CompTIA CySA+ (CS0-004) — All Questions

An incident responder isolates a compromised host from the network to stop lateral movement while preserving it for analysis. Which incident response phase does this action belong to?

• a.Preparation
• b.Lessons learned
• c.Detection and analysis
• d.Containment✓

Isolating an affected system to halt the spread of an attack is a core containment activity. Containment buys time to investigate and plan eradication without allowing further damage. Preserving the host rather than immediately wiping it also protects evidence needed for later forensic analysis.

After an incident is fully resolved, the team meets to document what happened, what worked, and what to improve. Which phase of the lifecycle is this?

• a.Lessons learned (post-incident activity)✓
• b.Containment
• c.Eradication
• d.Detection and analysis

The lessons-learned phase captures root cause, timeline, and improvement actions to strengthen future response. Conducting it promptly while details are fresh maximizes value and feeds updates to playbooks and controls. Skipping this phase means the organization repeats avoidable mistakes.

During evidence collection, an analyst records who handled a seized hard drive, when, and for what purpose at every transfer. What forensic principle is being upheld?

• a.Data enrichment
• b.Chain of custody✓
• c.Threat hunting
• d.Sandbox isolation

Chain of custody documents every person who handled evidence and each transfer to prove it was not altered or tampered with. Maintaining an unbroken, well-documented chain is essential for evidence to be admissible in legal proceedings. Gaps in custody can render otherwise valuable evidence useless in court.

To preserve volatile evidence during forensic acquisition, which data should be collected first based on the order of volatility?

• a.Data archived on backup tapes
• b.Files on a powered-off disk
• c.CPU registers, cache, and RAM contents✓
• d.Router configuration stored in NVRAM

The order of volatility dictates collecting the most ephemeral data first, since it disappears quickly. CPU cache, registers, and RAM vanish when power is lost, so they are captured before disk or archival media. Following this order prevents loss of transient artifacts such as running processes, network connections, and encryption keys.

During eradication after a malware incident, which action most directly addresses the goal of this phase?

• a.Notifying the public relations team
• b.Drafting the final executive summary
• c.Restoring service-level agreements with vendors
• d.Removing malicious artifacts and closing the exploited vulnerability✓

Eradication removes the threat, including malware, persistence mechanisms, and the root-cause vulnerability, from the environment. It ensures the adversary cannot simply re-enter through the same path. Only after thorough eradication should the team move to recovery and restore systems to normal operations.

An analyst identifies a specific file hash and registry key left behind by an attacker and adds them to detection rules across all endpoints. What is the analyst primarily doing?

• a.Operationalizing indicators of compromise for detection✓
• b.Calculating a CVSS environmental score
• c.Performing a credentialed vulnerability scan
• d.Establishing chain of custody

Extracting IoCs like file hashes and registry keys and deploying them as detection content helps identify other compromised hosts quickly. This turns incident findings into proactive detection across the environment. Sharing these IoCs internally and with trusted communities strengthens collective defense.