CompTIA CySA+ CS0-004 (CS0-004) — Questions 301–375

Performing a full packet capture (PCAP) is the most effective action because it allows the analyst to conduct deep packet inspection on the suspicious traffic. By analyzing the actual payloads and protocol headers, the threat hunter can definitively determine if sensitive data is being exfiltrated or if the traffic is benign. This provides the granular visibility that high-level NetFlow metadata lacks, confirming the exact nature of the transmission.

Disabling unnecessary plug-ins prevents the scanner from running checks that are not relevant to the environment, such as Windows-specific tests against Linux hosts. Each plug-in produces findings, and if it probes for software or services that are absent, it can generate false positives based on erroneous banner matches. By tailoring the active plug-in set to the actual asset inventory and exposed services, the analyst reduces meaningless alerts and focuses the scan on likely vulnerabilities. This is a core tuning step that directly reduces false positives while preserving comprehensive coverage.

Agent-based scans utilize a lightweight software package installed directly on the target endpoint to perform local, authenticated assessments. This method eliminates the need to manage network credentials or open inbound ports, allowing the agent to execute with local system privileges. It is highly effective for transient assets, such as remote laptops, which may not be consistently connected to the corporate network during scheduled network scans.

Disconnecting the server from the network is the primary containment action to halt active ransomware propagation. This immediate physical or logical isolation prevents the malware from encrypting mapped network drives, communicating with its command-and-control server, or spreading to other vulnerable hosts on the segment.

DNS logs record the specific domain queries (such as TXT, CNAME, or MX records) and responses that are manipulated during a DNS tunneling attack. Analyzing these logs allows security analysts to detect anomalies like unusually long subdomains, high query volume to a single authoritative name server, and encoded payloads within the queries.

Executives need decision-oriented context, not technical exploit detail. Framing the vulnerability around business risk, customer impact, remediation status and residual exposure satisfies the executive-audience constraint, enabling leadership to prioritise resources and accept or mitigate remaining exposure.

Process analysis is the correct first step because it allows the analyst to inspect the process metadata, parent-child relationships, and command-line arguments. By examining the command line of the running powershell.exe process, the analyst can extract and decode obfuscated or Base64-encoded scripts directly to understand the payload's intent.

This connection is highly suspicious and a strong indicator of compromise. An internal host (10.0.0.5) is initiating an outbound connection from an ephemeral port (54321) to an external, non-RFC1918 IP address (198.51.100.20) on a non-standard port (4444). Port 4444 is not commonly used for legitimate services and is frequently associated with reverse shells or command and control (C2) communication by malware, making it a critical security alert.

A comprehensive and accurate asset inventory is the foundation of any vulnerability management program. Without knowing which hardware, software, and cloud resources exist on the network, security teams cannot perform targeted scans, leaving critical blind spots that attackers can easily exploit.

netstat -anp lists all sockets numerically (-n), showing every connection state including ESTABLISHED (-a) and the owning process (-p). This matches the observed output of many established connections to an external IP on port 443.

Creating a detailed timeline of events is a critical component of a post-incident review. This chronological reconstruction helps the team understand the exact sequence of actions taken, when key decisions were made, and the duration of various incident phases. It is essential for identifying delays, missed detection points, and opportunities for earlier containment or eradication, providing a factual basis for subsequent analysis.

GDPR Article 33(1) mandates that a data controller notify the relevant supervisory authority of a personal data breach "without undue delay and, where feasible, not later than 72 hours" after becoming aware of it. This 72-hour window is the exact compliance threshold explicitly written into the regulation, and failing to meet it without documented justification is a violation. The notification must include the nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, and the measures taken or proposed to mitigate harm.

RWX (read-write-execute) memory pages in a process are a high-confidence indicator of injected shellcode because modern operating systems enforce W^X (write XOR execute) policies; legitimate code typically resides in read-only executable regions or uses explicit VirtualProtect transitions. While some Just-In-Time (JIT) engines may briefly allocate RWX, persistent regions outside known JIT heaps warrant immediate investigation.

This sequence correctly adheres to the standard order of volatility for digital forensic evidence collection, ensuring the most ephemeral data is captured first. Memory (RAM) is the most volatile, holding active process data that is lost upon power loss. Network connections represent active communication states, followed by swap space, which contains spilled-over memory pages. Finally, persistent disk storage is the least volatile, preserving data even after power cycles.

Every metric matches the scenario exactly: AV:N reflects remote network exploitability, AC:L means no special conditions are needed, PR:N and UI:N confirm no authentication or victim action is required, and C:H/I:H/A:H capture the total loss of confidentiality, integrity, and availability, which together drive the 9.8 critical base score.

Correct. AV:N indicates the vulnerability is exploitable remotely over a network without requiring physical or adjacent access, and S:U means the exploited component's impact stays confined within its own security scope rather than affecting resources managed by a different authority.

File integrity monitoring (FIM) tools track cryptographic hashes, such as SHA-256, of critical system files. An unexpected change in these hashes indicates that a file has been modified, potentially replaced by malware or tampered with by an attacker to establish persistence or escalate privileges.

A definitive sign of code injection is the presence of an executable memory region that is not backed by an on-disk file. Malicious shellcode is often allocated with VirtualAllocEx and written via WriteProcessMemory, producing a private, executable page that does not map to any section object. Memory forensics tools like Volatility's malfind enumerate the Virtual Address Descriptor (VAD) tree to identify such executable pages without a backing file, making this technique a core method for detecting fileless injection.

Running containers with privileged access essentially grants them the same capabilities as the host root user, bypassing container isolation boundaries. CIS Kubernetes benchmarks strongly recommend disabling privileged containers to prevent container breakout attacks, where an attacker compromises a container and escalates privileges to compromise the underlying node.

Ransomware is malware, so the category is straightforward. Moderate severity fits because a single infected workstation is contained, not spreading enterprise-wide, yet file encryption and a ransom demand still disrupt business operations and require remediation.

A risk register must prioritize threats to allocate mitigation resources effectively. Calculating the likelihood of occurrence alongside the potential business impact allows analysts to derive a qualitative or quantitative risk rating, which is the foundational metric for risk-based decision-making.

The classification level and handling restrictions are paramount because they directly dictate who is authorized to receive the intelligence and what protective measures must be applied. Protocols like the Traffic Light Protocol (TLP) explicitly define these boundaries, ensuring sensitive information is not inadvertently exposed, sources are protected, and legal or ethical obligations are met. Adhering to these restrictions is critical for maintaining trust within intelligence-sharing communities and preventing compromise of sensitive data.

During the testing phase of patch management, regression testing is essential to confirm that the newly applied software update does not break or degrade existing system functionalities, APIs, or custom integrations. This systematic validation ensures that while the security vulnerability is successfully mitigated, the operational stability of the application or operating system remains fully intact before deployment.

The VPN flaw is unauthenticated remote code execution, internet-facing and actively exploited, so it carries far greater likelihood and impact than the internal medium findings. Patching it first and verifying exposure is removed reflects genuine risk-based prioritisation.

Disabling services and daemons that are not essential for the system's intended function directly reduces the attack surface. Each active service typically listens on specific network ports or exposes APIs, creating potential entry points and increasing the likelihood of discovering exploitable vulnerabilities. By removing these unneeded components, an organization eliminates potential vectors for compromise, adhering to the principle of least functionality.

This alert highlights Living off the Land Binary (LOLBin) abuse, where attackers leverage trusted, pre-installed system utilities like PowerShell to execute malicious commands. When a productivity application like Microsoft Word spawns a command-line interpreter, it strongly indicates a macro-based initial access vector exploiting native binaries to bypass traditional application whitelisting.

Modifying the instance's security group to deny all inbound and outbound traffic effectively isolates it from the network. This containment strategy immediately stops any ongoing malicious activity from spreading or exfiltrating data, while crucially preserving the instance's current state, memory, and disk for subsequent forensic analysis. This allows security analysts to investigate the root cause, understand the attack vector, and gather evidence without destroying critical information.

SQL injection is a runtime vulnerability that DAST tools are highly effective at identifying. By actively injecting malicious payloads into input fields, query parameters, and headers, the DAST scanner analyzes the application's HTTP responses and database error messages to confirm the vulnerability. This black-box testing closely mimics the behavior of an external attacker.

Mean time to detect measures the average duration between when an incident or attack first occurs and when the security team actually becomes aware of it. A lower MTTD indicates stronger monitoring, alerting, and threat-hunting capabilities, allowing the organization to minimize the window in which attackers can operate undetected. It is specifically focused on the detection phase of the incident response lifecycle.

The CIS Level 1 profile is specifically designed to provide a basic, highly effective reduction of an organization's attack surface while minimizing disruption to business operations and system utility. These consensus-based recommendations can be rapidly implemented across an enterprise without causing significant compatibility issues or administrative overhead.

This approach aligns with best-practice vulnerability management by balancing the need for security against operational availability. A compensating control, such as an internal network access control list (ACL) or an updated intrusion prevention system (IPS) signature, reduces the likelihood or impact of exploitation until the patch can be installed during a scheduled maintenance window. This ensures that the system remains functional and that the patch is tested and deployed in a controlled manner, minimizing downtime and the risk of unexpected failures. It is the correct decision because it addresses the vulnerability without disproportionate disruption to the business.

CIS Level 1 benchmarks are meticulously designed to establish a foundational security posture across various systems without significantly disrupting business operations or demanding extensive resources. These basic security configurations focus on essential hardening steps that are broadly applicable and easy to implement, ensuring a robust security baseline can be achieved with minimal risk of system instability or performance degradation. This approach makes them highly practical for widespread adoption.

Isolating the EC2 instance by modifying its security groups to block all inbound and outbound traffic is the primary containment step. This action immediately halts malicious command-and-control (C2) communication or data exfiltration. Crucially, network isolation preserves the volatile memory (RAM) and disk state of the running instance for subsequent forensic analysis.

The sender's email address is a primary, direct email indicator of compromise found within the SMTP envelope or mail headers (such as the "From:" field). Analysts use this specific attribute to create mail transport rules, blocklists, and search mailboxes for phishing campaigns targeting the organization.

The correlation engine is the central analytical component of a SIEM that applies pre-defined rules and machine learning algorithms to normalized data. By analyzing relationships between disparate events across multiple sources in real time, it identifies complex security incidents that would otherwise appear as isolated, benign activities.

Reporting how many systems are affected and how business-critical they are gives management the scope needed to weigh urgency, because a critical flaw on 50 domain controllers demands immediate emergency change approval, while the identical CVE on a handful of low-value test machines can reasonably wait for the next scheduled maintenance window.

The vulnerability with a CVSS score of 5.0 should be prioritized because its high EPSS score and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog indicate active, real-world exploitation. Remediation efforts must focus on vulnerabilities with proven threat actor activity, as they represent an immediate entry point, regardless of a moderate base severity score.

The SIEM logs clearly depict a classic brute-force progression, starting with a rapid succession of failed SSH login attempts from an external IP address. Once a password is successfully guessed, the attacker establishes a session and immediately executes commands to download and run an external payload, confirming both compromise and malware installation.

Adding a known-safe, high-volume domain to an exclusion list or whitelist within the SIEM suppresses repetitive false positive alerts without degrading overall detection capabilities. This tuning process optimizes analyst workflow by reducing alert fatigue while preserving the integrity of the underlying correlation rule for other unverified domains.

This chain matches a living-off-the-land binary (LOLBin) technique in which an adversary abuses the trusted svchost.exe process, often via a hijacked or malicious service DLL, to spawn powershell.exe and execute a downloader script while evading signature-based detection. Because svchost.exe is inherently trusted and its child processes are rarely scrutinized, this parent-child anomaly combined with the subsequent executable download is a strong indicator of active compromise requiring immediate isolation and deeper forensic review.

Isolating the source host (10.0.0.5) from the network is a significant containment action that should only be performed after initial analysis confirms it is genuinely compromised or malicious, and after proper coordination with stakeholders. Premature isolation without sufficient evidence or communication could disrupt legitimate business operations if the source is a critical internal system or if the alert proves to be a false positive, hindering the overall incident response process.

When an active security control, such as a Web Application Firewall, successfully mitigates a vulnerability, formalizing this state through documented risk acceptance is the correct protocol. Security analysts must record the compensating control's details and the residual risk in the risk register to maintain compliance and operational awareness.

Legitimate administrative binaries, such as PowerShell or wmic, are frequently abused by attackers in Living off the Land (LotL) attacks. When a trusted, signed binary is spawned by an anomalous parent process like a web server (w3wp.exe) or a document viewer, it strongly indicates a compromise or exploit execution rather than normal administrative activity.

Indicators of compromise such as malicious IP addresses, file hashes, registry keys, and C2 domains give engineers concrete, actionable artifacts they can load into SIEM correlation rules, EDR block lists, or YARA signatures to hunt for the same threat elsewhere in the environment and confirm the intrusion has been fully eradicated.

By adding an exception or exclusion filter for the specific, known user account within the SIEM correlation logic, the analyst prevents benign, repetitive authentication failures from triggering the alert. This targeted approach directly eliminates false positives generated by this specific user's predictable behavior without degrading the rule's ability to detect brute-force attacks on other accounts.

Active network connections, routing tables, and ARP caches are extremely transient and can terminate or change in milliseconds as sessions close. Capturing these live state metrics first is critical before any local tools are run that might alter the network socket state or terminate active connections.

Developing, documenting, and testing incident response playbooks through tabletop exercises or simulations is a fundamental task of the Preparation phase. This proactive step ensures that the incident response team has validated, repeatable procedures to follow when an active threat is detected. It establishes the necessary operational readiness before any actual security incident occurs.

Access review documentation is primary audit evidence because it shows a periodic recertification of user entitlements against role definitions, least privilege, and separation of duties. It provides an auditable trail of who reviewed critical systems, what discrepancies were detected, and how they were remediated, directly satisfying access control compliance requirements. Auditors frequently cite missing or outdated access reviews as a material finding, so this documentation is a cornerstone of evidence collection.

Negotiating protocol versions directly with the service confirms what the endpoint actually accepts, rather than relying on the owner's configuration claim. A TLS client or scanner profile that offers TLS 1.0 will reveal whether the handshake succeeds, providing evidence before the finding is closed or downgraded.

Structured Threat Information Expression (STIX) provides a standardized XML/JSON schema to represent cyber threat intelligence, while Trusted Automated Exchange of Intelligence Information (TAXII) is the application-layer protocol used to securely route this data. MISP natively supports STIX/TAXII to enable automated, machine-to-machine sharing of indicators of compromise (IoCs) and threat actor profiles across diverse security tools.

Vulnerability A represents the highest immediate risk due to its critical severity rating and presence on an internet-facing system. This combination means it is highly susceptible to exploitation by external threat actors, potentially leading to severe data breaches, system compromise, or service disruption without requiring prior internal access. Remediation of such a vulnerability must be the absolute top priority to mitigate the most significant and accessible threat to the organization.

Effective incident response requires translating technical findings into business impacts to facilitate rapid executive decision-making. By outlining clear recovery paths, such as restoring from offline backups versus the legal and financial risks of paying a ransom, the security team empowers the CEO to make informed risk-management choices.

Adding logical conditions, such as requiring the presence of an auxiliary malicious string or a specific file header, increases the rule's specificity. This multi-indicator approach significantly reduces false positives by ensuring the rule only triggers when a combination of unique threat characteristics is met, rather than a single, potentially benign string.

YARA rules are highly effective for endpoint detection of a known ransomware strain because they can match on multiple characteristics beyond simple hashes—such as unique strings, mutex names, byte patterns, PE section anomalies, and file metadata. By creating a rule that evaluates file content and structure, the team can identify the malicious payload regardless of filename or hash mutation (e.g., hash-busting variants), enabling rapid triage on forensic images and live systems. This directly addresses the immediate need to recognize the specific ransomware artifacts that were observed during the incident.

Lynis is an open-source, battle-tested security auditing tool specifically designed for Unix-like operating systems, including Linux and macOS. It runs locally on the host to perform deep scans of system configurations, bootloaders, kernel parameters, and installed packages, providing actionable hardening recommendations to improve overall system defense.

This behavior is characteristic of malware beaconing, where a compromised host establishes periodic, scheduled outbound connections to a command-and-control (C2) server to receive instructions. Utilizing port 443 allows this malicious traffic to blend seamlessly with legitimate, encrypted HTTPS web traffic, bypassing basic firewall inspection.

Wireshark is a graphical packet analyzer that allows analysts to perform deep packet inspection on captured network traffic. By reconstructing TCP streams and dissecting application-layer payloads, it enables the precise identification of sensitive data being exfiltrated. This granular visibility is crucial for verifying the exact contents of suspicious transmissions.

Cloud audit logs record control-plane API activity, capturing IAM policy changes, access key creation and console authentication events. These identity and key-management entries directly evidence or refute compromise of the tenant's management plane, unlike data-plane or host telemetry.

Describing potential financial loss, reputational damage, and regulatory fines directly maps the risk onto the board's fiduciary duties, giving them the essential information needed for risk tolerance and resource allocation. This approach quantifies or estimates impact in the same units executives use to evaluate business decisions, such as ERM frameworks and insurance. It lets the CISO argue for security investment as a business trade-off, which is the only frame that produces meaningful discussion and sign-off.

Lynis is an open-source, host-based security auditing tool specifically engineered for Unix, Linux, and macOS systems. It conducts deep local scans to evaluate system hardening, detect configuration flaws, and verify compliance with frameworks like PCI-DSS and ISO 27001. Unlike network scanners, it runs directly on the target operating system to inspect local configuration files and system parameters.

When a user opens a malicious Office document, embedded macros or OLE objects can trigger the execution of code. This often involves the Office application (e.g., Word, Excel) launching a script interpreter like PowerShell, cmd.exe, or wscript.exe under the user's security context. This process chain (Office app spawning a script interpreter) is a classic initial access vector for malware, allowing attackers to download further payloads or establish persistence on the compromised system.

Establishing a rigorous chain of custody is the foundational requirement for ensuring the integrity and legal admissibility of any collected evidence. This process meticulously documents who collected, accessed, transferred, and secured the evidence at every stage of the incident lifecycle. Without this continuous paper trail, the evidence can be easily challenged as tainted or manipulated.

Utilizing an advanced memory forensics tool like Volatility allows an analyst to reconstruct active network sockets, identify rogue processes, and extract unencrypted payloads from RAM. This deep-dive analysis can reveal active TCP/UDP connections to external command-and-control (C2) servers or identify the specific buffers used to stage exfiltrated data.

Proper risk management requires documenting the active compensating control, such as a WAF rule blocking the specific exploit vector, within the risk register. Because this control significantly reduces the likelihood of successful exploitation, the risk rating should be adjusted downward to reflect the actual residual risk. This ensures accurate reporting and prioritization for the security team.

Immediately isolating the web server is crucial for containment, stopping the active reverse shell and preventing lateral movement. Capturing full disk and memory images preserves all forensic evidence, including the kernel rootkit and attacker activities, for post-incident analysis. Reimaging the server from a trusted source and restoring known clean application data ensures complete eradication of all malicious components and persistence mechanisms, preventing re-infection and ensuring system integrity.

This pattern of sending SYN packets, receiving SYN-ACK responses, and intentionally withholding the final ACK packet is the hallmark of a TCP SYN flood. By leaving these connections half-open, the attacker rapidly exhausts the target's connection queue (backlog queue), rendering the service unavailable to legitimate users.

A documented risk acceptance must record the risk owner, justification, compensating controls, review date and expiry so the SOC manager can track accountability and ensure the deferral is revisited. This satisfies the requirement that delayed remediation be formally governed rather than silently ignored.

The Exploit Prediction Scoring System (EPSS) is a data-driven model that estimates the probability that a specific vulnerability will be exploited in the wild within the next 30 days. By integrating real-time threat intelligence and historical exploit data, EPSS allows security analysts to prioritize remediation efforts based on actual threat activity rather than theoretical severity alone.

Parameterized queries, also known as prepared statements, are the most effective defense against SQL injection because they fundamentally separate the SQL code from user-supplied data. The database engine first compiles the query structure, then binds user input as literal data values, ensuring that any special characters in the input are treated as data, not executable SQL commands. This prevents attackers from altering the query's intent by injecting malicious SQL syntax.

Mean Time to Detect is the primary security metric used to calculate the average elapsed time between the initial occurrence of a security compromise and its formal identification by security tools or analysts. Reviewing MTTD during post-incident activities helps organizations evaluate the effectiveness of their monitoring controls, SIEM correlation rules, and threat hunting capabilities.

Summarizing the vulnerability in terms of its business risk, potential financial impact, and a recommended mitigation timeline is the most effective communication strategy for management. This approach translates complex technical issues into terms that resonate with their strategic priorities, such as potential revenue loss, regulatory fines, or reputational damage. Providing a clear action plan and timeline empowers them to understand the urgency, allocate necessary resources, and make informed decisions regarding risk acceptance or mitigation.

This scenario represents a classic true positive for a brute-force attack, where an attacker systematically attempts numerous credential combinations against a single account from a single source IP until succeeding. The sequence of multiple rapid authentication failures followed immediately by a successful login is a high-fidelity indicator of compromise (IoC) that confirms the attack was successful.