New Release CS0-003 CompTIA CySA+ Questions

The given firewall logs indicatehigh outbound traffic with low IP reputation, sustained over time, which is a strongindicator of cryptomining activity​.

Option A (Anomalous activity)is a general term but does not specifywhythe activity is suspicious.

Option B (Bandwidth saturation)occurs when network traffic is overwhelming, but cryptomining typicallyuses CPU/GPU powerrather than overwhelming bandwidth.

Option D (Denial of service - DoS)would result incontinuous large requests, but cryptomining generatesconsistent, high-bandwidth outbound trafficrather than bursts of large requests.

Thus,C is the correct answer, as cryptomininggenerates unusual outbound network activity from internal hosts to mining pools​.

Implementing controls to block execution of untrusted applications can prevent privilege escalation attacks that leverage native Windows tools, such as PowerShell, WMIC, or Rundll32. These tools canbe used by attackers to run malicious code or commands with elevated privileges, bypassing system security policies and controls. By restricting the execution of untrusted applications, organizations can reduce the attack surface and limit the potential damage of privilege escalation attacks.

SLA stands for service level agreement, which is a contract or document that defines the expectations and obligations between a service provider and a customer regarding the quality, availability, performance, or scope of a service. An SLA may also specify the metrics, penalties, or remedies for measuring or ensuring compliance with the agreed service levels. An SLA can help the SOC manager review if the team is meeting the appropriate contractual obligations for the customer, such as response time, resolution time, reporting frequency, or communication channels.

After recovering a compromised server to its previous state, the analyst should perform forensic analysis to determine the root cause, impact, and scope of the incident, as well as to identify any indicators of compromise, evidence, or artifacts that can be used for further investigation or prosecution. References: CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 6, page 244; CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 6, page 253.