CompTIA CySA+ CS0-004 (CS0-004) — Questions 601–675

Directing the acquired memory image to a write-blocked destination device is a critical forensic practice that prevents accidental overwriting, modification, or contamination of the evidence. This ensures that the captured volatile data remains in an untampered state from the exact moment of acquisition through the entire chain of custody.

Engaging the vendor for a hotfix or documented workaround while layering compensating controls, such as WAF rules, enhanced monitoring, or restricted access, addresses the vulnerability's risk in the interim without forcing the team to accept either the security exposure or the measured performance degradation.

EDR solutions provide continuous monitoring and threat detection directly on host devices, such as workstations and servers. By analyzing endpoint behavior, running processes, and system files in real-time, EDR allows analysts to identify and rapidly respond to advanced persistent threats that bypass traditional perimeter defenses.

Rerouting traffic through a DDoS mitigation service or scrubbing center is the most effective response because these services employ specialized filtering, rate limiting, and behavioral analysis to distinguish legitimate user requests from malicious traffic, forwarding only clean traffic to the origin. This approach is well-suited for both volumetric floods and application-layer attacks, and it can be activated quickly by updating DNS or BGP to redirect traffic.

Generating a cryptographic hash (such as SHA-256) of the suspicious file and querying threat intelligence databases allows the analyst to quickly identify known malware. This passive analysis technique is safe, efficient, and leverages global threat data without risking exposure or executing the payload.

Wireshark captures and decodes packets in real time or from a saved capture file, reassembling TCP streams and, where the session is unencrypted or keys are available, rendering application-layer payload content, protocol fields, and TLS handshake metadata needed to determine what data is actually being exchanged with the malicious IP.

Identifying patient zero (the initial infected host) and the associated user context is critical during ransomware scoping. This allows analysts to pinpoint the entry vector, such as a phishing email or drive-by download, and determine the privilege level of the compromised account to predict potential lateral movement.

The primary objective of log normalization is to ingest disparate log formats from various vendors—such as firewalls, operating systems, and databases—and map them to a common schema, such as mapping "src_ip", "source", and "src" all to "source_ip". This standardization is essential for SIEM correlation engines to accurately analyze cross-platform events and detect complex attack patterns.

DNS tunneling protocols frequently abuse TXT records because they can carry arbitrary, unstructured text payloads up to 65,535 bytes in size. When an analyst observes unusually large TXT record responses, it strongly indicates that an external server is sending encapsulated payload data or command-and-control instructions back to a compromised internal host.

Disconnecting all network shares is a critical containment step because modern ransomware actively scans for mapped drives and open SMB shares, which it can encrypt just like local disks after compromising a single endpoint. By severing access to shared folders, you eliminate a large portion of the attack surface and prevent the ransomware from quickly encrypting centralized file servers and backup repositories. This action directly limits the blast radius while you deploy more comprehensive containment measures.

Running authenticated scans allows the vulnerability scanner to log into the target Windows servers using provided credentials, gaining internal access to query the operating system directly. This enables the scanner to accurately identify installed software, verify patch levels against known vulnerabilities, and assess local security configurations, providing a significantly more comprehensive and precise vulnerability report. Employing least-privilege credentials for the scanner account is crucial to minimize the potential impact should those credentials ever be compromised, adhering to security best practices.

Because the Pod Security Policy reduces but does not eliminate the vulnerability's potential impact, the correct approach layers remediation with verification: patch the base image to remove the underlying flaw while also confirming the policy's privilege-escalation controls are properly enforced, ensuring both the root cause and the compensating control are addressed rather than relying on either alone.

CVSS is a standardized severity score that synthesizes exploitability characteristics (attack vector, attack complexity, privileges required, user interaction) and impact metrics (confidentiality, integrity, availability) into a 0–10 score. In v3.x, this score provides the critical first filter for triage, allowing an analyst to quickly separate low-severity flaws from those that demand immediate attention. However, it is only a measure of intrinsic severity, not a guarantee of real-world exploitation, so it must be combined with threat likelihood and business impact. As a severity benchmark, it remains the primary initial factor in any prioritization workflow.

Because the vendor no longer supports the application, patching is impossible, so the residual risk must be formally owned. Documented risk acceptance records that decision, compensating controls reduce likelihood or impact, and the migration plan provides a route off the unsupported system.

This metric directly quantifies the ratio of benign events that are incorrectly flagged as malicious alerts out of all truly benign events. When tuning a SIEM to minimize noise, tracking the False Positive Rate allows analysts to verify that rule modifications are successfully reducing erroneous alerts without compromising detection capabilities.

Generating a Software Bill of Materials (SBOM) provides a comprehensive, machine-readable inventory of all third-party components, libraries, and dependencies within a software build. Reviewing these manifests allows security teams to track downstream risks, identify newly disclosed vulnerabilities in existing deployments, and ensure compliance with licensing and security standards.

Checking the user's RBAC role assignments against Key Vault establishes whether Add-AzKeyVaultKey was actually within that person's authorized scope of duties, since a first-time use of a cmdlet by someone who legitimately holds a Key Vault Contributor or Crypto Officer role is far less suspicious than the same call from an account with no assigned Key Vault permissions.

PowerShell (T1059.001) is a sub-technique under Command and Scripting Interpreter that allows adversaries to execute commands, run scripts, and interact directly with the operating system. Threat hunters look for PowerShell commands utilizing cmdlets like 'Invoke-WebRequest' or 'Start-BitsTransfer' because they are commonly abused to download and execute malicious payloads directly into memory.

STIX provides a structured language for describing threat indicators, while TAXII defines the transport protocol for exchanging that data between platforms. MISP natively supports both, satisfying the requirement to structure and exchange threat intelligence with trusted partners. OpenIOC and PDF are unrelated formats, and Microsoft Entra ID governs identity, not intelligence sharing.

Containment should stop encryption spread while preserving evidence for analysis. In containment, responders need action that reduces risk while preserving the investigation record.

Sysmon Event ID 13 specifically monitors registry value modifications, making it highly effective for tracking persistence mechanisms. By targeting the \\CurrentVersion\\Run key path within the TargetObject field, this rule directly alerts on attempts to establish autostart execution points, regardless of the process initiating the change.

Memory dumps preserve volatile evidence such as running processes, injected code and persistence mechanisms that identify the infection vector. Analysing them before restoration satisfies the CISO's requirement to establish root cause, preventing re-infection once systems are rebuilt from backups.

Exposing detailed server version banners is a classic security misconfiguration that leaks valuable reconnaissance data to potential attackers. By failing to disable verbose headers or default error pages, administrators inadvertently assist adversaries in mapping out specific, exploitable vulnerabilities associated with that software version.

Verification is the final, critical step in the vulnerability management lifecycle where analysts perform follow-up scans or manual checks to ensure the patch was correctly installed and the vulnerability is fully mitigated. This step prevents false positives and confirms that the remediation efforts were effective in reducing the organization's attack surface.

In a legitimate Windows environment, svchost.exe (Service Host) is always spawned by the Services Control Manager (services.exe). If the parent process is anything else, such as a web browser, user-space application, or command shell, it strongly indicates process hollowing, DLL injection, or malicious Living off the Land (LotL) activity. Verifying this lineage is the most effective way to confirm whether the process has been hijacked to establish the outbound C2 connection.

In the Common Vulnerability Scoring System (CVSS), an Attack Vector of Network (AV:N) means the vulnerability is exploitable from any remote system that can reach the target over a network connection. This includes sending specially crafted IP packets, protocol-specific requests, or application-layer payloads without requiring any prior authentication or local access. The attacker does not need to be co-located on the target's local subnet, merely capable of network connectivity.

Stored XSS in the comment section is an injection vulnerability because the attacker injects executable client-side script (e.g., JavaScript) that is persisted on the server and later rendered in other users' browsers. Unlike SQL injection, which targets the database layer with structured query language, XSS targets the interpretation context of HTML/JavaScript in the victim's browser. The comment field fails to sanitize or encode user input, enabling script execution that can steal session cookies, deface pages, or perform actions on behalf of the target user.

This is a false positive because the alert fired on a single failed login from a known, trusted internal IP that was immediately followed by successful authentication, a pattern far more consistent with a routine typo than malicious activity; the detection rule's threshold for triggering on just one failed attempt is overly sensitive and should likely be tuned to require multiple failures before alerting.

A true positive represents a successful detection where the SIEM security analytics engine correctly flags actual malicious behavior or policy violations. When an analyst validates that the triggered alert corresponds to genuine adversary activity, such as an active brute-force attack or unauthorized data exfiltration, it confirms a true positive state. This validation initiates the incident response lifecycle.

Threat actors frequently target registry Run and RunOnce keys located within HKLM or HKCU to ensure their malicious payloads execute automatically upon system boot or user logon. This mechanism allows the malware to survive system reboots and maintain a continuous presence within the compromised environment. Consequently, detecting unauthorized modifications to these specific registry paths is a high-fidelity indicator of a persistence establishment attempt.

Implementing and enforcing a configuration management baseline directly addresses the root cause of a high number of open ports. Configuration management tools define the desired secure state for systems, specifying exactly which services should run and which ports should be open. By continuously monitoring and automatically remediating any deviations from this established baseline, it ensures consistent hardening, prevents configuration drift, and proactively closes unnecessary ports across the entire environment, significantly improving the security posture.

SOC analysts are the primary consumers for a report consisting of technical IoCs, as they operationalize these indicators into detection logic such as SIEM signatures and alert rules. The report should be structured to support correlation with telemetry, enabling prioritization and investigation of matching events. For the SOC, IoCs serve as the foundational input for proactive threat detection and ongoing security monitoring.

The most effective remediation strategy for container security is to minimize the attack surface by practicing container hygiene. Requesting that the development team remove the unnecessary library and rebuild the base image permanently eliminates the vulnerability at the source, preventing it from being deployed into production environments.

Running a container in privileged mode eliminates the isolation boundaries enforced by namespaces and cgroups, granting the container near-root access to the host. When combined with a hostPath mount, an attacker can easily access the host's filesystem, manipulate system binaries, interact with the host's container runtime socket, and achieve full container escape to compromise the underlying node.

A timeline is a critical incident response artifact that chronologically documents the exact sequence of events, including initial vector detection, lateral movement, containment actions, and system restoration. Maintaining an accurate timeline is essential for correlating disparate log sources, establishing a clear chain of custody, and providing a structured narrative for forensic analysis, legal compliance, and stakeholder reporting.

Structured Threat Information Expression (STIX) is a standardized serialization format used to model and represent structured cyber threat intelligence. Trusted Automated Exchange of Intelligence Information (TAXII) is the application-layer protocol specifically designed to securely route and exchange these STIX-formatted threat feeds over HTTPS, making them the industry standard for automated threat sharing.

LiME (Linux Memory Extractor) is a kernel-space tool designed specifically for acquiring volatile memory from Linux-based systems. It operates as a Loadable Kernel Module (LKM), allowing it to bypass user-space limitations and capture a full, uncorrupted dump of physical RAM, including volatile artifacts, while minimizing its footprint on the host system.

Implementing automated compliance checks, such as Cloud Security Posture Management (CSPM) tools, directly addresses the root cause by continuously auditing resource configurations against security baselines. These tools provide real-time detection and automated remediation of drift, ensuring that unauthorized public access is blocked immediately upon misconfiguration.

This option accurately reflects a CVSS v3 vector string where the Attack Vector is Network, meaning the vulnerability can be exploited remotely over the internet. It also correctly identifies that the exploit results in a High impact rating for confidentiality, integrity, and availability, indicating total compromise of the affected system.

Sigma is designed as a generic detection-rule format that can be translated into SIEM-specific queries.

DNS logs capture the complete transaction details, including the requested domain names, query types (such as TXT, MX, or CNAME), and the corresponding server responses. This granular payload visibility is essential for identifying the high-frequency, anomalously long, or encoded subdomains characteristic of DNS tunneling and data exfiltration techniques.

Creating a whitelist or exception within the SIEM correlation rule for validated, non-interactive service accounts is the most effective tuning strategy. This approach eliminates high-volume false positives generated by legitimate automated processes while maintaining strict, low-threshold monitoring for standard user accounts. It ensures that any anomalous lateral movement by human adversaries remains highly visible to the security operations center.

Process hollowing launches a legitimate process in a suspended state, unmaps its original executable image from memory, and writes malicious code and a new PE header into that same memory space before resuming execution, which is exactly why memory forensics reveals a legitimate process name like notepad.exe containing a PE header and code that does not match its original binary on disk.

The import table lists external functions and libraries the executable calls, revealing capabilities such as network access, file manipulation, or process injection without running the code. This static inspection satisfies the no-execution constraint while exposing likely malicious behaviour.

Mean time to remediate (MTTR) critical vulnerabilities directly quantifies the average duration from the initial detection of a critical vulnerability to its verified resolution. This metric is precisely designed to assess the efficiency and effectiveness of the remediation process against a specific service level agreement or internal goal, such as a 30-day target. By tracking this average time, the company can accurately determine if its remediation efforts consistently meet or exceed the desired timeframe for its most severe security findings.

Port 4444 is the default listening port for the Metasploit Framework's popular payload, Meterpreter, and is frequently associated with Remote Access Trojans (RATs) and reverse shells. Finding an active listener on this port without a documented business justification strongly suggests a malicious compromise where an attacker has established a persistent backdoor.

A primary objective of alert enrichment is to accelerate the incident response lifecycle by automatically appending contextual data, such as threat intelligence or host details, to incoming alerts. Measuring a decrease in the mean time to triage (MTTT) directly quantifies the operational efficiency gained from this automated enrichment process, proving that analysts can make faster, more informed decisions.

An out-of-band (OAST) SSRF test uses an external callback server like Burp Collaborator to detect when the application fetches an attacker-specified URL. If a DNS lookup or HTTP hit is received, it proves the server-side component is making the request as the victim, even when the response body is not reflected to the tester. This technique is essential for blind SSRF, where the application processes the response internally without echoing it back. It also confirms the vulnerability independently of any firewall or filtering on the inbound path.

Documenting the technical vulnerability exploited is central to root cause analysis because it identifies the specific weakness—such as an unpatched CVE, SQL injection, or misconfigured S3 bucket—that allowed the initial compromise. Without this technical detail, the response team cannot prescribe a targeted fix (e.g., patch, configuration change, or WAF rule) to prevent recurrence. The root cause is inseparable from the exact flaw that made the attack viable.

OpenSCAP evaluates systems against security baselines such as SCAP content and STIG profiles, checking configuration settings and reporting compliance deviations. This directly satisfies the scenario's compliance scanning purpose by automating configuration assessment against defined standards.

Restricting an employee's access to sensitive data is a critical, immediate containment measure during an insider threat investigation. This action adheres to the principle of least privilege, mitigating potential data exfiltration or damage without prematurely alerting the suspect. It allows the security team to safely conduct further investigation and evidence collection while minimizing ongoing risk to organizational assets.

Uploading the suspicious file to a public multi-engine scanner like VirusTotal allows the analyst to quickly cross-reference the file's hash against dozens of antivirus databases. This provides rapid, low-risk detection intelligence without executing the payload locally, though analysts must remain cautious about leaking sensitive or proprietary data contained within the file.

Applying the principle of least privilege to user accounts is the most direct and effective countermeasure against privilege escalation. This principle ensures that users and processes are granted only the minimum necessary permissions to perform their legitimate functions, and no more. By limiting the initial access an attacker gains, even if they compromise a user account, their ability to escalate privileges to administrative or system-level access is severely restricted, significantly reducing the potential impact of a successful exploit.

An executive report should demonstrate how well the organization responded and where improvements are needed. A concise timeline with effectiveness metrics for containment, eradication, and recovery shows whether controls worked and where gaps exist. This helps leadership assess resilience and prioritize investments. It is a standard component of post-incident reporting for senior stakeholders.

Correct: RAM (most volatile) first, then CPU registers, then swap, then network connections, then disk, then archived media. This follows the standard order of volatility.

Command and control (C2) beaconing is characterized by compromised internal hosts making periodic, highly consistent outbound connections to external malicious infrastructure to check for instructions. These regular intervals, often referred to as heartbeat signals, are designed to maintain persistence and bypass standard firewalls by masquerading as legitimate outbound HTTPS traffic.

Malicious VBA macros embedded in Office documents commonly use the Shell function or WScript.Shell object to launch powershell.exe directly as a child process of winword.exe, often passing obfuscated, base64-encoded, or download-cradle commands as arguments to retrieve a second-stage payload, which produces exactly the winword.exe-to-powershell.exe parent-child relationship seen in this alert and matches the well-documented email-delivered macro attack pattern.

The log entries clearly display dot-dot-slash (../) sequences, or their URL-encoded equivalents like %2e%2e%2f, which are classic signatures of a directory traversal attack. This exploit attempts to escape the web root directory to access restricted system files, such as /etc/passwd or boot configuration files.

Trivy is an open-source vulnerability scanner specifically designed for containers, Kubernetes, and IaC templates. It excels at detecting vulnerabilities in OS packages and application dependencies within container images, making it ideal for integration into CI/CD pipelines.

The CVSS vector string 'AC:L' explicitly denotes a Low Attack Complexity. This means that a successful attack does not require specialized conditions beyond the attacker's control, nor does it demand extensive preparation or specific timing. Attackers can typically exploit such vulnerabilities with readily available techniques and resources, making the attack relatively straightforward and increasing its likelihood.

By authenticating to the target, the scanner can query installed software versions, registry settings, running services, and local configuration files directly from the operating system, producing far more accurate and complete vulnerability data than an external, unauthenticated scan could infer from network responses alone.

Scan intensity controls the aggressiveness of the scan, including the number of concurrent connections and payloads sent. Lowering intensity reduces the risk of overwhelming production systems, which could cause outages. The analyst should set a lower intensity to avoid disruption while still identifying vulnerabilities. This setting directly addresses the need to balance thoroughness with system stability.

This Group Policy setting directly addresses the OpenSCAP finding by preventing unauthenticated users from enumerating domain or local account names and shares. Enabling this policy enforces the recommended CIS benchmark control, securing the SAM database against reconnaissance techniques like null session enumeration without disrupting legitimate system operations.

This scenario represents a false positive because the SIEM's correlation rules triggered an alert on benign, authorized user activity. The system incorrectly classified a legitimate login attempt as a security threat, requiring the analyst to investigate and potentially tune the rule to prevent future noise.

Burp Suite is an intercepting proxy designed specifically for web application security testing. It allows an analyst to intercept, modify, and replay HTTP/HTTPS requests to manually inspect the web server's responses. This makes it the ideal tool to safely and directly verify if directory listing is enabled on a specific web directory.

DAST tools excel at identifying input validation flaws like SQL injection by actively sending malicious payloads to application entry points and analyzing the HTTP responses. If the application returns database error messages or exhibits unexpected behavior, the tool flags the vulnerability in real-time.

Scheduling the patch for the next maintenance window, especially if it's more than 30 days away, directly violates the company's established remediation policy. This approach leaves the vulnerability unaddressed and the system exposed for an extended period, significantly increasing the risk of exploitation. It prioritizes operational convenience over security policy adherence and immediate risk mitigation.

A credentialed scan utilizes provided administrative or user credentials to log directly into the target operating system. This allows the scanner to perform deep local inspections, such as querying the registry, checking package manager databases, and auditing configuration files. Consequently, it provides a highly accurate assessment of missing patches and misconfigurations with minimal false positives.

Frequent queries to domains with random-looking, long subdomains are a hallmark of Domain Generation Algorithms (DGAs). Malware uses DGAs to generate pseudorandom domain names as rendezvous points with command-and-control (C2) servers, often producing long, alphanumeric subdomains that appear nonsensical. The high query rate to such domains is a strong indicator of compromise because legitimate users rarely make repeated queries to random subdomains.

Injection vulnerabilities occur when an application passes unfiltered, user-supplied input directly to an interpreter, such as a SQL database or system shell. This allows an attacker to manipulate the structure of the intended command, leading to unauthorized data access, modification, or arbitrary remote code execution on the host system.

Validating exploitability is a crucial first step to prioritize remediation efforts by determining if a vulnerability is reachable and impactful within the specific container context. Subsequently, rebuilding the image from a patched base image directly addresses the root cause of the vulnerability at its foundational layer. This proactive approach significantly reduces the inherited risk, ensures the deployment of secure artifacts, and aligns with best practices for maintaining a robust software supply chain.