CompTIA CySA+ CS0-003 Dumps PDF

Adding the SHA-256 hash of a legitimate Microsoft-signed binary like svchost.exe to detection signatures would result in the indicator firing on the majority of Windows devices. Svchost.exe is a common and legitimate system process used by Windows, and using its hash as an indicator ofcompromise (IOC) would generate numerous false positives, as it would match the legitimate instances of svchost.exe running on all Windows systems.

The correct answer is B. In forensic analysis, the analyst wants to preserve volatile evidence and prevent the user from changing system state. If the computer is powered off, data in memory, running processes, active network connections, and other volatile artifacts may be lost. If the user continues interacting with the computer, they may unintentionally overwrite or alter evidence.

Exact supporting extract: the Sybex CySA+ Study Guide states that forensic evidence acquisition may require “making live memory images to ensure that information is not lost when a system is powered off.” It also explains that order of volatility measures how easy data is to lose and that data in memory or caches is highly volatile.

The Secbay CySA+ guide also states that allowing a computer to enter hibernation or sleep mode can change memory properties and result in loss of forensic evidence. It further explains that failing to follow order of volatility will likely result in evidence being lost.

Why the other options are incorrect:

A is incorrect because the main reason is evidence preservation, not preventing misuse.

C is incorrect because the analyst is not validating tool installation or patch status.

D is incorrect because legal hold is a legal preservation process, not the immediate reason to keep a live system powered on.

Registry key values would be missing from a scan performed with this configuration, as the scanner appliance would not have access to the Windows Registry of the scanned systems. The WindowsRegistry is a database that stores configuration settings and options for the operating system and installed applications. To scan the Registry, the scanner would need to have credentials to log in to the systems and run a local agent or script. The other items would not be missing from the scan, as they can be detected by the scanner appliance without credentials. Operating system version can be identified by analyzing service banners or fingerprinting techniques. Open ports can be discovered by performing a port scan or sending probes to common ports. IP address can be obtained by resolving the hostname or using network discovery tools.

ISO 27001 is an international standard that establishes a framework for implementing, maintaining, and improving an information security management system (ISMS). It helps organizations demonstrate their commitment to protecting their data and complying with various regulations and best practices. The other options are not relevant for this purpose: PCI DSS is a standard that focuses on protecting payment card data; COBIT is a framework that provides guidance on governance and management of enterprise IT; ITIL is a framework that provides guidance on service management and delivery.