CompTIA CySA+ Changed CS0-003 Questions

The metric that measures how quickly something is detected/identified is Mean Time to Detect (MTTD). Although MTTD is often used in incident detection, it directly matches the wording “how quickly … are identified” because it measures the time between occurrence and detection.

Secbay Press defines MTTD explicitly as the time to detect an issue:

Exact extract (Secbay Press):

“Mean Time to Detect (MTTD) is… the average time taken to identify and detect a security incident… Mean time to detect is how long it took… to when it was detected.”

Why the other options are not best:

KPI is a category/type of measure (a key metric), not the specific metric itself. Secbay distinguishes metrics vs KPIs and lists MTTD as a KPI example.

SLO is a service objective/target, not a measurement of detection speed by itself.

Alert volume measures quantity of alerts, not detection time.

Exact extract (Secbay Press):

“KPI: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).”

A mean time to remediate (MTTR) is a metric that measures how long it takes to fix a vulnerability after it is discovered. A MTTR of 30 days would best protect the organization from the new attacks that are exploited 45 days after a patch is released, as it would ensure that the vulnerabilities are fixed before they are exploited

The correct answer is B because this is a critical infrastructure / ICS / OT environment. The safest option listed is a targeted, low-impact banner-grabbing approach against the known standard ports: TCP 80 for HTTP and TCP 502 for Modbus. In critical infrastructure, the analyst should avoid aggressive or broad scanning methods that could disrupt fragile industrial systems.

Exact supporting extract: the Secbay CySA+ guide states that vulnerability scanning of OT environments, including ICS and SCADA systems, requires specialized tools and methodologies because these environments have unique security requirements and constraints. It also states that vulnerabilities in ICS can have severe operational and safety implications.

The same guide explains that Modbus is a protocol used in industrial control systems and enables communication among devices connected to the same network.

The Sybex CySA+ Study Guide explains that service identification may be done by connecting and grabbing the banner or connection information provided by the service. It also explains that Nmap can perform service and version detection, but the more aggressive options are less appropriate for sensitive ICS environments.

Why the other options are incorrect:

A is incorrect because a general IT vulnerability scanner may be too intrusive for an oil and gas pipeline ICS environment.

C is incorrect because -A enables aggressive Nmap detection features, which may include OS detection, version detection, scripts, and traceroute. That is riskier in ICS/OT environments.

D is incorrect because Masscan is designed for high-speed scanning and is inappropriate for sensitive critical infrastructure networks.

B is best because it targets only the known ports and uses a less aggressive identification method.

A security analyst’s concern is that any discovered vulnerabilities in the OS that is approaching the end-of-life date will not be remediated by the vendor, leaving the system exposed to potential attacks. The other options are not directly related to the security analyst’s role or responsibility. Verified References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives, page 9, section 2.21