CompTIA CS0-003 Questions Answers

Making a forensic image of the device and creating a SRA-I hash is the best step to preserve evidence, as it creates an exact copy of the device’s data and verifies its integrity. A forensic image is a bit-by-bit copy of the device’s storage media, which preserves all the information on the device, including deleted or hidden files. A SRA-I hash is a cryptographic value that is calculated from the forensic image, which can be used to prove that the image has not been altered or tampered with. The other options are not as effective as making a forensic image and creating a SRA-I hash, as they may not capture all the relevant data, or they may not provide sufficient verification of the evidence’s authenticity. Official References:

Awareness training and education are essential to help staff recognize phishing emails and understand safe email practices, particularly when using legacy applications that might not have the latest securityfeatures. Training helps build a culture of security mindfulness, which is critical for preventing social engineering attacks. According to CompTIA Security+ and CySA+ frameworks, user education is a fundamental aspect of organizational defense against phishing. Options like replacing applications or implementing MFA (while helpful) do not directly address the need for user awareness in this scenario.

Asimulation(such as atabletop exercise or full-scale IR drill) is the best way to demonstrate real-world readiness without affecting operations​.

Option A (Reviewing lessons-learned and playbooks)is valuable but does not actively test readiness.

Option C (Deploying malware)is highly risky and unethical in a production environment.

Option D (Disaster recovery site testing)focuses on DR, not security incident readiness.

Thus,B is the best choice, as simulations effectivelytest incident response capabilities without operational disruption.

The correct answer is D. Routing table. The routing table is volatile technical evidence because it is stored in memory and can change or be lost when the system is isolated, powered down, rebooted, or otherwise modified. In incident response and forensics, volatile evidence must be collected before less volatile evidence.

Exact supporting extract: the Sybex CySA+ Practice Tests explanation states that routing tables are typically stored in RAM, making them highly volatile. It also explains the order of volatility from least to most volatile as backups/printouts, disk drives, virtual memory, and finally CPU cache, registers, and RAM.

The Sybex CySA+ Study Guide states that forensic acquisition must account for the order of volatility, meaning how easily data can be lost. It explains that memory and cache data are highly volatile and may be lost if the system is powered off, while disk data is much less volatile.

The Secbay CySA+ guide also states that the order of volatility must be followed because failing to do so will likely result in evidence being lost. It specifically notes that volatile data is kept in areas such as CPU cache and memory, while archived media persists for much longer.

Why the other options are incorrect:

A. Hard disk is persistent storage and can be imaged later using forensic procedures.

B. Primary boot partition is also persistent disk evidence.

C. Malicious files are important, but files on disk are less volatile than memory-resident network state.

E. Static IP address is configuration information and is not as volatile as the active routing table.

D is correct because the routing table should be captured before isolation changes the server’s active network state.