Pass the CompTIA CompTIA CySA+ CS0-004 Questions and answers with CertsForce

Rebuilding the environment from infrastructure-as-code definitions is a recovery activity because the organization is restoring trusted operational capability after the ransomware incident has been controlled. IaC provides a particularly effective recovery mechanism because infrastructure can be reconstructed according to predefined, version-controlled configurations instead of attempting to repair every potentially compromised component manually.

During detection and analysis, responders establish that malicious activity occurred and determine its scope. Containment limits additional damage or spread. Eradication removes malicious artifacts, persistence, compromised credentials, and the underlying causes of the incident. Recovery then restores affected systems and services to normal operation while ensuring they are returned in a trustworthy state.

NIST defines recovery as the restoration of assets and operations affected by cybersecurity incidents and emphasizes verifying restored assets before normal operations resume. Tearing down potentially compromised infrastructure and deploying fresh resources from controlled IaC templates directly fulfills that purpose.

Post-incident activities occur after operational restoration and focus on lessons learned, reporting, process improvement, and corrective recommendations.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Recovery → Infrastructure as Code → Rebuilding from Known-Good Configurations → Validation.

Mean time to close is the most relevant measurement because the manager needs to quantify how long cases or incidents remain open before all required closure activities—including after-action documentation—are completed.

An incident may already be technically contained and remediated while administrative closure remains outstanding. Mean time to remediate measures how long it takes to correct or neutralize the security problem, but it does not necessarily include final reporting and formal case closure. Mean time to respond measures how quickly responders begin or perform response activity after detection. Mean time between failures is primarily a reliability metric describing the average operating duration between failures and does not measure SOC reporting performance.

Current Microsoft Sentinel SOC guidance explicitly includes mean time to closure and time-to-closure percentiles among incident-management metrics used to evaluate SOC performance. This directly maps to the manager's concern: if after-action reports delay completion of incidents, the organization's mean closure time will increase and can be trended by analyst, severity, team, or incident category.

Therefore, B provides the quantitative evidence needed to determine whether after-action reporting is preventing incidents from being closed promptly.

Study Guide Reference: Reporting and Communication → Incident Metrics → Mean Time to Close → After-Action Reporting → SOC Performance Measurement → Continuous Improvement.

A comprehensive asset inventory is required because the discrepancy demonstrates that the organization lacks a reliable common understanding of which systems actually exist and should be covered by vulnerability and patch-management processes. Effective vulnerability management begins with asset discovery and inventory. Without accurate asset records, teams cannot determine whether missing systems represent decommissioned devices, unmanaged assets, duplicate IP addresses, dynamic addressing, scanning gaps, or endpoints that are not enrolled in the patch platform.

Reconciliation with the infrastructure team allows the organization to establish authoritative records for hostnames, IP addresses, operating systems, ownership, business function, physical or cloud location, patching status, and vulnerability-scanner coverage. Once that inventory exists, each security tool can be compared against the same source of truth.

Verbose scanner logging might explain specific scanning failures but cannot resolve discrepancies caused by unknown or unmanaged assets. Rebuilding report filters risks masking the real coverage problem. Rerunning patch deployment does not help when the organization has not established which assets should be receiving patches.

The governing principle is simple: an organization cannot reliably assess or patch assets it has not accurately inventoried .

Study Guide Reference: Vulnerability Management → Asset Discovery → Asset Inventory → Vulnerability Scanner Coverage → Patch Management → CMDB/Reconciliation → Shadow and Unmanaged Assets.

An after-action report (AAR) is the most comprehensive document associated with a closed incident because it consolidates the incident itself, the response activities performed, recovery actions, outcomes, deficiencies, and lessons identified during the event. NIST Cybersecurity Framework guidance specifically calls for preparing an after-action report that documents the incident, response and recovery activities, and lessons learned.

A lessons-learned document focuses primarily on what worked, what failed, and what should be improved. Those observations are important, but they represent only one component of a complete post-incident record. Root cause analysis has a narrower technical purpose: determining the fundamental condition that permitted the incident to occur or progress. A situation report is generally produced while an incident is ongoing to communicate current status, impact, actions, and outstanding issues.

An AAR is broader because it can incorporate the timeline, technical findings, containment and eradication actions, recovery results, stakeholder performance, root cause, lessons learned, and assigned corrective actions. NIST exercise guidance likewise treats lessons learned as information that becomes part of an after-action report.

Study Guide Reference: Reporting and Communication → Post-Incident Reporting → After-Action Reports → Lessons Learned → Root Cause Analysis → Corrective Actions.

The activity is consistent with Virtual Network Computing (VNC) remote-control sessions. VNC provides interactive graphical access to another computer, which can manifest to the local user as unexpected mouse movement, windows opening, applications launching, or terminal sessions appearing without direct user interaction.

The network evidence distinguishes VNC from the other possibilities. Nmap's official VNC detection documentation demonstrates VNC services operating on TCP port 5900 and provides NSE functionality for querying VNC protocol versions and supported security mechanisms. When traffic logs show connections consistent with VNC services and users simultaneously observe visible remote desktop activity, VNC is the strongest correlation.

An internally addressable source address establishes only where traffic originated; it does not explain interactive mouse and keyboard activity. A reverse tunnel can provide an attacker with connectivity through network restrictions, but the tunnel itself does not identify the remote-control protocol responsible for the graphical symptoms. RDP can also provide interactive remote access, but it uses a different protocol and service profile; the traffic evidence in the scenario aligns with VNC instead.

An analyst should therefore correlate endpoint symptoms with network protocol and port evidence , rather than diagnosing remote access solely from visible user-interface behavior.

Study Guide Reference: Security Operations → Network Traffic Analysis → Remote Access → VNC → RDP → Ports/Protocols → Indicators of Unauthorized Remote Control.

Chain of custody is the formal process used to document the collection, possession, transfer, handling, analysis, and disposition of evidentiary artifacts. Its purpose is to establish an auditable history demonstrating who controlled the evidence, when custody changed, why it was transferred, and what actions were performed on it.

NIST defines chain of custody as tracking evidence throughout its collection, safeguarding, and analysis lifecycle while documenting each individual who handled it, relevant timestamps, and the purpose of transfers. This is critical when multiple systems, analysts, forensic teams, or external parties participate in an investigation because undocumented handling could undermine confidence in the evidence's integrity or admissibility.

Packaging and labeling are important evidence-preservation procedures, but they represent only individual activities within the broader evidence-management process. Storage and containment protect artifacts from alteration or unauthorized access but do not provide the complete historical record of possession. Post-incident reporting documents investigation conclusions and response actions after the incident rather than tracking evidence throughout its lifecycle.

The decisive phrase is “properly recorded.” A defensible record of every evidence transfer and handler is specifically the function of chain of custody.

Study Guide Reference: Incident Response and Management → Digital Forensics → Evidence Acquisition → Chain of Custody → Evidence Integrity → Documentation and Preservation.

The scan results identify two systems exposing services that permit communications without transport encryption, making B the correct count. The analyst must examine each discovered service rather than merely count open ports, because the security property being evaluated is whether the identified protocol transmits its session or application data without adequate encryption.

Common examples include HTTP instead of HTTPS, Telnet instead of SSH, and legacy FTP rather than protected file-transfer alternatives. The presence of an unencrypted service does not automatically prove that sensitive information is currently being transmitted, but it identifies a configuration that can expose credentials, commands, session content, or application data to interception when used.

The correct vulnerability-management workflow is to map discovered ports to services, determine the security characteristics of those protocols, verify whether encryption is available and enforced, and then prioritize remediation according to asset exposure and business requirements. Where possible, administrators should disable unnecessary cleartext services or replace them with cryptographically protected equivalents.

This question therefore tests interpretation of vulnerability or port-scan output , not simple arithmetic. The two affected systems are those whose discovered services permit cleartext communications.

Study Guide Reference: Vulnerability Management → Scan Result Interpretation → Ports and Protocols → Cleartext Services → Encryption in Transit → Remediation and Secure Configuration.

The common underlying weakness is insufficient handling and validation of untrusted application input . XSS occurs when attacker-controlled content is processed and subsequently rendered in a manner that allows script execution. SQL injection occurs when untrusted values become part of database commands without appropriate separation between code and data.

OWASP recommends validating untrusted input early in the processing workflow and applying syntactic and semantic validation. For SQL injection specifically, OWASP identifies parameterized queries as the primary defensive technique and recommends allow-list input validation as an additional defensive layer. For XSS, context-appropriate output encoding and sanitization must also be applied; therefore input validation should be viewed as part of secure application handling rather than the sole technical control.

A WAF can provide defense in depth but does not correct vulnerable application code. HSTS forces browsers to use HTTPS and protects transport security; it does not prevent malicious input from being interpreted by an application. Endpoint protection similarly operates on hosts and does not repair web application data-handling flaws.

Study Guide Reference: Vulnerability Management → Application Vulnerabilities → XSS → SQL Injection → Input Validation → Output Encoding → Parameterized Queries → Secure Coding.

The analyst should collect the Netstat output first because current network-connection information is highly volatile and will change immediately when the server is disconnected. netstat-type evidence can identify active TCP/UDP connections, listening services, remote endpoints, and potentially the communication channels associated with an attacker or command-and-control infrastructure.

Digital-forensic acquisition follows the order of volatility : evidence most likely to disappear or change should be captured before more persistent artifacts. RFC 3227 explicitly directs investigators to proceed from volatile to less-volatile evidence and identifies information such as routing data, ARP cache, process state, memory-related information, and network state as highly time-sensitive.

The ARP table is also volatile and should be captured early, but the wording “before disconnecting the server from the network” makes active connection state particularly important because those sessions will terminate when network connectivity is removed. ShellBags are persistent forensic artifacts stored within Windows Registry data and can be collected later from disk. A hard-disk image is critical but comparatively nonvolatile and should follow acquisition of live state.

Therefore, live network-session information takes priority.

Study Guide Reference: Incident Response and Management → Evidence Acquisition → Order of Volatility → Live Response → netstat → Network Connections → Forensic Preservation.

A phishing simulation click rate measures user susceptibility to phishing and is therefore primarily an indicator of employee security awareness and behavior . If a simulated phishing message is delivered to employees and a percentage of recipients click the embedded malicious-style link, that percentage provides evidence about how effectively users are recognizing and resisting social-engineering attempts.

NIST research specifically identifies phishing-simulation click rates as a commonly used measure for evaluating the effectiveness of phishing-related security-awareness programs. NIST also cautions that raw click rates should be interpreted in context because phishing messages differ substantially in difficulty; the Phish Scale was developed to provide context for click-rate and report-rate results.

The metric does not primarily measure email-filter effectiveness because a controlled simulation may intentionally bypass or be allowlisted through technical filtering so employee behavior can be evaluated. It is unrelated to data-loss prevention false positives. It also does not directly measure response speed; metrics such as reporting time or mean time to respond would be more appropriate for that purpose.

Therefore, click rate is fundamentally a human-risk and awareness metric .

Study Guide Reference: Reporting and Communication → Security Metrics → Security Awareness → Phishing Simulations → Click Rate → Reporting Rate → Human Risk Measurement.