfuscated payloads, often passing Base64-encoded scripts via the `-e` or `-EncodedCommand` flags to bypass legacy security controls. An osquery search targeting these specific command-line arguments, especially when spawned by unusual parent processes like web servers or office applications, is a classic method for detecting active malicious PowerShell execution.

A privileged container runs with nearly all Linux capabilities enabled and direct access to host devices, meaning a compromised container can mount the host filesystem, load kernel modules, and effectively break out of container isolation entirely, giving an attacker root-equivalent control over the underlying node.

An overall risk posture summary aggregates findings into a concise, qualitative rating—such as high/medium/low—or a weighted risk score that reflects the organization's relative exposure. This gives management a rapid understanding of whether immediate attention is required and how the current risk compares to prior assessments or industry benchmarks. It directly enables informed, risk-based decisions about prioritizing remediation efforts and allocating resources.

A heat map converts likelihood and impact into colour-coded bands, letting a non-technical board grasp relative exposure at a glance without interpreting raw scores. Pairing each rating with a business impact description satisfies the stem's constraint: communicating risk to an audience lacking technical background, so prioritisation and funding decisions can be made quickly.

MTTD, Mean Time to Detect, is precisely the metric that measures the average elapsed time between when a security incident actually begins and when the security team becomes aware of it, making it the key indicator of detection capability and a primary driver of overall breach cost and dwell time.

Asset criticality and business context are central to vulnerability prioritization because they determine the potential impact on operations, data confidentiality, and compliance. A critical internet-facing server, for example, represents a higher risk to the organization if compromised, even when the vulnerability's severity is moderate. Contextual factors such as exposure, sensitive data, and required availability turn a generic technical finding into a prioritized business risk.

The Attack Vector (AV) metric represents the context in which vulnerability exploitation is possible. A value of AV:N (Network) explicitly indicates that the vulnerability is exploitable remotely over the network, meaning the attacker does not need local, physical, or adjacent network access to compromise the target.

This combination represents the highest remediation priority because the CISA KEV catalog confirms the vulnerability is currently being exploited in the wild, while a high EPSS score mathematically predicts a high probability of imminent exploitation. Leveraging both threat-centric metrics allows security analysts to transition from theoretical severity to active risk-based patching.

Disclosing internal IP addresses in HTTP headers is typically classified as a medium-risk vulnerability that facilitates external reconnaissance. Remediation involves modifying the web server configuration to prevent the disclosure, which is a non-emergency change that should be scheduled during a standard maintenance window to avoid service disruption.

Placing a legal hold on relevant data is a legally binding directive that suspends all normal deletion, rotation, and destruction policies for potentially relevant information. In a ransomware incident, this preserves logs, endpoint artifacts, and backup copies, ensuring a complete forensic record for litigation or regulatory investigation. Without a legal hold, automated processes such as log rotation or archive purging could destroy evidence, leading to spoliation sanctions and undermining the ability to prove the scope of the breach.

Combining the Exploit Prediction Scoring System (EPSS) and CISA's Known Exploited Vulnerabilities (KEV) catalog allows analysts to focus on threats with active, real-world exploitation activity. Integrating business context ensures that remediation efforts are directed toward high-value assets that directly impact organizational operations. This risk-based approach optimizes resource allocation and significantly reduces actual organizational exposure compared to relying solely on static severity scores.

Exposure determines the likelihood of attack, considering whether the asset is internet-facing or reachable by potential adversaries. It directly influences the probability of exploitation, making it a fundamental factor in prioritizing vulnerabilities. Without exposure, even a critical vulnerability on an internal system poses less immediate risk. Therefore, asset exposure is the primary determinant for prioritizing remediation efforts.

Mean time to remediate is calculated as the average duration between when a vulnerability is identified and when it is actually fixed or closed, making it the direct metric for tracking remediation speed described in the question.

Calculating cryptographic hashes (such as SHA-256) of acquired forensic images immediately after acquisition establishes a baseline for integrity verification. This mathematical proof ensures that the evidence has not been altered during subsequent analysis, which is critical for admissibility in legal proceedings.

Limiting the number of concurrent checks directly controls how many vulnerability tests or network connections the scanner initiates simultaneously against a target system or across the network. This crucial configuration reduces the immediate load placed on the target and the network infrastructure, preventing resource exhaustion. By pacing the scan, it significantly lowers the risk of inadvertently causing a denial-of-service condition or overwhelming critical services, thereby ensuring operational stability during the assessment.

Cloud audit logs, specifically those tracking data plane operations like secret-read events, provide granular details on which secrets were accessed, by which identity, from what source IP, and at what timestamp. This direct evidence is crucial for identifying unauthorized secret access and understanding the scope of a potential compromise, directly addressing the scenario of a workload identity accessing secrets outside its expected scope.

Presenting critical exposure trends, specifically categorized by business service, offers executives a strategic and actionable view of the organization's evolving risk posture. This metric indicates whether the most severe risks are increasing or decreasing within specific operational areas, directly linking security posture to business impact. Such trends enable informed resource allocation and strategic decision-making to mitigate risks affecting critical business functions.

The findings-by-severity section breaks the full vulnerability list down into the critical, high, medium, and low buckets shown in the manager's report, giving the analyst the exact grouped detail needed to identify which of the 15 critical and 40 high items must be remediated first.