Free CompTIA CySA+ CS0-003 Practice Test

The correct action in re-imaging a compromised server is to replace its current system image with a clean, known-good image. This involves erasing the current system to remove any potential malware or unauthorized changes and then installing a pre-configured image that is verified to be secure. Failing to use a clean image or not verifying the image can allow threats to persist. Pulling backups from the potentially compromised server or running standard antivirus software alone is insufficient.

Network segmentation is a compensating control that can limit the ransomware spread by isolating the critical server from the broader network, thus reducing the risk of cross-contamination from other network segments. Regular patching is the primary control but is not feasible in this scenario due to legacy software constraints, making it an incorrect answer. Encrypted backups are essential, but they don't address the direct risk of the server being compromised; instead, they are more about ensuring data recovery post-incident. Similarly, frequent password rotation is a security best practice but does not effectively mitigate the specific risk of unpatched systems being exploited.

The scenario described indicates the presence of a Buffer Overflow, where the buffer (in this case, an integer array) is fixed in size and not adequately checked for the volume of input supplied, allowing overflow and possible overwrite of other memory areas. A Stack Overflow is incorrect as it specifically pertains to the stack memory segment, usually involved with function call management, not general fixed-size buffer overflows. Integer Overflow deals with errors in arithmetic operations causing the integer to wrap around, which doesn't directly match the scenario presented. Heap Overflow is related to dynamic memory allocation issues in the heap segment, which is also not specified in this scenario.

Creating a forensic disk image ensures that the original evidence is preserved and any analysis is performed on an exact copy. This helps maintain the integrity of the data and allows the original disk to remain unaltered. Hashing both the original and the image to make sure they match is part of this process, providing proof that the image is an identical copy.

The correct answer is to reconfigure the firewall to restrict access to the database server. Publicly accessible database servers can be easily targeted by attackers, making it imperative to ensure that access is restricted to authorized users and systems only. Modifying other parameters such as password policies or ensuring updates are installed, while important for overall security, will not directly address the immediate threat posed by the open firewall configuration.

Parameterized queries are a technical control that can help prevent injection flaws by separating SQL code from data. This makes it harder for an attacker to inject malicious input that could alter the execution of a SQL query. Using encrypted channels addresses the confidentiality and integrity of the data in transit, but not the injection vulnerability itself. Input length restrictions can prevent buffer overflow attacks but would not necessarily prevent injection attacks. Role-based access control is a good practice for limiting user permissions based on their role, but it does not directly mitigate the vulnerability of unsanitized user input.

The correct answer is the Immunity debugger. This tool is specifically designed for interactive debugging and is commonly used for malware analysis and exploit development due to its ability to manipulate running processes and probe the internals of an application in real-time. It provides cybersecurity professionals with deeper insights into how an application behaves under certain conditions, potentially revealing exploitable vulnerabilities. Other options like WireShark, Nessus, and GDB have different primary uses; WireShark is a network protocol analyzer, Nessus is a vulnerability scanner, and GNU debugger (GDB) is more general-purpose and less specialized in malware analysis or exploit development than Immunity debugger.

The correct answer is 'Mean time to remediate' because it measures the average time taken to resolve an incident from the moment it is detected until it is fully remediated. 'Mean time to detect' refers to the time taken to detect an incident, and 'Alert volume' refers to the number of alerts received in a given time period, neither of which describe the resolution time frame. 'Critical vulnerabilities and zero-days' is not a time-based metric but rather a classification of vulnerabilities.

The primary purpose of conducting root cause analysis during post-incident activities is to identify the underlying causes of the incident. This helps organizations implement measures to prevent similar incidents from occurring in the future. Root cause analysis goes beyond the symptoms and addresses the fundamental reasons for the incident.

In the context of incident response, 'scope' refers to determining the boundaries of the impact of an incident. This involves identifying the extent of the damage, the systems affected, and the potential reach of the threat. Recognizing the correct scope is vital for appropriate containment and mitigation actions.

Conducting regular Tabletop exercises ensures the incident response team is familiar with the incident response plan and is prepared to execute it effectively. During these exercises, scenarios are simulated, and the team walks through the plan step-by-step to identify any gaps or inefficiencies. This practical approach to incident response preparation can significantly improve the team's readiness and capability to respond to real incidents. Revising the disaster recovery plan might be part of overall improvements, but it is not as directly related to the immediate incident handling effectiveness as conducting regular exercises. The other options, although they might be components of an incident response plan, do not directly ensure more effective handling of future incidents.

This statement is accurate as edge discovery focuses on finding the outermost services and systems that are accessible, which can potentially be targeted by attackers. By identifying and securing these points, an organization can effectively manage and reduce its attack surface, therefore mitigating risks.

The correct answer is 'Re-image systems with the clean backup and modify default credentials and access controls before reconnection.' In the case of a persistent threat actor, it is essential to assume that simply restoring a clean backup is insufficient if default credentials or predictable access controls remain unchanged, as the actor could potentially regain access using the same methods as before. The response encompasses not just restoration from a clean backup but also emphasizes altering access mechanisms to prevent the recurrence of the breach. 'Perform a bare-metal restore and immediately reconnect systems to the network' fails to consider that unchanged credentials can be reused by the adversary. 'Install the latest patches prior to re-imaging' is important for system security, but it does not directly thwart an actor who may have knowledge of current credentials or backdoors. 'Integrate additional monitoring tools during the re-imaging process' may help with detection of future breaches but does not necessarily impede the threat actor from accessing the systems using the same methods as before.

This scenario is an example of Business Email Compromise (BEC), where attackers impersonate high-level executives or other trusted figures to manipulate employees into revealing sensitive information or making unauthorized transactions. Recognizing and preventing BEC attacks is crucial for protecting organizational assets and data.

Maintaining a proper chain of custody is critical for ensuring that digital evidence is admissible in legal proceedings. It involves precise documentation of every individual who handled the evidence, when it was transferred, and why. Without this documentation, the integrity and authenticity of the evidence could be challenged, potentially compromising an investigation.