Pass the CompTIA CompTIA CySA+ CS0-004 Questions and answers with CertsForce

The organization cannot completely block the malicious URL because it remains necessary for a legitimate business process. Instead, the security team is implementing compensating controls that reduce exposure while preserving required functionality. These controls include limiting access to explicitly authorized users, restricting network paths through firewall and cloud security-group rules, increasing monitoring, and ensuring that systems interacting with the external resource are fully patched.

A compensating control is an alternative safeguard used when the preferred control—such as completely removing access to the risky resource—is operationally impractical. The important distinction is that the underlying risk still exists; the organization is reducing its likelihood or potential impact through layered protections.

Patching is only one component of the response and therefore does not describe the overall mitigation. Configuration management concerns maintaining approved system configurations and controlling changes. Attack surface management focuses on identifying and reducing externally or internally exposed assets and services, but the scenario specifically describes alternative safeguards around a business-required risk.

The combination of access restriction, enhanced monitoring, and system hardening is therefore characteristic of compensating-control implementation.

Study Guide Reference: Vulnerability Management → Vulnerability Mitigation → Compensating Controls → Network Segmentation → Monitoring → Patch Management → Risk-Based Remediation.

Windows Security Event ID 4624 records a successful logon session. Therefore, querying the Security log for event 4624 provides the analyst with historical evidence of successful logins to the affected workstation.

Get-WinEvent is the appropriate PowerShell cmdlet for retrieving Windows event records. The FilterHashtable parameter allows efficient server-side filtering using attributes such as LogName and ID, rather than retrieving an entire event log and filtering the results afterward. Microsoft specifically documents LogName and ID as valid FilterHashtable keys and recommends this approach for efficient event-log querying.

The command then uses Sort-Object TimeCreated -Descending so the newest login events appear first, and Export-Csv preserves the resulting records for investigation.

Option A does not use the correct PowerShell event-query syntax shown. Options C and D search inappropriate log channels and unrelated event IDs. The evidence needed is authentication history, making the Windows Security log and successful-logon identifier 4624 the correct combination.

Study Guide Reference: Incident Response and Management → Evidence Collection → Windows Event Logs → PowerShell → Get-WinEvent → Security Event ID 4624 → Timeline Reconstruction.

The Microsoft-Windows-PowerShell/Operational log is the appropriate source because PowerShell is commonly involved in script-based and memory-oriented attack activity, including techniques associated with fileless malware. The key requirement in the question is “requires additional configuration”: advanced PowerShell telemetry such as Script Block Logging must be enabled to provide the detailed execution visibility required by a SIEM.

Microsoft documents that enabling Script Block Logging causes PowerShell to record processed commands, functions, scripts, and script blocks in the Microsoft-Windows-PowerShell/Operational channel. In Windows PowerShell, Script Block Logging generates Event ID 4104 , which contains script-block content and can provide valuable evidence when investigating malicious PowerShell execution. Microsoft also specifically identifies malicious PowerShell scripts as a post-exploitation technique associated with fileless attack activity.

The DPAPI operational log concerns cryptographic data-protection activity. UserPnp/DeviceInstall relates to device installation events, while TerminalServices-LocalSessionManager provides Remote Desktop and terminal-session telemetry. Those sources can be valuable during investigations but are not the primary log channel for capturing PowerShell-based fileless execution.

Study Guide Reference: Security Operations → Logging and Monitoring → Windows Event Logs → PowerShell Logging → Event ID 4104 → Script Block Logging → Fileless Malware Detection.

Encryption at rest primarily protects the confidentiality of stored information when an unauthorized party obtains physical or logical access to the storage medium. This is particularly important for laptops because portable devices can be lost or stolen, giving an attacker possession of the disk outside the organization's normal network and endpoint protections.

NIST guidance on storage encryption specifically addresses laptops and other end-user devices and explains that storage encryption combines encryption and authentication to restrict unauthorized access to stored information. NIST further notes that threats involving lost or stolen end-user devices can expose information to unauthorized parties.

Encryption does not inherently prevent an authenticated and authorized user from copying information while the system is unlocked; data loss prevention controls are more directly suited to that objective. Regulatory requirements may mandate encryption in some environments, but compliance is an external requirement rather than the fundamental security reason encryption at rest exists. Option D confuses confidentiality with integrity and network protection. Encryption of data stored on a laptop is not primarily intended to validate whether network data has been modified.

The examination concept is the CIA triad: encryption primarily supports confidentiality , especially when physical possession of the storage device is lost.

Study Guide Reference: Security Operations → Data Protection → Encryption at Rest → Full-Disk Encryption → Confidentiality → Lost/Stolen Endpoint Protection.

The Pyramid of Pain illustrates the increasing operational difficulty imposed on an adversary when defenders successfully detect and deny progressively more behavioral indicators. At the lower levels are artifacts that attackers can replace relatively easily, such as hash values and IP addresses. Higher levels include domain names, network or host artifacts, tools, and ultimately tactics, techniques, and procedures (TTPs) .

Its central defensive lesson is that not all indicators impose equal cost on an attacker. Blocking one IP address may require the attacker only to obtain another server. Detecting a specific malware hash can often be defeated by recompiling or modifying the file. Detecting the attacker's established behaviors and operational methods creates substantially greater difficulty because the adversary may need to redesign procedures, change tooling, retrain operators, or alter an established intrusion methodology.

The Pyramid of Pain was developed specifically to describe this relationship between indicators and the amount of operational “pain” defenders impose when those indicators are denied.

Option B describes impact measurement, not indicator durability. Option C concerns intelligence-source classification. Option D resembles threat-modeling approaches such as STRIDE rather than the Pyramid of Pain.

Study Guide Reference: Security Operations → Threat Intelligence → Pyramid of Pain → Indicators of Compromise → Tools → TTPs → Behavioral Detection.

The analyst must construct an accurate incident timeline . Patient zero is the earliest compromised system from which subsequent malicious activity originated or propagated. Determining it requires ordering events chronologically across all affected hosts and correlating authentication activity, process execution, network connections, malware creation times, lateral movement, and other evidence.

Raw logs alone do not communicate this sequence effectively. Logs from different systems must first use reliable timestamps and then be normalized and correlated. Once events are ordered, the analyst can work backward from known compromises to determine which host displayed the earliest credible signs of intrusion and whether subsequent systems were reached from that host.

Enabling additional monitoring helps detect future activity but does not reconstruct historical sequence by itself. Isolation is necessary during containment but does not establish which system was initially compromised. Shift-handoff improvements are useful organizationally but do not answer the forensic question. Malware composition analysis may identify relationships between samples, but it does not establish system-level chronology.

NIST's incident-response guidance emphasizes analysis, documentation, root-cause understanding, and after-action reporting as inputs to continuous improvement.

Study Guide Reference: Incident Response and Management → Timeline Analysis → Event Correlation → Patient Zero → Root Cause Analysis → After-Action Review.

The CIO is implementing risk avoidance because the organization is eliminating the activity or technology that creates the risk. The legacy system no longer receives security updates, so continued operation would maintain exposure to vulnerabilities that may eventually become impossible to remediate. By phasing out and ultimately decommissioning the system, the organization removes that source of risk instead of continuing to operate it under additional controls.

NIST recognizes acceptance, avoidance, mitigation, sharing, and transfer as established risk-response approaches. Avoidance differs from mitigation because mitigation would retain the legacy system while implementing controls that reduce its likelihood or impact—for example, segmentation, strict access controls, application allowlisting, or enhanced monitoring.

Risk acceptance would involve deliberately continuing to operate the system after management acknowledges and approves the remaining exposure. Risk transference would shift some financial or operational consequences to another party, such as through insurance or contractual arrangements.

The phrase “phase out” is the decisive indicator. The organization intends to stop using the risk-producing technology entirely, making avoidance the most precise classification.

Study Guide Reference: Vulnerability Management → Risk Management → Risk Responses → Avoidance → Mitigation → Acceptance → Transference → Legacy and End-of-Life Systems.

Category 2 represents hosts whose RDP authentication characteristics indicate NTLM without Active Directory domain membership , making option C the correct interpretation. The Nmap command targets TCP port 3389 and executes RDP-related NSE scripts. Nmap's RDP scripts include rdp-ntlm-info, which obtains information through RDP services configured for CredSSP/Network Level Authentication, as well as rdp-enum-encryption, which evaluates supported RDP security layers and encryption.

Kerberos normally relies on a domain-based authentication infrastructure and a Key Distribution Center. A non-domain-joined workstation will typically rely on local authentication mechanisms and can use NTLM challenge-response authentication where appropriate. The absence of Active Directory domain characteristics, together with NTLM-specific RDP information, therefore distinguishes Category 2 from domain-integrated Kerberos authentication.

It is important operationally not to infer that every NTLM-capable system is necessarily outside Active Directory; domain members can fall back to NTLM under certain conditions. The examination conclusion depends on the combined evidence shown in the category output rather than NTLM alone.

Study Guide Reference: Vulnerability Management → Service Enumeration → Nmap NSE → RDP/3389 → NTLM → Kerberos → Active Directory Authentication Assessment.

The analyst should first establish a legal hold because the suspected breach involves personnel records and evidence that may become relevant to regulatory, disciplinary, civil, or other legal proceedings. A legal hold prevents potentially relevant information from being deleted, overwritten, modified, rotated out under normal retention schedules, or otherwise destroyed before the organization's legal and investigative obligations are understood.

Preservation must precede destructive or potentially evidence-altering actions. NIST describes digital forensics as retrieving, storing, and analyzing electronic information while ensuring that evidence is captured reliably without alteration. RFC 3227 similarly emphasizes preserving evidence, following proper collection procedures, documenting handling, and maintaining chain of custody.

Log correlation and timeline construction are important investigative activities, but they should occur after preservation requirements have been established. Resetting credentials may subsequently be required for containment, but the scenario first raises an evidence-preservation obligation. Restoring files from backup would be especially premature because it could alter timestamps, overwrite artifacts, or otherwise complicate forensic analysis.

The examination principle is therefore preserve first when legal implications are reasonably foreseeable; analyze and remediate afterward under controlled procedures .

Study Guide Reference: Incident Response and Management → Evidence Acquisition → Legal Hold → Evidence Preservation → Chain of Custody → Timeline Analysis → Regulatory/Legal Considerations.

PRODWEB-01 represents the highest remediation priority because vulnerability prioritization should combine asset value, vulnerability risk, and exploitation likelihood , rather than relying on severity alone. A production web server is typically more exposed and operationally significant than a development endpoint, and the correlated CMDB information provides the business context required to determine whether exploitation would materially affect organizational operations.

A mature vulnerability-management process evaluates technical severity together with internet exposure, business criticality, existing controls, active exploitation, threat intelligence, and the availability of remediation. CISA specifically recommends using known exploitation evidence as an input into vulnerability prioritization and provides risk-based methodologies such as SSVC for determining appropriate response actions.

This explains why simply choosing the system with the numerically highest isolated vulnerability score would be inadequate. DEVWIN11-01, for example, may contain significant findings but carries lower production value. A control-system asset may have high business importance but can present different exposure and exploitability conditions. The correlated attributes associated with PRODWEB-01 establish the strongest combined risk.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization → Asset Criticality → Exploitability → Threat Intelligence → CMDB Context → Risk-Based Remediation.