Skip to content
Certification Guides

CompTIA CySA+ Practice Tests: Exam CS0-003 (2023)

CompTIA CySA+ Practice Tests: Exam CS0-003 (2023) helps you master your certification exam with realistic practice questions and detailed answers.

Preview 16 of 596 pages

See the first 16 pages exactly as they appear in the document.

  1. Page 1
    Read page 1 as text

    Exam CS0-003 DoDD 8140/8570 Approved Certification SPECIAL BONUS INCLUDES: On-line access to Flashcards, Practice & Mock Exams Author & Publisher EECBAYPRESS

  2. Page 2
  3. Page 3
    Read page 3 as text

    Certified Cybersecurity Analyst (CySA+) Secbay Press

  4. Page 4
    Read page 4 as text

    Secbay Press Copyright © 2020-2024 Secbay Press. All rights reserved. No part of this certification student guide can be copied, stored in a retrieval system, or transmitted in any manner or through any method, without the prior written permission of Secbay Press, except in the case of brief references/quotations embedded in critical labs, articles, or reviews. Secbay Press has made every effort in the preparation of the courseware to ensure the accuracy of the information presented. However, the information contained in this student guide is sold without warranty, either express or implied. Neither the Authors/SME's nor Secbay Press and its training partners, resellers, and distributors can be held liable for any damage caused or alleged to be caused directly or indirectly by this student guide. Copyright Disclaimer: The information and content provided in this Book, including but not limited to text, graphics, images, and illustrations, are for informational purposes only and should not be considered as legal, financial, or professional advice. The author and publisher of this Book are not responsible for any errors or omissions, or for any actions taken based on the information provided in this Book. Any references or mentions of CompTIA in this Book are for informational purposes only and should not be construed as an endorsement or official representation of CompTIA. The author and publisher are not affiliated with, endorsed by, or otherwise connected to CompTIA or another agency. By accessing or using this Book, you acknowledge and agree to abide by the copyright laws and terms of use outlined in this disclaimer. Unauthorized use, reproduction, or distribution of this Book may result in legal action. Secbay Press has endeavored to provide accurate trademark information about all the companies and products mentioned in this book. However, Secbay Press cannot guarantee the accuracy of such information. Secbay Press has made its best effort to give attribution where applicable to any companies referenced in this book. Disclaimer/Note : The information within the Secbay Press cybersecurity or related books is intended to be used only in an ethical manner to protect your digital assets. Do not use any information from this book if you do not have legal authorization from the software, tools, or equipment owner. If you perform illegal actions, you will likely be arrested and prosecuted by the law. Secbay Press does not take any responsibility if you misuse any of the information contained within the book. The information herein must only be used while authorized in cloud environments with proper written authorizations from the management and your senior authorities within your organization according to your protocols and change management procedures. Published by: Secbay Press, P O Box 5074 Oak Brook, IL 60523 USA www.secbaypress.com info@secbaypress.com ©Secbay Press 2 | Page

  5. Page 5
    Read page 5 as text

    Secbay Press Contributions to this book This book would not have been possible without significant contributions of the following people. These individuals have been instrumental in writing, editing, and updating the content. Thank you to CompTIA CySA+ contributors as follows: ♦ Parm Soni ♦ Kris Hefner ♦ Manoj ♦ Salman ♦ Rhea ♦ Ron ♦ Hamsaraj and rest of the Secbay Press Team Dedication: In loving memory of my dear Dad, Mr. Baldev Soni, whose kindness and generosity touched the lives of everyone around him. Though he left us 20 years ago, his spirit continues to inspire the pages of this book. This publication is dedicated to the man whose love and wisdom shaped our lives. A father ’ s love and guidance are timeless gifts that live on in the hearts of those he touched. In honor of Mr. Baldev Soni, a beacon of kindness and a great Dad, whose legacy illuminates the path of compassion and selflessness. ©Secbay Press 3 | Page

  6. Page 6
    Read page 6 as text

    Secbay Press About Parm Soni - Publisher, Founder & SME Mr. Soni is a distinguished executive and Subject Matter Expert (SME) in the certification and knowledge transfer industry with over 30 years of experience. As a Founder & Co-founder of several successful knowledge transfer companies, Mr. Soni and his team have delivered certification training to over 10,000 professionals worldwide, encompassing major leading vendors such as CompTIA, PMI, EC-Council, Microsoft, MicroFocus/Novell, and more. Mr. Soni is the pioneer behind one of the earliest on-line assessment engines and has been actively engaged in the biometrics field since 1995. He is also the visionary founder of the world ’ s first vendor-neutral biometrics certification. He holds a Bachelor ’ s in Electrical and Computer Engineering from IIT, Chicago, and an MSCS in Telecommunications from DePaul University (1993). He has served a multitude of Fortune 500 companies and federal organizations, delivering customized training programs and sharing his wealth of knowledge. Mr. Soni stands as a revered figure in the certification and knowledge transfer industry, offering unparalleled expertise and dedication to the advancement of professionals worldwide. Contact: Parm@Secbay.com Kris Hefner - SME and CertFirst Certified Trainer Kris Hefner Credentials: Certfirst Certified Trainer, CompTIA Certified, EC-Council Certified, Certified Biometrics Security Professional, Certified CertCop Trainer, M.S. Information Assurance, M.S. Cybersecurity, B.S. Computer Science, US Army Network Engineer. Contact: Training@CertFirst.com ©Secbay Press 4 | Page

  7. Page 7
    Read page 7 as text

    Secbay Press CertTips from CertAdvisor By Parm Soni Candidates who are pursuing technology certifications must be disciplined and understand what it requires to learn these technologies and pass these tough exams. Shortcuts by practicing only exam dumps are not the way to go! It ’ s a career disaster waiting to happen, as you will not have the confidence even if you secure a job. Here is my step-by-step advice to prepare for any certification exam: CertAdvisor: Gateway to Certification The technology certification market is a dynamic ecosystem, featuring a multitude of respected vendors and industries, including CompTIA, EC-Council, Biocertification, Open Source (Linux, Python, Postgresqlcert, MySQL. Java, etc), AI, AWS, Microsoft, ISC(2), ISACA, and many more. It has evolved into a pivotal force in today ’ s job market, with certifications from these industry leaders serving as credible endorsements of individuals ’ expertise. These certifications validate their skills and knowledge in specific technologies or domains, making them indispensable in a fast-paced tech landscape where innovations unfold rapidly. Employers have come to rely on certifications as reliable indicators of a candidate ’ s capabilities, simplifying the identification of qualified professionals. Consequently, technology certifications have become a currency of immense value in the job market, equipping individuals with the means to secure superior career opportunities, advance professionally, and contribute effectively to the ever-evolving tech industry. • Step 1: Understanding Prerequisites Before embarking on your certification journey, it is crucial to thoroughly comprehend the prerequisites. For instance, if you ’ re pursuing the CompTIA CySA+ certification, ensure that you ’ ve either completed the CompTIA Security+ certification or possess equivalent experience, as stipulated by CompTIA ’ s prerequisites. In the absence of these qualifications, consider delving into the CySA+ curriculum. Should budget constraints be a concern, explore on-demand training options or immerse yourself in CySA+ literature to establish a robust foundation in networking concepts. Whether you opt for instructor-led training, on-demand courses, or self-study, grasping prerequisites stands as the initial stepping stone to attaining advanced certifications. • Step 2: Time Management - Craft a Study Schedule Effective time management is paramount. Create a well-structured study schedule, emphasizing the allocation of dedicated time each day or week for certification preparation. Consistency is the linchpin of success. • Step 3: Active Learning - Engage in Effective Techniques Engage in active learning techniques to enhance understanding and retention. Develop or utilize flashcards, summarize daily notes, and, when possible, take on the role of an educator by elucidating concepts to fellow certification seekers. These strategies reinforce comprehension and retention, fostering a robust grasp of the material. ©Secbay Press 5 | Page

  8. Page 8
    Read page 8 as text

    Secbay Press • Step 4: Domain Mastery Before Practice Refrain from attempting practice or mock exams until you ’ ve achieved mastery in each domain and harbor confidence in your understanding. Create a checklist of topics and subtopics drawn from the certification program ’ s exhaustive agenda provided by the vendor. Focus on practicing exams from a specific domain only after achieving a minimum 80 percent success rate. Review questions answered incorrectly, utilizing them as opportunities for reverse learning, reinforcing your mastery of each domain and topic in a modular fashion. • Step 5: Community and Resources - Leverage Support Networks I strongly encourage you to engage with online forums, study groups, or social media communities dedicated to your specific certification. These platforms provide invaluable spaces for discussing challenging topics, sharing educational resources, and gaining insights from the experiences of fellow certification aspirants. • Step 6: Practical Application - Embrace Hands-On Learning For technical certifications, especially in areas like cybersecurity, cloud technology, or databases, underscore the significance of practical experience. I highly recommend utilizing virtual labs and hands- on exercises to apply theoretical knowledge. Practical application not only deepens understanding but also builds essential skills and self-confidence. • Step 7: Test-Taking Strategies - Comprehensive Preparation and Mock Exams Once you ’ ve attained mastery across all domains, intensify your preparation by taking additional practice exams. When you feel ready for the actual test, consider investing in online mock exams from reputable sources like examIT.com. These simulations include a full money-back guarantee if you pass their online mock exam on your initial attempt but subsequently fail the actual test. Their remarkable success rate attests to their quality. If your scores persistently fall below 80 percent, revisit areas where you feel less confident. Scores below 70 percent necessitate careful consideration of attending instructor-led training sessions. Opt for virtual live sessions, as they offer cost-effective alternatives to traditional classroom training, which can be particularly beneficial for those pursuing self-study due to budget constraints. These simulated mock exams not only prepare you comprehensively but also equip you with essential test-taking strategies. Managing time during the actual exam, effectively eliminating incorrect answers, and the importance of flagging questions for review are all covered. These strategies significantly enhance your performance during the certification exam. Most vendors also offer similar services, albeit at a slightly higher cost, which you can consider as well. • Step 8: Refinement Through Additional Resources After successfully passing mock exams, channel your efforts into refining your understanding of areas that continue to pose challenges. Utilize on-demand training, flashcards, or freely available YouTube videos to reinforce your knowledge. ©Secbay Press 6 | Page

  9. Page 9
    Read page 9 as text

    Secbay Press By meticulously adhering to these steps, you enhance your chances of achieving certification and, more importantly, cultivate the confidence essential for roles aligned with your certification. Always remember to shun shortcuts such as exam dumps, etc. USING THIS BOOK EFFECTIVELY Welcome to the world of cybersecurity analysts and the field of defensive cybersecurity! This guide is here to help you get the most out of your cybersecurity textbook. It ’ s vital to understand how to use this valuable resource to boost your learning journey. This book is essential for students studying on their own for this challenging certification or taking on-demand training. While the best choice is usually instructor-led classroom or live virtual training, not everyone has access to these options. This book is a fantastic resource for anyone looking to gain cybersecurity knowledge and prepare for the CompTIA CySA+ exam. However, keep in mind that achieving success in the exam will require additional effort beyond what ’ s covered in this book. You ’ ll need to become familiar with the tools commonly used by cybersecurity analysts. Before we dive into the details, it ’ s important to note that the content in the cybersecurity textbook may include references to real-world test environments, simulated scenarios, trademarked names, and copyrighted materials. These are used solely for educational purposes, with no intention of infringing on rights. While we strive for accuracy, errors may still occur. Getting Started: Orientation: Begin by thoroughly reading the introduction and table of contents. Get to know how the textbook is structured, its chapters, and objectives. Study Environment: Create an ideal study space, free from distractions, with good lighting. A reliable internet connection is all you need to start. If you don ’ t have reliable internet access, you may be able to download the book if permitted by the provider. Important Note: The links in this book may change over time and may become inaccessible. Secbay Press is not responsible for broken links. The information is accurate as of the time of writing. Keep in mind that links change for various reasons, including organizational changes, company acquisitions, network issues, and rebranding. Chapter Selection: Depending on your current expertise level and course requirements, choose the chapters or sections to study. Even if some content is familiar, don ’ t skip any chapters to succeed in the certification exam. Active Reading: When reading, engage with the content actively. Take notes, highlight key points, and jot down questions or areas of confusion. Testbed Environment and Simulated Scenarios: Hands-On Practice: Many cybersecurity textbooks include practical exercises and scenarios. Use these to gain hands-on experience in a controlled setting. You may come across terms like “ testbed environment ” or “ simulated scenarios ” - these are meant to provide a safe space for applying your knowledge without real-world risks. ©Secbay Press 7 | Page

  10. Page 10
    Read page 10 as text

    Secbay Press Virtual Labs: If your textbook is part of a training package, you may have access to virtual labs. Make the most of these resources. They simulate real-world cybersecurity situations, allowing you to test your skills in a risk-free environment. It ’ s highly recommended to have a Linux terminal to practice commands as you learn. Even better, consider installing a virtual machine operating system like Kali Linux or Ubuntu Linux in software like VMWare or VirtualBox. This provides an immersive experience for practical, hands-on learning. Also Check out www.examit.com as you may be able to purchase related exam resources at a very reasonable price. Review and Assessment: In your journey toward cybersecurity excellence, consider these aspects of review and assessment: • Regular Review: Make it a habit to revisit previously covered chapters periodically. This practice reinforces your understanding and ensures the long-term retention of the knowledge you ’ ve gained. • Self-Assessment: Utilize any available practice exams and assessments to assess your progress. This allows you to pinpoint areas that may require additional focus and improvement. Conclusion: By adhering to the aforementioned guidelines and leveraging supplementary resources, you can optimize your use of the official study guide. It ’ s important to recognize that cybersecurity is an ever evolving field, demanding continuous learning. Your textbook serves as the foundation for your entry into the realm of defensive cybersecurity. Moreover, if you aspire to elevate your skills to the next level, consider the benefits of instructor-led training. This avenue provides a deeper dive into the tools and techniques used by cybersecurity analysts. It also offers practical hands-on experience, complementing the course materials and expanding your tradecraft in the field. Disclaimer: Before we delve into the specifics, it's important to note that the content within the cybersecurity textbook may include references to real-world testbed environments, simulated scenarios, trademarked names, and copyrighted materials. These are used for educational purposes only, and no infringement of rights is intended. The accuracy of the information is diligently maintained, but errors may still occur. For any concerns regarding copyrighted materials or inaccuracies, please contact the publisher. For more information regarding the exam prep and additional tools can be obtained at www.examit.com Happy learning! ©Secbay Press 8 | Page

  11. Page 11
    Read page 11 as text

    Secbay Press Table of Contents About this Program: ......................................................................................................................... 22 Target Audience: .............................................................................................................................. 22 Program Prerequisites: ................................................................................................................... 22 How to use this Program: ............................................................................................................... 22 Objectives: ........................................................................................................................................ 23 DOMAIN 1 .......................................................................................................................................... 24 Threat and Vulnerability Management ............................................................................................ 24 1.1 Explain the importance of threat data and intelligence ..................................................................... 24 1.1.1 Intelligence sources ............................................................................................................................ 24 1.1.2 Confidence Levels .............................................................................................................................. 25 1.1.3 Indicator Management ...................................................................................................................... 25 1.1.4 Threat Classification .......................................................................................................................... 27 1.1.5 Intelligence Cycle ............................................................................................................................... 28 1.1.6 Commodity Malware ......................................................................................................................... 29 1.1.7 Information Sharing and Analysis Communities ................................................................................ 29 1.2 Given a Scenario, Utilize Threat Intelligence to Support Organizational Security ............................ 31 1.2.1 Attack Frameworks ............................................................................................................................ 31 1.2.2 Threat Research ................................................................................................................................. 35 1.2.3 Threat Modeling Methodologies ....................................................................................................... 36 1.2.4 Threat Intelligence Sharing With Supported Functions .................................................................... 39 1.2.5 Threat Intelligence Sharing With Supported Functions .................................................................... 39 1.2.6 Threat Hunting ................................................................................................................................... 40 1.3 Explain the security concerns associated with various types of vulnerabilities ................................. 41 1.3.1 Cloud-based vs. on-premises vulnerabilities ..................................................................................... 41 1.3.2 Zero-day ............................................................................................................................................. 42 1.3.3 Weak configurations ......................................................................................................................... 43 1.3.4 Third-party risks ................................................................................................................................. 44 1.3.5 Improper or weak patch management ............................................................................................. 46 1.3.6 Legacy platforms ................................................................................................................................ 47 1.3.7 Impacts .............................................................................................................................................. 47 1.4 Summarize the techniques used in security assessments .................................................................. 50 ©Secbay Press 9 | Page

  12. Page 12
    Read page 12 as text

    Secbay Press 1.4.1 Threat hunting 50 1.4.2 Vulnerability scans 52 1.4.2.1 - OWASP TOP 10 ........................................................................................................................ 55 1.4.3 Syslog/Security information and event management (SIEM) ........................................................... 56 1.4.4 Security orchestration, automation, and response (SOAR) .............................................................. 58 1.5 Given a Scenario, Perform Vulnerability Management Activities ...................................................... 60 1.5.1 Vulnerability Identification ............................................................................................................... 60 1.5.2 Validation .......................................................................................................................................... 61 1.5.3 Remediation / Mitigation .................................................................................................................. 62 1.5.4 Scanning Parameters and Criteria .................................................................................................... 63 1.5.5 Vulnerability Feed and Scope ............................................................................................................ 64 1.5.6 Credentialed Vs Non-Credentialed ................................................................................................... 64 1.5.7 Special Considerations ...................................................................................................................... 64 1.5.8 Inhibitors to Remediation ................................................................................................................. 66 1.5.9 Vulnerability scans ............................................................................................................................. 67 1.3.9.1 - Vulnerability Assessment .......................................................................................... 67 1.5.10 Security Content Automation Protocol (SCAP) ............................................................................... 69 1.5.11 Self-assessment vs. third- party vendor assessment ...................................................................... 73 1.5.12 Patch management ......................................................................................................................... 73 1.5.13 Information sources ........................................................................................................................ 73 1.5.14 Asset Discovery ................................................................................................................................ 75 1.5.15 Baseline ........................................................................................................................................... 75 1.5.16 Baseline ........................................................................................................................................... 75 1.5.17 Analyzing data to prioritize vulnerabilities ..................................................................................... 76 1.6 Given a scenario, use the appropriate vulnerability assessment and penetration testing methods and tools ................................................................................................................................................................ 77 1.6.1 Methods ............................................................................................................................................ 77 1.6.2 Tools ................................................................................................................................................... 80 1.6.3 Dependency management ................................................................................................................ 88 1.6.4 Requirements .................................................................................................................................... 88 1.7 In a Given Situation, Evaluate Results from Standard Vulnerability Assessment Tools ..................... 90 1.7.1 Web Application Scanner .................................................................................................................. 90 1.7.2 Infrastructure Vulnerability Scanner ................................................................................................ 92 ©Secbay Press 10 | Page

  13. Page 13
    Read page 13 as text

    Secbay Press 1.7.3 Software Assessment Tools and Techniques ..................................................................................... 93 1.7.4 Enumeration ...................................................................................................................................... 94 1.7.5 Wireless Assessment Tools ................................................................................................................ 97 1.7.6 Cloud Infrastructure Assessment Tools ............................................................................................. 99 1.7.7 Network Scanning and Mapping ...................................................................................................... 101 1.7.8 Debuggers ........................................................................................................................................ 101 1.7.9 Metasploit Framework (MSF) .......................................................................................................... 102 1.8 Explain the Threats and Vulnerabilities Associated with Specialized Technology .......................... 103 1.8.1 Mobile ............................................................................................................................................. 103 1.8.2 Internet of Things ............................................................................................................................. 104 1.8.3 Embedded Systems ......................................................................................................................... 105 1.8.4 Real Time Operating Systems .......................................................................................................... 105 1.8.5 System on Chip (Soc) ....................................................................................................................... 105 1.8.6 Field Programmable Gate array (FPGA) .......................................................................................... 106 1.8.7 Physical Access Control ................................................................................................................... 106 1.8.8 Vehicles and Drones ........................................................................................................................ 107 1.8.9 Workflow and Process Automation Systems ................................................................................... 107 1.8.10 Industrial Control Systems ............................................................................................................. 107 1.8.11 Critical Infrastructure .................................................................................................................... 108 1.9 Elaborate on the Risks and Weaknesses Connected with Cloud Operations ................................... 109 1.9.1 Cloud service models ...................................................................................................................... 109 1.9.2 Cloud deployment models ............................................................................................................... 109 1.9.3 Function as a Service (FaaS) ............................................................................................................. 110 1.9.4 Infrastructure as code (IaC) ............................................................................................................. 111 1.9.5 Insecure API ..................................................................................................................................... 111 1.9.6 Improper Key Management ............................................................................................................ 112 1.9.7 Unprotected Storage ....................................................................................................................... 112 1.9.8 Logging and monitoring ................................................................................................................... 112 1.10 Given a scenario, analyze vulnerabilities and recommend risk mitigations .................................... 114 1.10.1 Vulnerabilities ................................................................................................................................ 114 1.10.2 Inherently vulnerable system/application ..................................................................................... 121 1.10.3 Attacks ........................................................................................................................................... 123 Practice Questions - Threat and Vulnerability Management ....................................................................... 132 ©Secbay Press 11 | Page

  14. Page 14
    Read page 14 as text

    Secbay Press Answers for Practice Questions ............................................................................................................... 140 DOMAIN 2 ....................................................................................................................................... 144 Software and Systems Security ................................................................................................... 144 2.1 In a given context, implement security measures for managing infrastructure ................................. 144 2.1.1 Cloud vs. On-Premises .................................................................................................................... 144 2.1.2 Asset management ......................................................................................................................... 144 2.1.3 Segmentation .................................................................................................................................. 144 2.1.4 Network Architecture ..................................................................................................................... 146 2.1.5 Change management ...................................................................................................................... 148 2.1.6 Serverless Infrastructure ................................................................................................................. 148 2.1.7 Virtualization ................................................................................................................................... 149 2.1.8 Containerization .............................................................................................................................. 151 2.1.9 Identity and access management ................................................................................................... 151 2.1.10 Cloud Access Security Broker (CASB) ............................................................................................. 154 2.1.11 Honeypots ..................................................................................................................................... 155 2.1.12 Encryption ..................................................................................................................................... 155 2.1.13 Certificate management ............................................................................................................... 157 2.1.14 Active defense ............................................................................................................................... 157 2.2 Explain software assurance best practices ........................................................................................... 158 2.2.1 Platforms ......................................................................................................................................... 158 2.2.2 Software Development Life Cycle .................................................................................................. 159 2.2.3 DevSecOps ....................................................................................................................................... 159 2.2.4 Software assessment methods ....................................................................................................... 160 2.2.5 Secure coding best practices ........................................................................................................... 162 2.2.6 Static analysis .................................................................................................................................. 163 2.2.7 Dynamic analysis ............................................................................................................................. 163 2.2.8 Service oriented architecture .......................................................................................................... 164 2.3 Programming Languages/Scripting ..................................................................................................... 166 2.4 Explain hardware assurance best practices ......................................................................................... 167 2.4.1 Hardware Root of Trust .................................................................................................................. 167 2.4.2 eFUSE .............................................................................................................................................. 168 2.4.3 Unified Extensible Firmware Interface (UEFI) ................................................................................. 168 2.4.4 Trusted Foundry .............................................................................................................................. 169 ©Secbay Press 12 | Page

  15. Page 15
    Read page 15 as text

    Secbay Press 2.4.5 Secure Processing ............................................................................................................................ 170 2.4.6 Anti-Tamper ..................................................................................................................................... 171 2.4.7 Self-Encrypting Drive ....................................................................................................................... 171 2.4.8 Trusted Firmware Updates .............................................................................................................. 171 2.4.9 Measured Boot and Attestation ...................................................................................................... 172 2.4.10 Bus Encryption ............................................................................................................................... 172 Practice Questions - Software and Systems Security ................................................................................... 174 Answers for Practice Questions ................................................................................................................ 182 DOMAIN 3 ........................................................................................................................................ 188 Security Operations and Monitoring ............................................................................................ 188 3.1 In a given scenario, assess data as a component of security monitoring tasks 188 3.1.1 Heuristics ......................................................................................................................................... 188 3.1.2 Trend Analysis .................................................................................................................................. 188 3.1.3 Endpoint Data Analysis .................................................................................................................... 188 3.1.4 Network Data Analysis .................................................................................................................... 191 3.1.5 Log Review ....................................................................................................................................... 192 3.1.6 Impact Analysis ................................................................................................................................ 194 3.1.7 Security Information and Event Management (SIEM) Review ....................................................... 194 3.1.8 Query Writing .................................................................................................................................. 195 3.1.9 Email Analysis .................................................................................................................................. 195 3.1.10 Domain Name Service (DNS) and Internet Protocol (IP) Reputation: ........................................... 197 3.1.11 File Analysis .................................................................................................................................... 197 3.1.12 Sandboxing .................................................................................................................................... 198 3.1.13 Common techniques to Determine Malicious Activity ................................................................. 198 3.2 In a given scenario, apply modifications to existing controls to enhance security .............................. 199 3.2.1 Permissions ...................................................................................................................................... 199 3.2.2 Whitelisting Blacklisting .................................................................................................................. 200 3.2.3 Firewalls ........................................................................................................................................... 200 3.2.4 Intrusion Prevention Systems (IPSs) ................................................................................................ 200 3.2.5 Data Loss Prevention (DLP) .............................................................................................................. 201 3.2.6 Endpoint Detection and Response (EDR) ........................................................................................ 201 3.2.7 Network Access Control (NAC) ........................................................................................................ 201 3.2.8 Sinkholing ........................................................................................................................................ 202 ©Secbay Press 13 | Page

  16. Page 16
    Read page 16 as text

    Secbay Press 3.2.9 Malware Signatures ........................................................................................................................ 202 3.2.10 Sandboxing .................................................................................................................................... 202 3.2.11 Port Security .................................................................................................................................. 202 3.2.12 Operating System (OS) Concepts .................................................................................................. 203 3.3 Explain the Importance of Proactive Threat Hunting .......................................................................... 204 3.3.1 Establishing a Hypothesis ................................................................................................................ 204 3.3.2 Threat Actors and Activities ............................................................................................................ 204 3.3.3 Threat Hunting Tactics .................................................................................................................... 205 3.3.4 Reducing the Attack Surface Area ................................................................................................ 205 3.3.5 Bundling Critical Assets ................................................................................................................... 205 3.3.6 Attack Vectors ................................................................................................................................. 206 3.3.7 Integrated Intelligence .................................................................................................................... 206 3.3.8 Improving Detection Capabilities ................................................................................................... 206 3.4 Compare and Contrast Automation Concepts and Technologies ....................................................... 207 3.4.1 Workflow Orchestration ................................................................................................................. 207 3.4.2 Scripting .......................................................................................................................................... 207 3.4.3 Application Programming Interface (API) Integration ..................................................................... 207 3.4.4 Automated Malware Signature Creation ........................................................................................ 208 3.4.5 Data Enrichment .............................................................................................................................. 208 3.4.6 Threat Feed Combination ............................................................................................................... 208 3.4.7 Machine Learning ............................................................................................................................ 208 3.4.8 Use of Automation Protocols and Standards ................................................................................... 209 3.4.9 Continuous Integration ................................................................................................................... 209 3.4.10 Continuous Deployment / Delivery 209 3.4.11 Continuous Deployment / Delivery 209 Practice Questions - Security Operations and Monitoring .......................................................................... 212 Answers for Practice Questions ............................................................................................................... 220 DOMAIN 4 ....................................................................................................................................... 225 Incident Response ......................................................................................................................... 225 4.1 Elaborate on the significance of the incident response process ......................................................... 225 4.1.1 Importance of Incident Response ................................................................................................. 225 4.1.2 Response Coordination with Relevant Entities ................................................................................ 226 4.1.3 Factors Contributing to Data Criticality .......................................................................................... 227 ©Secbay Press 14 | Page

580 more pages in the full document

Unlock it once and it stays in your library, ready to chat with or turn into flashcards.

Unlock the full document

More CompTIA Certifications study materials

See all

Study this document with CramX

Once it is in your library, every tool can work from it.