CS0-003 Exam Dumps - CompTIA CyberSecurity Analyst CySA+ Certification Exam

Comprehensive and Detailed Explanation From Exact Extract:

A “network data closet” attack is a physical-environment incident (hardware, cabling, physical access/tampering). Proper documentation in such cases includes documenting the scene and physical state of impacted items so that investigators can reconstruct what was present, what was changed, and how things were connected.

The All-in-One CySA+ guide explicitly states that an important step is documenting the physical environment and that an easy way is to take lots of photos of the scene:

Exact extract (All-in-One Exam Guide):

“Another important… step is to document the entire physical environment around a device. An easy way to do this is to take lots of photos of the scene.”

Why the other options are less correct:

A is a recovery/ops task, not primary incident documentation of a physical attack scene.

B may be useful in some contexts, but the best practice for a physical incident scene is to photograph impacted items and surroundings.

C can help later, but it’s not the first/best documentation action for a physical tampering incident compared to capturing the scene as-found.

Implementing a central place to manage IT assets is the best solution to decrease the inconsistencies regarding versions and patches in the existing infrastructure. A central place to manage IT assets, such as a configuration management database (CMDB), can help the vulnerability assessment team to have an accurate and up-to-date inventory of all the hardware and software components in the network, as well as their relationships and dependencies. A CMDB can also track the changes and updates made to the IT assets, and provide a single source of truth for the vulnerability assessment team and other teams to compare and verify the versions and patches of the infrastructure12. Implementing credentialed scanning, changing from a passive to an active scanning approach, and performing agentless scanning are all methods to improve the vulnerability scanning process, but they do not address the root cause of the inconsistencies, which is the lack of a central place to manage IT assets3. References: What is a Configuration Management Database (CMDB)?, How to Use a CMDB to Improve Vulnerability Management, Vulnerability Scanning Best Practices

The best way to ensure that the investigation complies with HR or privacy policies is to ensure that the case details do not reflect any user-identifiable information, such as name, email address, phone number, or employee ID. This can help protect the privacy and confidentiality of the user and prevent any potential discrimination or retaliation. Additionally, password protecting the evidence and restricting access to personnel related to the investigation can help preserve the integrity and security of the evidence and prevent any unauthorized or accidental disclosure or modification.

Aplaybookprovides astep-by-stepguide for handling specific types of incidents like ransomware, making it invaluable during triage. It outlines predefined procedures, aiding consistent and fast decision-making.

The incident response plan (A) provides high-level structure.

Lessons learned (B) applyafterthe incident.

Tabletop exercises (D) are training tools, not live guides.

📘Reference: Chapple & Seidl, CySA+ Practice Tests, Incident Response, Chapter 3 – Playbooks and Procedures​.

📘Objective: 3.1 - Apply incident response procedures based on an incident classification​.

Segmenting the entire department from the network and reviewing each computer offline is the first step the incident response staff members should take when they arrive. This step can help contain the malware infection and prevent it from spreading to other systems or networks. Reviewing each computer offline can help identify the source and scope of the infection, and determine the best course of action for recovery12. Turning on all systems, scanning for infection, and backing up data to a USB storage device is a risky step, as it can activate the malware and cause further damage or data loss. It can also compromise the USB storage device and any other system that connects to it. Identifying and removing the software installed on the impacted systems in the department is a possible step, but it should be done after segmenting the department from the network and reviewing each computer offline. Explaining that malware cannot truly be removed and then reimaging the devices is a drastic step, as it can result in data loss and downtime. It should be done only as a last resort, and after backing up the data and verifying its integrity. Logging on to the impacted systems with an administrator account that has privileges to perform backups is a dangerous step, as it can expose the administrator credentials and privileges to the malware, and allow it to escalate its access and capabilities34. References: Incident Response: Processes, Best Practices & Tools - Atlassian, Incident Response Best Practices | SANS Institute, Malware Removal: How to Remove Malware from Your Device, How to Remove Malware From Your PC | PCMag

Single Sign-On (SSO) allows users to authenticate once and gain access to multiple applications without needing to re-enter credentials for each one.

It reduces password fatigue, improves security, and streamlines authentication across vendor portals.

Why Not Other Options?

A (API) → APIs facilitate data exchange but do not solve authentication problems.

B (MFA) → Enhances security but still requires multiple logins.

D (VPN) → Secures connections but does not eliminate multiple logins.

Isolation is the first step to take after detecting some indicators of compromise (IoCs) of possible ransomware contamination. Isolation prevents the ransomware from spreading to other servers or segments of the network, and allows the security team to investigate and contain the incident. Isolation can be done by disconnecting the infected servers from the network, blocking the malicious traffic, or applying firewall rules12.

To determine the correct priority, you must filter the options by applying the rules from Security Policy 1006 in the order of importance dictated by the scenario.

“The Company shall prioritize patching of publicly available systems and services over patching of internally available system.”

Option A: Internal System

Option B: External System (Keep)

Option C: External System (Keep)

Option D: Internal System

Result: Eliminate Options A and D. We are now choosing between B and C.

“In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.”

To apply this, you must read the CVSS v3.1 Vector String for the remaining options. The relevant metrics are C (Confidentiality) and A (Availability).

Option B (CAP.SHIELD): C:H / I:N / A:N

Confidentiality: High (C:H)

Availability: None (A:N)

Interpretation: This vulnerability allows for a significant breach of data confidentiality.

Option C (LOKI.DAGGER): C:N / I:N / A:H

Confidentiality: None (C:N)

Availability: High (A:H)

Interpretation: This vulnerability allows for a significant disruption of service (DoS).

Conclusion: Since the policy explicitly prioritizes Confidentiality (Option B) over Availability (Option C), Option B is the highest priority.

The exam expects you to parse raw CVSS strings to assess risk. Here is the breakdown for the correct answer (Option B):

Metric

Code

Value

Meaning

AV

AV:N

Network

The vulnerability is exploitable remotely via the network (most dangerous).

AC

AC:L

Low

No complex conditions are required to exploit.

PR

PR:N

None

No privileges are required (unauthenticated).

UI

UI:N

None

No user interaction is required.

C

C:H

High

Confidentiality Impact. Total loss of confidentiality.

A

A:N

None

Availability Impact. No impact to uptime.