CS0-004: CompTIA Cybersecurity Analyst (CySA+)

Because the malicious link was confirmed to be a credential-harvesting site and the user did visit it, the user's credentials must be treated as potentially compromised regardless of whether misuse has been observed yet. The incident response containment phase requires taking action to limit further damage — such as resetting the affected credentials or disabling the account — before closing the case. By moving directly to a training recommendation and closing the incident without resetting or invalidating the potentially exposed credentials, the analyst skipped the containment step of the incident response process.

Per the order-of-volatility principle used in incident response, the most ephemeral evidence must be preserved before it changes or disappears. Netstat output reflects the server's currently active network connections and sessions, which are live, in-memory state that is destroyed the moment the server is taken off the network. Because the analyst's very next action is to disconnect the server from the network, this connection data must be captured first, before that state is irrecoverably lost. ShellBags and the hard disk are non-volatile, disk-resident artifacts that remain available for later imaging and analysis even after the server is disconnected, and the ARP cache, while volatile, does not depend directly on active network connectivity the way netstat's session data does, making it less time-critical in this specific scenario.

During the analysis phase of incident response, security personnel perform triage — reviewing and validating detected events, determining their scope and severity, and prioritizing which incidents require further investigation or escalation. This is distinct from containment activities like isolation, eradication/recovery activities like reimaging, or preparation/detection activities like writing alert rules.

Chain of custody is the formal process that documents who collected each piece of evidence, when and where it was collected, who handled or transferred it, and how it was stored, creating an unbroken record from collection through analysis and legal proceedings. This documentation ensures the integrity and admissibility of evidentiary artifacts by proving they were not altered or tampered with. Packaging/labeling and storage/containment are supporting physical-handling activities, and post-incident reporting occurs after the response concludes—neither of these serves the specific function of formally recording evidence handling like chain of custody does.

Eradication is the incident response phase focused on completely removing the cause of the incident from the environment — this includes deleting malicious accounts, removing backdoors and malware, closing exploited vulnerabilities, and revoking any unauthorized access the attacker obtained. Unlike Containment, which temporarily isolates or limits the spread of an incident (e.g., segmenting a compromised host from the network) without necessarily eliminating the attacker's foothold, Eradication ensures the threat and all associated access are permanently eliminated before moving into the Recovery phase. Detection (or Identification) only concerns recognizing that an incident has occurred, and "Denial of service" is a type of attack, not a phase of the incident response lifecycle.