CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

Question

An analyst is preparing an after-action report following an incident in which multiple systems were compromised over the course of several days. The report includes raw event logs collected from each of the compromised systems, and the analyst determines that a patient-zero system cannot be identified. Which of the following should the analyst do to determine the patient-zero system?

A Establish an accurate timeline of events.
B Enable monitoring on the compromised systems.
C Isolate the compromised systems before remediation.
D Improve the content for incident updates during shift handoff.
E Perform a reverse composition analysis on malware packages.

Explanation

Identifying patient-zero requires correlating and sequencing events across all affected systems to reconstruct how and when the compromise began and spread. Building an accurate timeline from the raw logs allows the analyst to trace the chronological order of events back to the first compromised system, which is the standard forensic method used in incident response investigations for root-cause analysis. Enabling monitoring, isolating systems, improving handoff communication, and performing reverse composition analysis on malware are all valid incident response or forensic activities, but none of them directly reconstructs the sequence of events needed to pinpoint the originating system.

CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

AstroTutor

Notes

Readiness

QuestionQ67

Community Discussion