CompTIA CySA+ CS0-004 (CS0-004) — Questions 376–450

A registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) is an autostart extension point that launches a specified executable at user logon. Malware frequently adds entries here to achieve persistence, ensuring the malicious code runs on every subsequent login. Sandbox analysis treats this as high-risk because legitimate programs rarely modify such keys during a single execution, especially with randomly named or masqueraded values.

A malicious URL extracted from a phishing email serves as a classic Indicator of Compromise (IOC). Security analysts use these reactive, static artifacts—such as domain names, IP addresses, and file hashes—to identify systems that have already been breached or targeted. Once identified, IOCs are ingested into security tools like SIEMs and firewalls to block future traffic and scope the extent of the intrusion.

This option correctly identifies the essential elements for an executive-level report on a critical vulnerability. Executives require a clear understanding of the business risk posed by the vulnerability, a thorough assessment of its potential customer impact (including legal and privacy implications), the current status of remediation efforts, and the organization's remaining exposure. This strategic information enables informed decision-making regarding resource allocation, risk acceptance, and communication strategies, aligning security posture with business objectives.

OpenSCAP is an open-source security compliance tool designed specifically to audit systems against standardized security baselines, such as the Center for Internet Security (CIS) benchmarks and DISA STIGs. It utilizes the Security Content Automation Protocol (SCAP) to automate configuration compliance checking and vulnerability assessment, making it the ideal choice for verifying adherence to specific security frameworks.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a worst-case scenario where an unauthenticated remote attacker can fully compromise confidentiality, integrity, and availability without user interaction. Because the Scope is Unchanged (S:U), the mathematical formula caps the maximum possible base score at 9.8 rather than 10.0.

Defining clear queue ownership ensures that every alert has a designated team or individual responsible for its review and action, preventing alerts from being orphaned or ignored. Establishing specific escalation thresholds, including time limits and conditions for elevating an alert to higher-tier analysts or management, guarantees timely response and prevents critical incidents from languishing unaddressed. This structured approach is fundamental for efficient and effective security operations center (SOC) workflow and incident management.

CVSS v3 (Common Vulnerability Scoring System version 3) is the industry standard for assessing the severity of software vulnerabilities. It provides a quantitative score from 0 to 10, derived from metrics evaluating exploitability, impact, and temporal and environmental factors. This comprehensive scoring allows organizations to prioritize vulnerabilities effectively based on their potential risk and ease of exploitation, directly addressing the need for a prioritization mechanism.

Remediation priority shifts because risk combines vulnerability severity with asset criticality and exposure. The public payment API carries direct financial and regulatory impact, while the isolated lab server does not, so ordering work by business impact and internet exposure correctly ranks the API first.

Blocking the phishing domain at the email gateway is immediate containment because it prevents subsequent emails carrying the same malicious payload from reaching other recipients, thereby reducing the number of users exposed to the lure. This email gateway control is fast, reversible, and can also block outbound traffic if needed, but it does not remediate credentials that have already been stolen.

Scheduled tasks allow the operating system to launch specified commands or executables on triggers such as system startup, user logon, or defined intervals. Attackers frequently create scheduled tasks that re-download or re-execute malicious payloads, and these tasks persist across reboots by being stored in the Task Scheduler database. Osquery can enumerate them through the scheduled_tasks table, revealing the task name, path, and schedule, which helps identify malicious creations with autorun capabilities.

Resetting the employee's password is the most immediate and effective containment action when there's a strong suspicion of compromised credentials due to a phishing click. This action instantly invalidates any stolen password, preventing an attacker from using it to gain unauthorized access to the employee's account or other systems where those credentials might be reused. It directly mitigates the primary risk associated with credential-harvesting phishing attacks by severing the attacker's access.

Level 1 controls, such as disabling unused filesystems or setting basic password policies, are designed to reduce the attack surface without breaking common applications, making them suitable as a default baseline for nearly any server.

Because the unvalidated URL parameter is used server-side to fetch a resource, an attacker can substitute internal addresses, cloud metadata endpoints, or restricted URLs, forcing the server itself to issue requests it controls, which is the defining behavior of Server-Side Request Forgery.

Tactical threat intelligence focuses on the immediate, real-time indicators of compromise (IoCs) such as malicious IP addresses, domain names, and file hashes. Security analysts ingest this data directly into security information and event management (SIEM) systems and firewalls to automate threat detection and block active attacks.

User and Entity Behavior Analytics (UEBA) is specifically engineered to detect anomalous activities by establishing baselines of normal behavior for users and other entities within an organization's IT environment. It employs machine learning algorithms and statistical analysis to identify deviations from these baselines, such as unusual login times, access to sensitive data, or data exfiltration attempts, which often indicate compromised accounts or insider threats. This makes UEBA the ideal technology for proactive detection of behavioral anomalies.

A NetFlow analyzer aggregates metadata about network conversations, such as source/destination IPs, ports, and timestamps, without the overhead of full packet payloads. This lightweight data structure allows security analysts to rapidly query months of historical traffic across the entire enterprise to pinpoint which hosts communicated with a malicious external IP.

System owners must be able to immediately identify which specific hosts, IP addresses, or application components are vulnerable. Explicitly mapping affected assets to their designated owners ensures clear accountability and prevents critical remediation tasks from being ignored due to ambiguity in organizational responsibility.

Fileless malware resides primarily in volatile memory (RAM) or executes via legitimate system tools like PowerShell or WMI without writing traditional files to the disk. Capturing a memory image or gathering live response data is critical because rebooting or shutting down the system will destroy this volatile evidence, preventing successful forensic reconstruction.

Verification is the closing phase of the lifecycle, where the analyst re-scans or otherwise re-tests the previously vulnerable asset to confirm the remediation was applied correctly and the vulnerability no longer exists, closing the loop before the finding can be marked resolved in the tracking system.

Network isolation immediately severs all communication pathways for the compromised workstation. This critical containment step prevents the malware from exfiltrating data, receiving further command and control (C2) instructions, or attempting lateral movement to other internal systems. It effectively quarantines the threat, buying crucial time for incident responders to analyze the payload and plan remediation without further risk to the broader network.

Scheduling the patch during the next maintenance window represents the best practice for addressing high-severity vulnerabilities in production environments. This approach allows for proper change management, including testing the patch in a non-production environment, planning for potential rollbacks, and communicating downtime to stakeholders. It effectively balances the need for security remediation with the critical requirement for system availability and operational stability, minimizing unplanned service disruptions.

This structure layers an executive summary for quick comprehension, findings grouped by severity for prioritization context, documented risk acceptances for transparency on deferred items, and a remediation timeline for accountability, matching exactly what management-level reporting requires to make informed risk and resourcing decisions without wading through raw technical scan output.

PCI DSS requirement 11.2 mandates quarterly external and internal scans.

Vulnerability scan reports are the primary evidence that an organization is actively discovering weaknesses, as they contain the scan timestamp, authenticated or unauthenticated scan type, CVEs, and CVSS severity scores. They allow auditors to correlate the identified vulnerabilities against the organization's asset inventory and check that coverage includes critical systems. A series of scan reports demonstrates the continuous, recurring nature of the program, which is a core requirement of many compliance frameworks.

The General Data Protection Regulation (GDPR), specifically Article 33, explicitly mandates that organizations must notify the relevant supervisory authority of a personal data breach "without undue delay and, where feasible, not later than 72 hours after having become aware of it." This precise timeframe is crucial for enabling authorities to promptly assess the breach's impact and for organizations to initiate appropriate mitigation actions and fulfill their accountability obligations.

A false positive occurs when a security control incorrectly flags benign, authorized activity as malicious. In this case, the SIEM generated an alert for legitimate SCP transfers, meaning the rule triggered on normal administrative behavior rather than an actual security incident.

Quantifying the unpatched vulnerability in terms of potential financial loss—such as breach response costs, regulatory fines, or lost revenue from downtime—and reputational damage, like customer churn or erosion of brand trust, directly aligns the technical risk with the board's fiduciary responsibilities. This translation reassures executives that their decision allocates resources to protect shareholder value and market standing, not just IT infrastructure.

People execute the plan; without a formed, trained team, detection, analysis and containment stall regardless of tooling. Creating and training the incident response team during preparation directly satisfies the stem's requirement for effective response capability before an incident occurs.

GDPR Article 33(1) sets a hard, maximum deadline of 72 hours after the controller becomes aware of a personal data breach for notifying the supervisory authority, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. The obligation is phrased as 'without undue delay and, where feasible, not later than 72 hours,' meaning 72 hours is the outer statutory limit, not a target. If notification is made after 72 hours, the controller must provide the reasons for the delay under Article 33(5). Thus, 72 hours is the correct and canonical compliance reporting requirement.

Mean time to detect (MTTD) is the average elapsed time between the actual occurrence of a security incident or malicious activity and the moment it is recognized or flagged as suspicious by telemetry, analytics, or an analyst. It is the definitive metric for measuring detection velocity, because it captures the so-called "dwell time" before discovery, where the adversary may be operating unnoticed. Lower MTTD directly reduces the opportunity for attackers to achieve their objectives by limiting the window of undetected access.

Capturing and analyzing the network traffic between the EMR server and the external IP address is the most effective immediate step. This action allows security analysts to perform deep packet inspection, revealing the protocols, data payloads, and true intent of the communication. This critical evidence determines whether data exfiltration is occurring, what specific data is being sent, and if the connection is malicious or benign, enabling an informed and targeted response without premature disruption.

Sequential correlation is precisely engineered to identify a specific series of events occurring in a predefined order, often involving the same entity or asset within a specified time window. This type of rule is ideal for detecting complex attack patterns, such as multiple failed login attempts followed by a successful login from the same user or IP address, which could indicate a brute-force attack or credential stuffing. It explicitly requires Event A to happen *before* Event B, and so on, making it perfect for recognizing a 'pattern of failures followed by success.'

This is the correct action because the scanner has mistakenly identified a web application running on port 3307 as a MySQL database, leading to a false positive vulnerability report. Marking it as a false positive and suppressing it for this asset ensures that security teams are not distracted by irrelevant alerts, allowing them to focus on genuine threats and maintain an accurate vulnerability posture.

Performing a root cause analysis (RCA) allows the incident response team to trace the attack path back to the initial point of entry and understand the vulnerabilities exploited. Implementing targeted remediation based on these findings—such as patching software, disabling unnecessary protocols, or enforcing multi-factor authentication—directly eliminates the security gaps. This is the only action that systematically prevents the same threat actor or campaign from recurring.

Software composition analysis inventories open-source dependencies and their known CVEs, satisfying the requirement to find vulnerable libraries before deployment. Running it in the CI/CD pipeline blocks risky builds at the earliest feasible stage rather than after release.

Negotiating protocol versions directly with a TLS client or version-aware scanner profile confirms whether TLS 1.0 is genuinely accepted, satisfying the need to validate the conflicting scanner finding. Passive inspection or configuration review cannot prove the listener's actual handshake behaviour.

hostPath mounts bind a node's filesystem directory into a pod, breaking container isolation. A compromised pod can then read or write node files, including credentials and the kubelet configuration, escalating beyond its namespace and undermining the cluster's security boundary.

CIS Benchmarks define Level 1 as the core set of security configurations that can be implemented without significantly degrading system functionality or causing incompatibility, making them suitable for most environments. Level 2 extends these settings with more aggressive hardening, such as disabling legacy protocols or tightening file permissions, which may reduce performance, break existing workflows, or require additional operational overhead. This performance-versus-restriction trade-off is the intended distinction.

DNS tunneling encapsulates non-DNS traffic, such as SSH, HTTP, or proprietary data exfiltration protocols, within DNS queries and responses. While standard DNS queries typically utilize UDP port 53, attackers frequently fall back to or abuse TCP port 53 to bypass standard UDP-based inspection filters and transmit larger payloads or maintain persistent, stateful connection channels.

The first phase of the incident response lifecycle following detection is analysis and validation. Analysts must investigate the CASB alert to rule out false positives, determine the classification of the downloaded file, and verify whether the activity constitutes actual unauthorized data exfiltration before initiating containment or eradication protocols.

This metric offers a high-level, aggregated view of the organization's current security health, synthesizing various underlying security controls and vulnerabilities into a single, comprehensible score. Presenting this score with a trend over time allows executives to quickly grasp whether security efforts are improving or deteriorating, enabling strategic resource allocation and risk management decisions aligned with business objectives. It directly addresses the strategic need for understanding enterprise-wide risk.

Injection occurs when untrusted user input is directly interpreted as code by an interpreter. Cross-Site Scripting (XSS) is a specific type of injection vulnerability where malicious scripts are injected into benign and trusted websites. During an OWASP ZAP assessment, the tool identifies this by injecting payload strings and verifying if they execute within the context of the victim's browser session.

Legal and privacy teams must determine regulatory notification obligations, which are strictly dictated by the specific categories of data compromised (such as PII, PHI, or PCI) and the geographic locations of the affected data subjects. Providing this information allows counsel to accurately assess compliance with frameworks like GDPR, CCPA, or HIPAA.

A high volume of outbound traffic directed to an unusual or previously unseen external IP address, especially over port 443, is a strong indicator of potential command-and-control (C2) activity or data exfiltration. Attackers frequently use port 443 to masquerade malicious traffic as legitimate HTTPS, blending in with normal web browsing to evade detection. The sheer volume and unusual destination suggest more than typical user activity, pointing towards a compromised internal host communicating with an external controller.

Validating the patch in a dedicated staging environment that replicates production configurations allows administrators to identify potential software conflicts, performance degradation, or deployment failures. This isolated testing ensures that the update can be safely applied to production systems without disrupting critical business operations.

For a board of directors, information regarding the financial impact, potential reputational damage, and regulatory penalties is paramount because these directly relate to their fiduciary duties and the long-term strategic health of the organization. Understanding the monetary losses, the erosion of public trust, and the legal ramifications enables the board to assess the overall business risk effectively. This critical information guides their strategic decisions on resource allocation, risk mitigation strategies, and governance improvements to protect shareholder value and ensure compliance.

Maintaining a complete chain of custody form is essential because it documents every interaction with the evidence — who collected it, when, where, and how it was handled, transferred, and secured. In court, opposing counsel will attack a gap in this record as evidence tampering or mishandling. A continuous, written log of all actions taken during acquisition and analysis preserves the integrity narrative and is what makes the forensic evidence legally admissible.

Isolating the affected host from the network is the primary containment step during a ransomware incident. This action immediately halts the propagation of the malware to other network segments, prevents the encryption of mapped network shares, and severs command-and-control (C2) communications required for key exchange.

An IDS only detects; the WAF may have blocked the attempt or it may have succeeded. Checking server and database logs confirms whether the injection actually executed, which determines whether this is a true incident requiring response or a blocked attempt to document.

The priority is exposure containment and impact assessment.

Analyzing the source distribution and timing of failed logons is critical for identifying a brute-force attack. A true brute-force often manifests as numerous failed attempts originating from a single or a small cluster of external IP addresses within a short, rapid timeframe, or from a distributed set of IPs attempting a dictionary attack. Conversely, legitimate user errors typically show fewer attempts, slower timing, and originate from expected internal sources. These patterns help differentiate malicious activity from simple user mistakes or misconfigurations.

Mean Time to Respond (MTTR) quantifies how quickly a SOC team takes action to contain an incident after detection. It typically measures the interval between alert triage and the first mitigation step (e.g., isolating a host, blocking a C2 domain), directly reflecting the team's readiness and playbook efficiency. Lower MTTR indicates faster containment, which reduces the attacker's dwell time and prevents lateral movement.

Attackers frequently abuse DNS TXT records because they can hold large, arbitrary strings of text, making them ideal for carrying payload data or receiving commands. A sudden spike in TXT queries, especially to unfamiliar external domains, strongly suggests that an internal host is using these records to bypass traditional firewalls and exfiltrate sensitive data.

Lessons learned should translate findings into trackable process improvements. In eradication, responders need action that reduces risk while preserving the investigation record.

Validating the incident is the crucial initial step in the detection and analysis phase. This involves corroborating the initial alert by reviewing additional data sources such as logs from firewalls, intrusion detection systems, endpoint detection and response (EDR) tools, and network flow data. This process helps to confirm if the alert represents a true security incident, thereby minimizing false positives and preventing the premature allocation of valuable incident response resources to non-threats.

Penetration test results and formal audit reports offer objective, empirical validation of how controls perform under active duress or systematic evaluation. These assessments actively test defenses and verify regulatory compliance, providing the concrete evidence needed to populate a control effectiveness dashboard.

Checking the change management system is the most appropriate initial step because it directly addresses the legitimacy of the HIDS alert. This action allows the analyst to quickly determine if the detected file modification was an authorized, pre-approved change or an unauthorized, potentially malicious event. Validating against a known baseline of approved changes is crucial for efficient and accurate incident triage, preventing unnecessary escalation for legitimate activities.

A true positive occurs when a security monitoring tool correctly identifies and alerts on actual malicious or unauthorized activity. In this case, the SIEM alert successfully flagged a genuine security event that requires analyst triage and incident response. Validating true positives is a fundamental step in the incident handling lifecycle before escalating to containment.

Deep Packet Inspection (DPI) involves a thorough examination of the entire network packet, including its application-layer payload, not just the header information. When applied to DNS traffic, DPI can analyze the full content of DNS queries and responses, such as unusually long domain names, non-standard record types, or encoded data within these fields. This capability is essential for identifying the subtle anomalies and data patterns indicative of DNS tunneling, where data is covertly embedded.

Disconnecting the workstation from the network is the most immediate and effective short-term containment action for an active ransomware infection. This action physically isolates the compromised system, preventing the ransomware from communicating with command-and-control servers, exfiltrating data, or attempting to spread laterally to other network resources, shares, or systems. It buys critical time for incident responders to analyze the threat and plan further remediation steps without risking wider network compromise, thus limiting the overall impact of the incident.

Kerberoasting relies on requesting Ticket Granting Service (TGS) tickets for Active Directory service accounts to crack their passwords offline. An unusual spike in TGS requests across multiple distinct Service Principal Names (SPNs) from a single user account is a strong indicator of an attacker scanning and harvesting tickets for offline brute-force attacks.

Chain of custody records evidence handling and integrity from collection onward. In post-incident improvement, responders need action that reduces risk while preserving the investigation record.

Disconnecting the network cable immediately isolates the compromised server from the network, preventing further malicious activity such as data exfiltration, lateral movement, or command-and-control communication. This crucial containment step preserves the current volatile system state for subsequent forensic acquisition without introducing significant changes, allowing for a more accurate investigation.

The DAST scanner only crawls unauthenticated content, so it never reaches pages behind login. Configuring authenticated scanning with a test account and session handling lets the scanner maintain a valid session and crawl restricted areas, directly improving coverage and finding quality.

Configuration drift is the gradual and often unnoticed deviation of a system's current configuration from its intended, documented baseline. It results from incremental changes such as manual edits, emergency fixes, unpatchable workarounds, or inconsistent patch deployments that accumulate over time without change-control approval. This divergence can lead to security weaknesses, compliance violations, and unpredictable behavior, making it a central concern for configuration management.

Implementing compensating controls is often the most practical and immediate action when direct patching or full remediation of a vulnerability is not immediately feasible due to operational constraints, system stability concerns, or vendor limitations. These alternative security measures, such as deploying a Web Application Firewall (WAF), configuring Intrusion Prevention System (IPS) rules, or segmenting networks, effectively reduce the likelihood or impact of exploitation. This approach allows the organization to reduce risk and maintain business continuity until a permanent solution can be applied.

The HKCU\Software\Microsoft\Windows\CurrentVersion\Run key causes the referenced program to execute automatically at user logon, establishing persistence across reboots. The outbound port 443 connection indicates command-and-control, and the dropped system32 DLL is a payload artefact, but only the Run key modification ensures the malware survives restarts.

Credentialed scans utilize valid administrative or user credentials to log directly into target systems, enabling the scanner to inspect local registries, installed software versions, and configuration files. This deep visibility allows for the identification of missing patches and misconfigurations that are invisible from the network perspective, minimizing false positives and negatives.

A timeline is a chronological, time-stamped listing of events, actions, observations, and findings that occurred during an incident. It is a foundational component of incident documentation because it establishes the order and timing of events, supporting correlation of security events and response actions. In an incident report, the section 'detailing the sequence' directly maps to the timeline's purpose of recording events in sequence.

Maintaining availability of the service is the paramount objective during an active Distributed Denial of Service (DDoS) attack. The primary goal of a DDoS attack is to overwhelm an organization's resources, preventing legitimate users from accessing critical services. Therefore, the immediate and most critical response is to implement measures that ensure the e-commerce site remains accessible and functional for its customers, directly countering the attack's intent and preserving business continuity.

The standard operating procedure when finding a regression during patch testing is to document the defect and report it to the software vendor. This allows the vendor to refactor the code and release an updated, stable patch. While waiting, the organization should implement compensating controls to mitigate the underlying vulnerability without breaking production systems.

Highest CVSS score (9.8).

Correct. OpenSCAP is built specifically around SCAP standards, consuming XCCDF checklists and OVAL definitions to evaluate a system's actual configuration against CIS Benchmarks or DISA STIGs and producing pass/fail compliance results, which is its primary design purpose.