CS0-003 Exam Dumps : CompTIA CyberSecurity Analyst CySA+ Certification Exam

Reimaging the device is the most effective way to eliminate persistent malware because some sophisticated malware, such as rootkits and firmware-level threats, can survive traditional scans and removals.

If a system keeps getting reinfected after cleaning, it may indicate a deeply embedded persistent threat, possibly in:

The Master Boot Record (MBR) or EFI firmware.

A compromised system restore point.

A hidden backdoor left by the malware.

Why Not Other Options?

A (Update and scan in safe mode) → Might help, but if malware is persistent, it will likely return.

C (Upgrade OS) → Does not necessarily remove malware; some malware survives OS upgrades.

D (Secondary scanner) → Useful for detection but does not guarantee complete removal.

Best Practice:

Replace the hard drive to eliminate firmware-level infections.

Reimage the system from a known-good source.

Update the OS and security patches before reconnecting to the network.

The correct answer is A. 121.19.30.221.

Based on the log files and the organization’s priorities, the host that warrants additional investigation is 121.19.30.221, because it is the only host that accessed a file containing sensitive data and is not from the partner vendor’s range.

The log files show the following information:

The IP addresses of the hosts that accessed the web server

The date and time of the access

The file path of the requested resource

The number of bytes transferred

The organization’s priorities are:

Unauthorized data disclosure is more critical than denial of service attempts

Denial of service attempts are more important than ensuring vendor data access

According to these priorities, the most serious threat to the organization is unauthorized data disclosure, which occurs when sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, altered, or used by an individual unauthorized to do so123. Therefore, the host that accessed a file containing sensitive data and is not from the partner vendor’s range poses the highest risk to the organization.

The file that contains sensitive data is /reports/2023/financials.pdf, as indicated by its name and path. This file was accessed by two hosts: 121.19.30.221 and 216.122.5.5. However, only 121.19.30.221 is not from the partner vendor’s range, which is 216.122.5.x. Therefore, 121.19.30.221 is a potential unauthorized data disclosure threat and warrants additional investigation.

The other hosts do not warrant additional investigation based on the log files and the organization’s priorities.

Host 134.17.188.5 accessed /index.html multiple times in a short period of time, which could indicate a denial of service attempt by flooding the web server with requests45. However, denial of service attempts are less critical than unauthorized data disclosure according to the organization’s priorities, and there is no evidence that this host succeeded in disrupting the web server’s normal operations.

Host 202.180.1582 accessed /images/logo.png once, which does not indicate any malicious activity or threat to the organization.

Host 216.122.5.5 accessed /reports/2023/financials.pdf once, which could indicate unauthorized data disclosure if it was not authorized to do so. However, this host is from the partner vendor’s range, which is required to have access to monthly reports and is the only external vendor with authorized access according to the organization’s requirements.

Therefore, based on the log files and the organization’s priorities, host 121.19.30.221 warrants additional investigation as it poses the highest risk of unauthorized data disclosure to the organization.

ISO 27001 is an international standard that establishes a framework for implementing, maintaining, and improving an information security management system (ISMS). It helps organizations demonstrate their commitment to protecting their data and complying with various regulations and best practices. The other options are not relevant for this purpose: PCI DSS is a standard that focuses on protecting payment card data; COBIT is a framework that provides guidance on governance and management of enterprise IT; ITIL is a framework that provides guidance on service management and delivery.