CompTIA CySA+ CS0-004 (CS0-004) — Questions 451–525

Root cause analysis (RCA) is performed during the post-incident phase to identify the fundamental vulnerability or vector that allowed the compromise to occur. By pinpointing the exact failure point, security teams can implement permanent corrective controls rather than just treating the symptoms of the attack. This prevents future occurrences of the same exploit.

Process hollowing is a defense evasion technique where an adversary spawns a legitimate process like svchost.exe in a suspended state, unmaps its memory, and replaces it with a malicious payload. This allows the malware to masquerade as a trusted system process, hiding its true nature from basic process-monitoring tools while executing unauthorized code.

Kerberoasting involves an attacker requesting service tickets (TGS-REQs) for various Service Principal Names (SPNs) registered in Active Directory. These tickets contain a hash of the service account's password, encrypted with the service account's NTLM hash. A high volume of TGS-REQ requests from a single workstation, especially for numerous different service principals, is a strong indicator of an attacker attempting to harvest these tickets offline for brute-forcing the password hashes to gain credentials.

Cloud audit logs capture control-plane API calls such as IAM policy changes, access key creation and console sign-in attempts, tying each action to an identity and source IP. This directly evidences control-plane compromise, unlike data-plane or endpoint telemetry.

Running sha256sum directly against the image file recomputes its SHA256 digest using the same algorithm and tool convention as the original acquisition hash, producing a value the analyst can directly diff against the recorded original hash to confirm bit-for-bit integrity and an unbroken chain of custody before proceeding with analysis.

When threat actors compromise AWS IAM credentials, they frequently target unused geographical regions to evade detection while spinning up high-performance EC2 instances for illicit cryptocurrency mining. This anomalous behavior is flagged in CloudTrail logs by API calls like RunInstances originating from unfamiliar IPs and targeting non-standard regions, which deviates sharply from established baseline activity.

Executive leadership is the primary audience for strategic intelligence because it informs high-level decisions about risk tolerance, resource allocation, and business continuity. This type of intelligence is written in non-technical language, summarizing geopolitical threats, industry-level trends, and potential impacts to the enterprise in a way that supports governance and investment choices. It helps the C-suite align cybersecurity with organizational objectives, not with day-to-day tactics.

When assessing a critical vulnerability, the asset's value and its criticality to business operations are paramount. This factor directly determines the potential impact of a successful exploit, which is a core component of risk calculation (Risk = Threat x Vulnerability x Impact). A critical vulnerability on a low-value, non-essential asset poses less overall risk than the same vulnerability on a high-value, mission-critical system, dictating immediate prioritization.

Performing a targeted follow-up scan is the critical first step to validate that the identified vulnerabilities have not already been mitigated by automated patching or configuration changes. This prevents the analyst from wasting organizational resources on false positives or outdated scan data before initiating formal remediation workflows.

Correlating the service account's authentication history, the source system's process and event logs, and any recent configuration changes lets the analyst distinguish between an expired or rotated credential causing benign failures and genuine credential misuse, which is the necessary evidence-gathering step before any containment decision is made.

The CISA KEV catalog's defining criterion is real-world exploitation evidence; CISA adds a CVE only after confirming it has been actively exploited in the wild, which is why federal agencies under Binding Operational Directive 22-01 must remediate KEV-listed vulnerabilities on an accelerated timeline regardless of their CVSS score.

Server-Side Request Forgery (SSRF) occurs when a web application fetches a remote resource without validating the user-supplied URL. This allows an attacker to coerce the vulnerable server into sending crafted requests to internal-only resources, such as loopback interfaces, local databases, or cloud metadata endpoints (like AWS IMDSv1), effectively bypassing perimeter firewalls.

This option is correct because the policy contains an explicit Deny statement for all s3:* actions, which lacks any limiting conditions such as aws:SourceIp. According to AWS IAM policy evaluation logic, an explicit Deny always overrides any explicit Allow statements. Consequently, all S3 actions are denied for all principals, regardless of their source IP address, effectively nullifying any Allow rules.

Vulnerability scan reports and access review logs serve as direct, empirical evidence of technical control implementation and operational effectiveness. These artifacts prove to auditors that vulnerability management processes are actively running and that identity and access management controls are being routinely monitored and enforced. This objective, system-generated data is crucial for validating compliance with frameworks like PCI-DSS, SOC 2, or ISO 27001.

A spike in outbound traffic from a server is inherently suspicious, necessitating immediate investigation. Querying threat intelligence platforms (TIPs) or open-source intelligence (OSINT) feeds with the destination IPs is a crucial initial step in incident response. This action quickly correlates observed indicators of compromise (IOCs) with known malicious infrastructure, such as command-and-control (C2) servers, botnet nodes, or phishing sites. This provides immediate context on the potential threat actor or malware family involved, allowing the analyst to rapidly assess the severity and nature of the incident without disrupting operations.

The executive summary is the most critical section for management because it distills the entire vulnerability assessment into a concise, high-level overview of the organization's risk posture. It should highlight the total number of vulnerabilities, the most severe threats, and the recommended strategic actions without overwhelming readers with technical CVSS vectors or exploit details. Management needs this to make informed decisions on resource allocation and risk acceptance, making it a mandatory component of any vulnerability report.

Container runtime events, such as those from an agent like Falco or eBPF, directly monitor process execution, file system access, and system calls within the container, immediately flagging an unexpected shell or host mount. Kubernetes audit logs capture API server requests, revealing if the container's configuration was modified or if a privileged pod was created, indicating orchestration-level compromise. Network flow from the pod provides crucial visibility into any attempted exfiltration or command-and-control communication initiated by the compromised container, completing the forensic picture. Together, these telemetry sources offer comprehensive detection and context for container escape attempts.

When a user account suddenly executes unauthorized API calls to alter network configurations or security groups, it strongly suggests an adversary is attempting privilege escalation or lateral movement. By modifying these boundaries, the attacker aims to establish broader access to sensitive cloud resources or bypass existing security controls.

Email subject lines and sender domains serve as highly effective, static indicators of compromise that can be ingested directly into secure email gateways (SEGs) to block incoming campaigns. By creating transport rules or blocklists based on these specific header elements, security analysts can proactively intercept and neutralize widespread phishing waves before users interact with them.

Threat modelling systematically enumerates threats against the application's architecture, data flows and trust boundaries before any testing begins, satisfying the stem's requirement to identify vulnerabilities specific to this application. Unlike vulnerability scanning, which only detects known signatures, it exposes design-level weaknesses such as insecure data handling of sensitive customer information.

Patch SLA compliance percentage directly measures whether systems are being patched within the timeframes the organization has committed to, for example critical patches within 14 days, which is precisely what a management-facing compliance dashboard needs to show for the patch management program. It ties directly to the process being audited rather than to an adjacent security function.

WHOIS queries domain registration databases, returning registrar, registrant contact, creation and expiration dates, and nameserver records. For an IOC like a known malicious domain, WHOIS enables analysts to pivot on registration metadata, identify shared infrastructure, or detect typosquatting and recently registered domains. It is a read-only lookup service, not a traffic analysis tool, making it a first-line passive enrichment source.

Identifying the precise root cause and the specific security control gaps that were exploited is fundamental to preventing recurrence. This technical detail allows engineering and security teams to understand exactly how the threat actor bypassed existing defenses, enabling them to deploy targeted mitigations, update firewall rules, or patch specific software vulnerabilities.

Rerouting traffic to a cloud-based DDoS mitigation or scrubbing service (via DNS or BGP redirection) is the most effective containment strategy. This allows the provider to filter out malicious traffic at the network edge using global scrubbing centers, ensuring that only clean, legitimate traffic reaches the organization's origin servers.

Endpoint Detection and Response (EDR) telemetry provides granular, real-time visibility into system activities, including process execution, file modifications, registry changes, and network connections, often stored off-host in a centralized repository. This rich dataset is crucial for forensic analysis as it allows investigators to reconstruct the attack timeline, identify initial access vectors, track lateral movement, and pinpoint malicious binaries or scripts. EDR's continuous monitoring capabilities ensure that even ephemeral attacker actions are captured and available for post-incident investigation.

This is the correct YARA rule syntax. It defines a rule named detect_malware, declares a string identifier $a assigned to the literal byte sequence "evil" inside the strings section, and then uses that identifier as the condition. The condition $a evaluates to true if the string 'evil' is found anywhere in the scanned file. YARA requires a dollar-sign prefix for string identifiers, an equals sign to bind the literal value, and a condition that references the identifier without quotes or further assignment. This rule compiles and will trigger a match when the file contains the specified string.

Raising the risk score threshold means only IPs with very high threat-intelligence risk scores trigger alerts, filtering out lower-scored IPs that legitimate services use. This directly reduces the false positives described in the stem while retaining detection of genuinely high-risk connections.

Different regulations, such as GDPR, HIPAA, or state breach laws, have distinct notification triggers, timelines, and recipients. Before communicating, the analyst must determine which laws apply based on data type, location, and affected individuals. This ensures the organization meets its legal obligations and avoids penalties. It is the foundational step in building a compliant communication plan, as it dictates what, when, and to whom notifications must be sent.

Staging environments often mirror production configurations and may reside on networks with access to sensitive internal resources or active directory domains. Patching this vulnerability immediately is critical because an attacker could exploit the staging server to establish a foothold and perform lateral movement across the corporate network.

Leveraging an established incident response playbook template for report drafting is a highly effective strategy, especially under time constraints. This approach ensures that critical information fields are addressed systematically, even if initial data is incomplete, and allows for the immediate documentation of known facts, timelines, and current status. By explicitly noting information gaps, the report remains transparent about its current state, facilitates timely communication to stakeholders, and provides a structured framework for subsequent updates and refinements as recovery progresses.

The A component of the CVSS v3.1 vector is H, which is the Availability Impact metric and indicates that the exploit can cause a total loss of availability, such as a denial of service. Unlike the C and I metrics, which are both N, the A metric is the only one rated high, so this option correctly identifies the finding's high impact on availability.

Disabling the compromised account is the most immediate and effective containment action to halt active exploitation. It instantly revokes the attacker's access to network resources, cloud services, and email, preventing lateral movement or data exfiltration using those specific credentials. This action buys the incident response team time to investigate the scope of the breach without allowing further unauthorized activity.

The executive summary condenses technical findings into business risk and impact language, giving management a high-level overview without operational detail. It satisfies the audience-specific requirement, unlike the technical sections that enumerate vulnerabilities, affected assets, and remediation steps for practitioners.

Scheduled Tasks (T1053.005) represent a highly common persistence mechanism where adversaries abuse task scheduling utilities, such as Windows Task Scheduler, to execute malicious binaries at specific intervals or system events. This technique directly aligns with the threat hunter's hypothesis of identifying persistent execution methods that survive reboots and user logoffs.

Verbose error messages, such as stack traces or database debugging information returned by an API endpoint, represent a classic security misconfiguration. Properly configuring the application server to suppress detailed debugging outputs and return generic error messages prevents attackers from mapping the internal architecture and finding exploitable vectors.

Network segmentation logically divides a network into smaller, isolated subnets, significantly limiting direct communication paths between different security zones. When combined with strict firewall rules that enforce a "deny by default" policy and only permit explicitly authorized traffic, this architecture severely restricts an attacker's ability to move laterally from a compromised host in one segment to other critical systems in different segments, thereby containing breaches and hindering further compromise.

Process hollowing specifically involves spawning a legitimate system process (like svchost.exe) in a suspended state using the CREATE_SUSPENDED flag, unmapping its original executable code from memory, writing a malicious payload into that hollowed space, and then resuming the thread. This allows the malware to masquerade as a trusted process while executing arbitrary code under its identity.

Quickest way to confirm if it was the user or a compromise.

Attack Vector (AV) is a base metric that describes the context by which a vulnerability can be exploited, such as network, adjacent, local, or physical. This metric directly influences the CVSS exploitability subscore and is fundamental because it determines the remote vs. local nature of the attack. A network attack vector is typically the most severe because it allows exploitation from anywhere on the internet without prior access.

Mean Time To Detect (MTTD) and Mean Time To Respond (MTTR) are crucial operational metrics that directly quantify the efficiency and effectiveness of a security program's incident management lifecycle. MTTD measures the speed at which threats are identified, reflecting the efficacy of monitoring and alerting systems. MTTR assesses the swiftness of containment, eradication, and recovery efforts, indicating the incident response team's proficiency in neutralizing threats and minimizing their impact.

72 hours is the correct timeframe under GDPR Article 33(1), which states that a data breach notification must be made to the competent supervisory authority 'without undue delay' and, where feasible, no later than 72 hours after the controller becomes aware of the breach. This period is a fixed regulatory deadline, and failure to meet it without a documented justification (e.g., complexity of investigation) can result in significant administrative fines.

mshta.exe is a Microsoft HTML Application host that runs .hta files containing VBScript or JavaScript. When invoked with a remote URL, it executes attacker-supplied script directly from the internet, bypassing many application control policies and acting as a living-off-the-land binary (LOLBin). This behavior is highly suspicious because legitimate mshta execution is typically local and user-initiated, not a network fetch of script code.

Using parameterized queries directly addresses the root cause of SQL injection by ensuring that user input is treated strictly as data, not as executable code. This method pre-compiles the SQL statement, defining placeholders for input values. When user data is then bound to these parameters, the database engine interprets it literally, preventing malicious characters from altering the query's structure and effectively eliminating SQL injection vulnerabilities.

MFA fatigue, also known as push-bombing, is a social engineering attack where an attacker repeatedly sends multi-factor authentication push notifications to a target user's device after obtaining their primary credentials. The goal is to overwhelm or annoy the user into inadvertently approving one of the prompts, granting the attacker unauthorized access to the account. This tactic exploits human psychology, relying on the user's frustration or distraction to bypass the intended security control.

Updating the Active Directory Group Policy Objects (GPOs) to enforce the disabled state of the guest account ensures centralized, automated remediation across all target systems. This approach establishes a permanent configuration baseline that actively prevents configuration drift, aligning the environment with the required STIG profile validated by OpenSCAP.

Patching the specific vulnerability that the ransomware exploited is a definitive eradication measure because it closes the door at the root cause, preventing both the current strain and any similar variations from re-entering through the same path. This step, derived from the incident's root cause analysis, is essential for protecting not only the affected hosts but also all other unpatched systems in the environment. Without this patch, even after rebuilding or credential rotation, the same hole remains, leaving the network vulnerable to immediate reinfection.

Requiring a second, corroborating signal significantly enhances the fidelity of an impossible travel alert by reducing false positives. For instance, an impossible travel event combined with a new device registration, multiple failed MFA attempts, or the creation of a suspicious mailbox rule strongly indicates a compromised account rather than a legitimate user action. This multi-factor anomaly detection approach leverages contextual information to differentiate between benign user behavior and genuine threats, making the alert more actionable and reliable.

This option aligns with established security best practices by ensuring the patch is first validated for efficacy and stability on test systems before proceeding. Utilizing the organization's formal change management process ensures that the production rollout is coordinated, scheduled during maintenance windows, documented, and equipped with a rollback plan to minimize operational impact.

Applying a workaround as a compensating control is the most appropriate immediate action when a critical vulnerability is discovered and a vendor patch is not yet available. A compensating control is an alternative security measure that reduces the risk to an acceptable level until a permanent solution can be implemented. This approach effectively mitigates the immediate threat without causing undue operational disruption, balancing security with business continuity.

When functional exploit code is publicly available in repositories like Metasploit or Exploit-DB, the technical barrier to entry for attackers drops significantly. This dramatically increases the likelihood of active exploitation, making it a critical, high-priority factor for immediate remediation over vulnerabilities that remain purely theoretical.

Recently remediated findings awaiting validation belong in remediation performance reporting because they show work completed but not yet confirmed, satisfying the stem's requirement to report progress to asset owners. This distinguishes pending verification from open or closed findings, giving owners an accurate picture of outstanding risk exposure.

HostPath mounts allow a pod to mount an arbitrary path from the underlying node's filesystem directly into the container. Without restrictions such as requiring read-only mounts, allowing only specific directories, or disabling hostPath when possible, a compromised container can read or modify sensitive host files, plant malicious executables, or even achieve full node compromise. This is a critical misconfiguration that directly exposes the host and is absolutely a security risk.

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides threat hunters with a highly structured, granular matrix to map specific behaviors, identify coverage gaps in telemetry, and systematically formulate hypotheses regarding how advanced persistent threats (APTs) might execute actions within an environment.

Trivy is an open-source, fast, and comprehensive vulnerability scanner designed specifically for container images. It scans both OS packages (e.g., Alpine, Debian) and application dependencies (e.g., Python, Node.js) by comparing against a continuously updated CVE database, and it can be easily embedded into CI/CD pipelines with a simple CLI without requiring a separate server. Its low false-positive rate and support for multiple input formats (e.g., Docker, Podman, OCI) make it the most straightforward and effective choice among these options for the security team's container scanning need.

Python paired with the Scapy library provides a powerful programmatic environment to parse packet capture (PCAP) files. It allows analysts to write custom scripts that target specific layers, extract HTTP payload data, programmatically decode base64-encoded strings, and automate the identification of exfiltrated data at scale.

Process hollowing involves spawning a legitimate process in a suspended state, unmapping its original executable image from memory, and replacing it with a malicious payload. Because the process's metadata and path point to a legitimate disk-backed executable while the memory contains unauthorized code, it creates a memory-only execution state that evades standard signature-based detection.

CPU registers and L1/L2/L3 caches represent the absolute highest tier of volatility in digital forensics. This data changes nanosecond by nanosecond as the processor executes instructions, and it is completely lost the moment any tool is run or the system state changes. Analysts must capture this ultra-transient data first to preserve the immediate execution state of the system.

Preserving relevant logs, mailboxes, images, and tickets is a critical action during a legal hold. This involves actively identifying, collecting, and securing all potentially discoverable electronic stored information (ESI) from various sources. These items often contain crucial metadata and content that can serve as evidence in legal proceedings, requiring strict chain of custody protocols to maintain their integrity and admissibility.

Sysmon Event ID 1 provides highly detailed telemetry regarding process creation, including the parent process, command-line arguments, and file hashes. This rich context is essential for Sigma rules designed to detect suspicious command-line flags or anomalous parent-child process relationships.

Broken Object Level Authorization (BOLA) is the most direct and correct answer because it occurs when an API fails to enforce per-object permissions, allowing an attacker to access, modify, or delete another user's data simply by substituting an object ID in an API request. For example, changing 'GET /api/user/123' to 'GET /api/user/456' can expose another user's private information if the server does not verify that the authenticated principal owns the requested object. This flaw is specifically catalogued as API1:2019 in the OWASP API Top 10 and is a primary focus of API penetration testing.

This comprehensive report provides the precise, actionable intelligence a server team needs to efficiently and safely remediate vulnerabilities. By detailing affected assets and their exact package versions, it pinpoints the scope of work, while patch commands or vendor guidance offer clear instructions for implementation. Including a validation method ensures the fix is confirmed successful, and rollback notes provide crucial risk mitigation. This holistic approach enables effective patching and minimizes operational disruption.

This is the correct classification because the SIEM generated an alert for behavior that, while anomalous or aggressive in appearance, is actually benign and pre-authorized. Vulnerability scanners frequently trigger brute-force or account-harvesting alerts during routine credentialed checks. Labeling this as a false positive allows analysts to tune the SIEM rules to exclude the scanner's IP address from future alerts.

Tactical threat intelligence focuses on the immediate, actionable technical details of an attack, such as IP addresses, file hashes, and specific YARA or Snort detection signatures. During an active security incident, SOC analysts rely on this real-time data to rapidly identify, scope, and contain malicious activity within the network.

Emergency patching is a specialized, expedited process designed to rapidly deploy critical security updates to production systems, often bypassing standard testing and change management protocols due to the severe and immediate risk posed by a newly discovered vulnerability. Its primary objective is to quickly mitigate an active threat or prevent imminent exploitation, prioritizing risk reduction over typical operational considerations like extensive pre-deployment testing or scheduled maintenance windows. This approach is reserved for vulnerabilities deemed critical enough to warrant immediate action.

Vulnerabilities with active, publicly available exploits in the wild pose an immediate threat because the barrier to entry for attackers is significantly lowered. Prioritizing these flaws aligns with threat-intelligence-driven vulnerability management, ensuring that organizations defend against active, real-world campaigns before addressing theoretical risks.

Isolating a host in the finance department without confirming the activity's legitimacy is a drastic and potentially disruptive action. Such a measure could severely impact critical business operations, leading to financial losses, operational delays, or an inability to perform essential tasks. Containment actions like isolation should only be executed after confirming malicious intent or unauthorized access, not as a first step during initial analysis.

A robust business justification is paramount for a vulnerability exception request, detailing why immediate remediation is impractical or detrimental to critical business operations. This justification must clearly articulate the operational impact, financial cost, or technical incompatibility that prevents standard vulnerability resolution. It serves as the foundation for management's informed decision to temporarily accept the associated risk, demonstrating due diligence in risk management.

Access review reports provide direct, auditable evidence that an organization regularly evaluates user permissions against the principle of least privilege. These reports document the specific reviewers, the dates of the evaluations, and the formal decisions to approve or revoke access rights, satisfying strict compliance mandates.

When a critical asset is affected by a vulnerability with a high Exploit Prediction Scoring System (EPSS) score, the probability of active exploitation is imminent. Expediting patch testing through an accelerated QA process and utilizing emergency change management procedures balances the urgent need to remediate the flaw with the necessity of preventing operational disruption. This approach ensures the vulnerability is closed rapidly without bypassing critical stability checks.

Outbound beaconing or persistent connections to a known command-and-control (C2) IP address are primary indicators of compromise (IoCs) associated with malware infections, such as trojans or botnet agents. Identifying this traffic during the detection and analysis phase allows analysts to confirm the presence of malicious software executing on the workstation.

GDPR Article 33 explicitly mandates that in the event of a personal data breach, the controller must notify the competent supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights. This is a strict, legally binding timeline tested heavily on the CySA+ exam.

High-severity incidents involve severe degradation of critical services, widespread compromise, or the encryption of multiple production systems by ransomware. This classification triggers immediate escalation, mobilization of the full incident response team, and containment protocols to prevent catastrophic operational downtime or data loss.