CS0-003: CompTIA Cybersecurity Analyst (CySA+)Demo

Risk appetite establishes which losses an organization considers unacceptable and guides operational risk decisions. The potential impact of a fast-moving ransomware incident on data confidentiality and integrity warrants rapid containment when those objectives are prioritized over monetary considerations.

Photographs preserve the physical condition, arrangement, and connections of affected equipment as evidence before the scene is altered. NIST incident-forensics guidance recommends photographing evidence to retain visual records of computer setups and peripheral devices, alongside detailed evidence-handling documentation.

Attack methodology frameworks model the tactics, techniques, behaviors, and motivations of adversaries so defenders can assess security from an attacker’s perspective and develop appropriate detections and mitigations.

A risk assessment identifies and evaluates threats, vulnerabilities, likelihood, and business impact, producing the summarized risk information needed for an executive briefing.

Passive, agentless sensors at the network edge provide visibility into external network threats without installing endpoint software or sitting inline with traffic. Because they observe rather than control packet forwarding, they do not modify or drop packets and do not add processing delay to transmitted traffic.

Credentialed vulnerability scans authenticate to each system and directly inspect installed software, configurations, and patch status. This produces more accurate patch-level findings than unauthenticated scans, which must infer vulnerability status from externally visible information.

Information-sharing organizations provide timely, vetted threat intelligence exchanged among organizations with shared industry, supply-chain, or risk interests. This makes them especially useful for a critical defense-manufacturing supplier seeking relevant information about an emerging ransomware campaign.

Software composition analysis (SCA) identifies third-party and open-source components in a codebase and can determine the license or licenses associated with each component. This supports a legal review of open-source and paid-licensed library usage.

The Cyber Kill Chain is a model of the phases an adversary generally follows during a cyber intrusion—reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Mapping defensive measures to those phases enables defenders to interrupt the intrusion at any stage. Cyber Kill Chain® | Lockheed Martin

Accounts that lack approved access and unexpected discrepancies in file data indicate unauthorized modifications to access permissions or file contents. This is categorized as unauthorized changes.

Active scanning generates probes to discover reachable devices and assess them. Passive discovery relies on observing existing communications and can miss hosts that do not send or receive traffic during the monitoring period.

BGP origin ASN and prefix data identify the autonomous system advertising an IP prefix, making them useful for detecting unexpected route origins and other routing anomalies. Team Cymru’s origin.asn.cymru.com DNS zone maps an IP address or prefix to its corresponding BGP Origin ASN; option C constructs and queries that lookup.

Disaster recovery planning begins by establishing recovery and continuity priorities with data and business owners. Those priorities define the recovery requirements that guide later decisions about recovery locations, vendors, and agreements.

Volatile network-state evidence should be captured before isolation because disconnecting a host can alter or eliminate it. The routing table records the system’s active network routing configuration, whereas disks, boot partitions, and files can be collected later as nonvolatile evidence. NIST guidance directs responders to capture volatile data, including network configuration information, as evidence.

Bash treats /dev/tcp/host/port in a redirection as a request to open a TCP socket. An active reverse shell therefore appears as a live TCP connection involving port 8080; inspecting active TCP connections and their owning processes most directly verifies that network activity.

A lessons-learned register documents observations and improvement actions identified during exercises and incidents, making it the appropriate resource for improving future SOC processes and tabletop exercises.

Network segmentation separates departments into distinct network segments and controls communications between them, limiting a malicious payload’s ability to spread beyond the finance department.

A remotely exploitable code-execution vulnerability on a high-value target that is actively being exploited presents the most urgent risk. It can enable an attacker to take control of a critical system, so it requires the highest patching priority.

MITRE ATT&CK is a knowledge base of real-world adversary behavior that categorizes tactics, techniques, and sub-techniques. Its matrices and group/software mappings support comparison of the TTPs associated with nation-state actors and other threat groups.

A service level agreement (SLA) defines the service commitments and operational expectations communicated to customers, including planned maintenance and patching windows.

Submitting sensitive, business-critical source code to an AI platform can disclose confidential intellectual property, embedded secrets, and operational details to parties or systems not authorized to receive them. Protecting that information from exposure is the primary concern.

When an operating system reaches end of life, the vendor generally stops providing security updates. Newly discovered vulnerabilities can therefore remain unremediated, increasing the risk that the PC controlling the machinery can be compromised.

A valid leaked credential would allow an attacker to authenticate successfully, register an attacker-controlled MFA device, access the account, remove the legitimate user’s MFA device, and change the password to lock out the legitimate user.

Lateral Movement describes an adversary moving through an environment to access and control additional systems, commonly by pivoting through systems or accounts. Using a compromised role to reach another isolated cloud subscription is a cross-environment pivot and therefore represents lateral movement.