CompTIA CySA+ CS0-003 (CS0-003) — Questions 526–600

The vector indicates Network attack vector, Low attack complexity, No privileges required, No user interaction, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. For CVSS v3.1, this corresponds to a base score of 9.8 (Critical).

Option C is correct because defining queue ownership and escalation thresholds ensures that alerts are assigned to a specific team or individual and have a clear path for escalation if not acknowledged within a defined time. This directly addresses the root cause of the alert never being triaged by enforcing accountability and automated follow-up, which is a standard incident response practice per NIST SP 800-61.

CVSS v3 (Common Vulnerability Scoring System) is the industry-standard framework for prioritizing vulnerabilities based on exploitability and impact. It provides a numerical score (0-10) derived from metrics such as Attack Vector, Attack Complexity, Privileges Required, User Interaction, and Scope, along with Confidentiality, Integrity, and Availability impact. This allows analysts to objectively rank vulnerabilities for remediation.

Defining a single point of contact (POC) for each stakeholder group ensures clear, controlled communication and prevents conflicting information. Pre-approved templates for different incident types enable rapid, consistent, and accurate notifications without needing to craft messages from scratch during a crisis. An escalation matrix with authority levels ensures that decisions are made by the appropriate personnel based on incident severity, preventing delays and unauthorized actions.

Option D is correct because remediation priority in vulnerability management is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API server has high business impact and exposure to external threats, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based prioritization frameworks such as CVSS environmental metrics and FAIR analysis.

Option B is correct because the immediate priority is to revoke the compromised cloud access key to prevent further unauthorized use, while simultaneously reviewing logs to understand the scope of the attacker's actions. In a regulated payment environment (e.g., PCI DSS), failing to disable the key promptly could lead to a data breach and non-compliance penalties. Reviewing actions with the key is essential for incident response and forensic evidence collection.

Short-term containment aims to stop the immediate threat. Disabling accounts and blocking malicious domains are quick containment actions.

Registry Run keys (T1547.001), scheduled tasks (T1053.005), and services (T1543.003) are common persistence mechanisms. Startup folders are also common but are not listed as a separate option here; the three listed are correct.

The immediate priority after credential compromise is to secure the account and prevent unauthorized access. Resetting the employee's password (Option D) invalidates the stolen credentials, stopping the attacker from using them to log in. This aligns with the NIST Incident Response Framework's containment phase, which must occur before any remediation or analysis steps.

CIS Level 1 benchmarks are intended to provide a baseline security configuration without causing significant operational impact.

Option C is correct because a failed alert integration indicates a gap in accountability and process validation. The corrective action must assign a named owner, set a due date, define acceptance criteria, and include a retest plan to ensure the integration is properly configured and monitored. This aligns with ITIL's change management and incident management practices, where ownership and verification are critical to closing the loop on failed controls.

Server-Side Request Forgery (SSRF) occurs when an attacker can induce the server to make requests to arbitrary URLs, often by manipulating a URL parameter.

Option B is correct because when a business unit accepts the risk of delaying a patch, the risk register must be updated to formally document the risk acceptance. This update should include the risk owner, the business justification for the delay, an expiry date for the exception, and any compensating controls (e.g., network segmentation, enhanced monitoring) that reduce the risk during the gap. This ensures the risk is tracked, reviewed, and eventually remediated, aligning with vulnerability management best practices.

Tactical intelligence includes IoCs such as IP addresses, domain names, and hashes that can be used for detection and blocking.

User and Entity Behavior Analytics (UEBA) is specifically designed to establish baselines of normal user behavior and detect anomalous activities—such as unusual login times, impossible travel, or abnormal data access patterns—that may indicate a compromised account. Unlike signature-based tools, UEBA leverages machine learning and statistical modeling to identify deviations from established norms, making it the correct choice for detecting account compromise.

NetFlow collects metadata about network flows, including destination IP and port, enabling analysts to query for all traffic on a specific port across the network.

Option B is correct because identifying affected assets and their owners is essential for accountability and remediation. Without this information, system owners cannot determine which systems require patching or configuration changes, making the report non-actionable. This aligns with the NIST SP 800-40 Rev. 4 guidance on vulnerability management, which emphasizes asset ownership as a prerequisite for response.

Option D is correct because the incident responder must first revoke the malicious OAuth app grant to immediately stop the attacker's access via the delegated mailbox permissions. Following revocation, reviewing mailbox access logs (e.g., Mailbox Audit Log, EWS/Graph API calls) is essential to assess the scope of compromise, and identifying other users who consented to the same app is critical to contain lateral movement. This aligns with the NIST SP 800-61 incident response lifecycle's containment and eradication phase.

Option D is correct because the immediate priority is to revoke the malicious OAuth consent grant, which removes the app's access to the mailbox via the Microsoft Graph API. Reviewing mailbox access (e.g., via Exchange Online audit logs) is necessary to assess data exfiltration, and identifying other users who consented helps contain a potential phishing campaign targeting the same app. This follows the NIST SP 800-61 incident response process for containment, eradication, and recovery.

Fileless malware operates in memory without writing to disk, so capturing a memory image or live response data preserves the malicious code, injected DLLs, and process hollowing artifacts that would vanish on reboot. Active network connections and running processes reveal the malware's C2 communications and its in-memory execution context, which are critical for identifying the infection vector and scope.

Verification is the phase where after remediation, the system is rescanned or checked to confirm the vulnerability is mitigated.

Isolating the workstation is the best immediate action because the EDR alert confirms active compromise: a malicious encoded PowerShell command executed via cmd.exe spawned svchost.exe (a process commonly abused for masquerading), and an outbound connection to the same C2 server on port 443 (HTTPS) indicates ongoing data exfiltration or further payload delivery. Network isolation stops all communication with the attacker while preserving forensic evidence on the endpoint, which is critical for containment in a SOC response.

Option B is correct because the database server is in production and cannot be taken offline, so the patch must be applied during a scheduled maintenance window to minimize business disruption. The vulnerability is high-severity, but the vendor requires a reboot, which would cause downtime; therefore, the first step is to plan the patch application at the next available maintenance window, not to apply it immediately or implement a workaround that may not fully mitigate the risk.

A standard vulnerability report includes an executive summary for high-level decision-makers, findings grouped by severity, risk acceptance decisions, and a remediation timeline.

Option A is correct because HTTP 200 responses from a WAF-protected endpoint do not rule out successful SQL injection; the application may have processed the malicious input without triggering an HTTP error. Reviewing application logs for query errors, authentication anomalies, and abnormal database access provides direct evidence of whether the injection actually succeeded, which is essential before declaring compromise. This approach balances containment by not disrupting legitimate traffic while preserving forensic evidence for analysis.

Vulnerability scan reports show identified vulnerabilities, and patch management reports show remediation efforts, together demonstrating the vulnerability management lifecycle.

GDPR Article 33 requires that data breaches be reported to the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

The alert is triggered by legitimate administrative activity (SCP file transfer), so it is a false positive. The analyst should tune the SIEM to reduce similar alerts.

Remediation priority is determined by risk, which combines asset criticality, exposure, and business impact. The public payment API has high exposure (internet-facing) and high business impact (PCI DSS compliance, financial data), while the lab server is isolated and non-production. A vulnerability scanner like Nessus or Qualys uses asset tags and CVSS environmental metrics (e.g., modified impact sub-scores) to calculate a risk-based priority score, not the number of installed fonts or dashboard color.

Boards care about business impact, not technical details. Quantifying financial exposure helps them understand urgency.

Preparation includes creating and training the incident response team, acquiring tools, and establishing procedures. A well-trained team is critical to executing the response effectively.

GDPR Article 33 requires notification to the supervisory authority within 72 hours of awareness.

MTTD is specifically defined as the average time to detect an incident.

Option B is correct because the analyst must first confirm whether the outbound connections are actually exfiltrating data or are legitimate (e.g., software updates, license checks). Capturing and analyzing the network traffic (e.g., using tcpdump or Wireshark) allows the analyst to inspect the payload and determine the nature of the data being sent, which is a standard step in incident response before taking more disruptive actions.

Sequential correlation is the correct choice because it detects a specific ordered sequence of events: multiple failed logins followed by a successful login from the same source IP within a defined time window. This pattern is characteristic of a brute-force attack, where an attacker attempts many passwords before succeeding. SIEM tools like Splunk or QRadar use sequential correlation to match event chains where the order matters, not just the count or aggregation of events.

LiME (Linux Memory Extractor) is a loadable kernel module that captures memory with minimal footprint, suitable for live acquisition on Linux systems.

Option D is correct because the vulnerability report is based on a false positive: the scanner misidentified the service on port 3307 as MySQL due to an incorrect port mapping in its fingerprinting database, while the actual service is a fully patched PostgreSQL. Since MySQL is not installed and no actual vulnerability exists, marking the finding as a false positive and suppressing it for this asset is the appropriate response in a production environment that cannot be disrupted.

Conducting a root cause analysis identifies the underlying vulnerability or weakness that allowed the attack, enabling targeted remediation.

Software composition analysis (SCA) is the correct control because it automatically scans the project's dependencies against known vulnerability databases (e.g., NVD, GitHub Advisory Database) to identify vulnerable open-source libraries before deployment. Integrating SCA into the CI/CD pipeline ensures that vulnerabilities are caught early in the development lifecycle, aligning with the shift-left security principle without suppressing or masking risk.

Time synchronization and timezone normalization across log sources is the correct first check because a consistent five-minute offset between firewall and endpoint events for the same connection strongly indicates a clock drift or timezone misconfiguration rather than a security anomaly. In incident reconstruction, analysts must ensure all timestamps are aligned to a common reference (e.g., UTC) and that NTP is properly configured on all devices; otherwise, the timeline is unreliable. This step directly addresses the root cause before any triage or prioritization can occur.

Privileged containers and hostPath mounts are known high-risk misconfigurations in Kubernetes.

CIS Level 1 benchmarks are intended to provide a clear security benefit without significantly impacting functionality or performance. Level 2 benchmarks provide more stringent security but may reduce functionality or require additional operational effort.

DNS normally uses UDP, but TCP port 53 can be used for DNS tunneling. The small, irregular connections to a single external IP suggest data exfiltration via DNS tunneling.

The first step is to verify the alert is a true positive by checking the user's activity and the file's sensitivity. Prematurely blocking or reporting may be incorrect if the alert is a false positive.

The executive team requires a high-level, strategic view of security effectiveness, not granular operational data. The overall risk posture score with trend over time directly communicates the organization's security health and whether it is improving or deteriorating, enabling informed decision-making. This aligns with the Reporting and Communication domain's emphasis on translating technical metrics into business-relevant insights.

Reflected user input in responses without encoding is a classic sign of Cross-Site Scripting (XSS), which falls under injection in OWASP Top 10 (though XSS is specifically listed as a separate category in some versions, but in 2021 it is under injection).

Data types (e.g., PII, PHI, PCI) and affected jurisdictions determine legal notification obligations under regulations like GDPR, HIPAA, or CCPA. Jurisdictions dictate breach notification timelines and penalties, making this information critical for legal and privacy teams to assess risk and compliance. Without this detail, the response cannot be properly scoped or legally defensible.

DNS tunneling often uses port 53 to exfiltrate data by encoding it in DNS queries. The consistent low-volume traffic to a single external IP suggests covert communication.

B is correct because a high volume of outbound traffic to an unusual destination IP on port 443 (HTTPS) is a classic indicator of data exfiltration or C2 communication, as attackers often use encrypted channels to blend in with legitimate web traffic. The combination of high volume and an unusual destination IP suggests the host is sending data to an external server controlled by the attacker, which is a key sign of an active C2 session.

Testing patches in a staging environment that mirrors production helps identify issues that could cause outages or incompatibilities.

Board members are non-technical stakeholders who need to understand the business impact. The communication should translate technical details into financial, reputational, and regulatory consequences.

Software composition analysis (SCA) is the correct control because it specifically scans open-source libraries for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures that vulnerable dependencies are detected automatically before code is deployed, enabling early remediation without manual overhead.

Forensic sound procedures include using write blockers to prevent alteration, verifying integrity with hashes, and documenting the chain of custody. Running a live scan would alter data.

The scheduled task creation is a persistent mechanism that can be detected via monitoring for new scheduled tasks.

Network isolation (disconnecting the affected system from the network) is a quick short-term containment step that stops the ransomware from communicating with C2 or spreading laterally.

Option B is correct because the first step is to verify whether the attack succeeded by checking the server logs. Premature blocking or shutdown may be unnecessary.

Option A is correct because the immediate priority is to stop the data leak by restricting public read access to the storage bucket, then investigate whether sensitive data was actually accessed. This aligns with the incident response principle of containment before analysis. In cloud environments like AWS S3 or Azure Blob Storage, a bucket with public read access exposes all objects to the internet, and the first step is to apply a bucket policy or ACL to deny public access.

Option B is correct because a true brute-force attack typically originates from multiple source IP addresses or a single source with a high frequency of failed logons over a short time window, whereas a misconfigured service account usually fails from a consistent source at regular intervals. Analyzing the source distribution and timing of failed logons helps distinguish automated attack patterns from predictable service account behavior, such as retry intervals defined in application configuration.

MTTD, MTTR, and MTTRem are standard SOC metrics to measure detection and response effectiveness.

Option D is correct because TXT records are commonly used in DNS tunneling to encode exfiltrated data. Attackers embed data in TXT record queries or responses, and a high volume of such queries is a strong indicator of data exfiltration via DNS.

To avoid false positives, the rule should specify the process name (rundll32.exe) and the command-line argument containing a path to a temp directory, as legitimate uses rarely involve DLLs from temp folders.

Option D is correct because a post-incident review in a regulated payment environment must produce actionable improvements to prevent recurrence. Delayed escalation indicates a failure in detection or notification procedures, so the review should yield specific playbook updates, escalation triggers, assigned owners, and due dates to ensure timely response in future incidents. This aligns with NIST SP 800-61r2 and PCI DSS requirements for continuous improvement of incident response processes.

NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.

Control effectiveness evidence, such as penetration test results and audit reports, directly demonstrates how well controls are working.

Reviewing audit logs for actions performed with the compromised key is appropriate during containment because it allows the incident response team to determine the scope of unauthorized access, identify affected resources, and understand the attacker's actions. This step is critical for informed decision-making before revoking or rotating the key, ensuring that legitimate operations are not disrupted and that forensic evidence is preserved.

Option C is correct because the best immediate action when a HIDS alerts on a critical configuration file change is to first verify whether the change was authorized through the change management system. This aligns with the incident response process of validation before remediation; reverting or restoring without checking could disrupt approved maintenance or patch deployments. HIDS monitors file integrity via checksums (e.g., SHA-256), but it cannot distinguish approved changes from malicious ones without external context.

AWS CloudTrail records API activity, and GuardDuty provides threat detection. Both are native services for investigation.

When a business unit formally accepts the risk of delaying a patch due to contractual constraints, the risk must be documented in the risk register. This entry should include the owner, justification, expiry date, and compensating controls to ensure the risk is tracked, reviewed, and eventually remediated. This aligns with the vulnerability management lifecycle, where accepted risks require formal documentation and periodic reassessment.

With high exploitability (EPSS), immediate action is needed. Applying a hotfix or workaround, such as updating the affected package in running containers, reduces risk while a full rebuild is planned.

The alert is triggered by a real failed login attempt from an internal IP, but the user is on vacation, so it likely indicates a malicious attempt. Since it is a confirmed security incident, it is a true positive.

Deep packet inspection (DPI) of DNS traffic is the best evidence because DNS tunneling works by encoding data within DNS queries and responses, often using non-standard record types (e.g., TXT, NULL) or unusually long domain names. DPI can decode the payload within DNS packets to reveal hidden data, whereas other methods only see metadata or connection summaries. This allows the analyst to directly inspect the content of DNS messages for signs of exfiltration, such as base64-encoded data or anomalous query patterns.

Disconnecting the infected workstation from the network stops the ransomware from spreading to other systems via network shares.