CompTIA CySA+ CS0-003 Updated Exam

The correct answer is B. Rule to detect and block OS commands. A remote code execution attack allows an attacker to execute malicious code or operating system commands on a target system. Since the question asks what should be configured in a WAF, the best answer is a WAF rule that detects and blocks command-execution patterns, such as attempts to invoke shell commands, command separators, or dangerous OS-level functions.

Exact supporting extract: the All-in-One CySA+ guide states that remote code execution describes an attacker’s ability to execute malicious code on a target platform and may allow arbitrary command execution. It also lists application firewalls as a direct RCE mitigation because they monitor and filter traffic to an application and block suspicious or malicious traffic.

The Secbay CySA+ guide also explains that WAFs filter and monitor HTTP traffic between a web application and the internet, and that WAF rules are configured to block known attack patterns and common web application vulnerabilities.

Why the other options are incorrect:

A. Rate control in deny mode is more useful for throttling abuse, brute-force attempts, scraping, or denial-of-service-style traffic, not specifically RCE.

C. Parameterized queries are a strong mitigation for SQL injection, but they are implemented in application/database code, not configured in a WAF.

D. Stored procedure in the database is database-side logic and does not directly configure the WAF to detect or block RCE payloads.

B is best because RCE commonly involves malicious command execution, and the WAF should block those command patterns before they reach the application.

MITRE ATT & CK is a framework and knowledge base that describes the tactics, techniques, and procedures (TTPs) used by various adversaries in cyberattacks. MITRE ATT & CK can help security analysts compare TTPs between different known adversaries of an organization, as well as identify patterns, gaps, or trends in adversary behavior. MITRE ATT & CK can also help security analysts improve threat detection, analysis, and response capabilities, as well as share threat intelligence with other organizations or communities

The correct answer is A. To ensure the report is legally acceptable in case it needs to be presented in court.

Proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response because they ensure the integrity, authenticity, and admissibility of the evidence in case it needs to be presented in court. Evidence that is mishandled, tampered with, or poorly documented may not be accepted by the court or may be challenged by the opposing party. Therefore, incident responders should follow the best practices and standards for evidence collection, preservation, analysis, and reporting1.

The other options are not reasons why proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response. They are rather outcomes or benefits of conducting a thorough and effective incident response process. A lessons-learned analysis (B) is a way to identify the strengths and weaknesses of the incident response team and improve their performance for future incidents. A postmortem analysis © is a way to determine the root cause, impact, and timeline of the incident and provide recommendations for remediation and prevention. A root cause analysis (D) is a way to identify the underlying factors that led to the incident and address them accordingly.

ABusiness Impact Analysis (BIA)is the correct document thatidentifies critical servicesand definesRecovery Point Objectives (RPOs)andRecovery Time Objectives (RTOs). It helps organizations determine the impact of downtime and the maximum tolerable outages for business functions.

Disaster recovery plan (A)uses the information from the BIA.

Playbooks (C)are tactical and focus on specific incidents.

Backup plans (D)support BIA but don ' t define RPO/RTO themselves.