Free CompTIA CySA+ CS0-003 Practice Test

A common symptom of a compromised system is the unauthorized use of system resources, like processing power. This can happen when malicious software, such as a Trojan or a crypto-miner, is clandestinely running on the machine. Considering that the increase in resource usage is unexpected and doesn't align with known tasks or user behavior, it suggests the possibility of malicious activity. In contrast, an application misconfiguration would typically be tied to a recent software change. A malfunctioning cooling system would likely lead to overheating, which could consequently throttle processing capabilities, rather than increase resource utilization. Similarly, pending updates might increase resource use temporarily, but this would be anticipated behavior correlated with the update process.

Passive scanning is recommended for environments with industrial control systems because it is less intrusive and reduces the risk of disrupting the sensitive systems that often operate with precise timing and control. Active scanning, on the other hand, could potentially interrupt ICS operations due to the probing and test traffic it generates.

Segmentation involves dividing a network into smaller parts, each isolated from the others. This helps in controlling access, limiting the spread of potential breaches, and managing network traffic more effectively.

The correct answer is to implement compensating controls and defer patching until after the year-end processing is complete. This option provides an immediate and additional layer of security to mitigate the risk temporarily without disrupting the critical financial processes due to service interruptions. Other choices do not offer the same balance between security needs and business continuity, as they either introduce significant risk (leaving the system unpatched), potentially cause unacceptable business interruptions (repatching during the year-end processing), or do not respond directly to the vulnerability (increasing logging and monitoring only).

A packet analyzer, also known as a network analyzer, is a tool designed to capture, filter, and analyze network traffic in real-time. It helps in detecting and diagnosing network issues, including security incidents.

A decrease in the Mean Time to Detect (MTTD) indicates that the team is becoming more efficient at identifying security incidents. Mean Time to Detect measures the average time it takes to become aware of an incident after it has occurred. Improvements in this metric suggest that detection tools, processes, and monitoring are becoming better integrated and more effective. While increasing mean time to respond (MTTR) or alert volume are important, they do not provide direct insight into detection efficiency.

The correct action in re-imaging a compromised server is to replace its current system image with a clean, known-good image. This involves erasing the current system to remove any potential malware or unauthorized changes and then installing a pre-configured image that is verified to be secure. Failing to use a clean image or not verifying the image can allow threats to persist. Pulling backups from the potentially compromised server or running standard antivirus software alone is insufficient.

The observed regular intervals of communication attempts suggest 'beaconing.' Beaconing is a technique used by malware to communicate with a command and control server at specific intervals to receive instructions or exfiltrate data. Other similar activities like 'data exfiltration,' involve the unauthorized transfer of data out of the network but do not necessarily involve regular communication, and 'privilege escalation' involves gaining higher access levels within a system, unrelated to the observed behavior.

The sudden creation of multiple new user accounts could be indicative of a compromised system where an attacker may be setting up accounts for further exploitation or lateral movement within the network. Regular account creation as part of business operations is usually periodic and follows a predictable pattern, making the unexpected creation of many new accounts an anomaly and possible sign of unauthorized activity.

Corrective controls are mechanisms put in place to mitigate and correct the impact of a security incident after it has been detected. They differ from responsive controls, which are activated during an incident to limit immediate damage, preventive controls meant to stop incidents before they occur, and detective controls which are used for identifying incidents.

A proprietary system is one that is owned by a specific company or entity, and its internal design and functionality are typically not disclosed to the public. This can make it challenging to implement patches or updates without specific vendor support, leading to delays in remediation.

The 'Top 10' in vulnerability management metrics generally represents the most critical vulnerabilities discovered during a given assessment period. This list is vital for prioritization, allowing organizations to address the most severe risks first to reduce the potential for exploitation. Other options, although related to the field, do not accurately describe the 'Top 10' indicator.

Correlating time stamps across multiple systems and devices enables an analyst to construct a timeline of events, which is essential for understanding the sequence in which the incident occurred. This timeline can be compared against the known behavior of security threats to identify patterns and potential points of entry or areas of impact. This question tests knowledge of log analysis techniques. Other options, while potentially useful in other contexts, do not focus on the primary purpose of time stamp correlation in incident investigation.

The best action is to implement a temporary web application firewall (WAF) rule to block traffic associated with the vulnerability. This provides an immediate layer of protection while a permanent fix is developed. Updating the application is a long-term solution but doesn't align with the policy of immediate risk reduction. Disabling the affected feature might reduce risk but can disrupt business operations significantly. Contacting the vendor is a valid action but may not provide an immediate fix.

The relevant inhibitor to remediation here is 'Business process interruption,' as patching the critical vulnerability could lead to disruptions in the financial reporting process. This is a significant concern for businesses relying on continuous operation. Other inhibitors such as legacy systems and organizational governance might also be factors, but the primary concern in this context is the potential interruption of critical business processes.