CompTIA CySA+ CS0-003 Passing Score

The given firewall logs indicatehigh outbound traffic with low IP reputation, sustained over time, which is a strongindicator of cryptomining activity​.

Option A (Anomalous activity)is a general term but does not specifywhythe activity is suspicious.

Option B (Bandwidth saturation)occurs when network traffic is overwhelming, but cryptomining typicallyuses CPU/GPU powerrather than overwhelming bandwidth.

Option D (Denial of service - DoS)would result incontinuous large requests, but cryptomining generatesconsistent, high-bandwidth outbound trafficrather than bursts of large requests.

Thus,C is the correct answer, as cryptomininggenerates unusual outbound network activity from internal hosts to mining pools​.

Comprehensive Detailed Explanation:To match the mitigation criteria, we analyze each machine’s CVSS (Common Vulnerability Scoring System) attributes:

Attack Vector (AV): N for network (matches the requirement of network-based attack).

Attack Complexity (AC): L for low (meets the requirement for low complexity).

Privileges Required (PR): N for none (indicating no privileges are needed).

User Interaction (UI): N for none (matches the requirement that no user action is needed).

Confidentiality (C), Integrity (I), and Availability (A): Requires high confidentiality and availability with low integrity.

From these criteria:

Computer1 requires user interaction (UI:R), which disqualifies it.

Computer2 has a local attack vector (AV:L), which disqualifies it for a network-based attack.

Computer3 has a high attack complexity (AC:H), which does not meet the low complexity requirement.

Computer4 meets all criteria: network attack vector, low complexity, no privileges, no user interaction, and appropriate confidentiality, integrity, and availability levels.

Thus, Computer4 is the correct answer.

Integrating an IT service delivery ticketing system to track remediation and closure is the best approach to ensure all vulnerabilities are patched in accordance with the SLA. A ticketing system is a software tool that helps manage, organize, and track the tasks and workflows related to IT service delivery, such as incident management, problem management, change management, and vulnerability management. A ticketing system can help the security team to prioritize, assign, monitor, and document the remediation of the vulnerabilities, and to ensure that they are completed within the specified time frame and quality standards. A ticketing system can also help the security team to communicate and collaborate with other teams, such as the IT operations team, the development team, and the business stakeholders, and to report on the status and progress of the remediation efforts12. Creating a compensating control item, accepting the risk, and requesting an exception are not the best approaches to ensure all vulnerabilitiesare patched in accordance with the SLA, as they do not address the root cause of the problem, which is the large number of critical and high findings that require patching. These approaches may also introduce more risks or challenges for the security team, such as compliance issues, resource constraints, or business impacts3 . References: What is a Ticketing System? | Freshservice ITSM Glossary, Vulnerability Management Best Practices, Compensating Controls: An Impermanent Solution to an IT … - Tripwire, [Risk Acceptance in Information Security - Infosec Resources], [Exception Management - ISACA]

An incident response plan (IRP) is a document that defines the roles and responsibilities, procedures, and guidelines for responding to a security incident. It helps the security team to act quickly and effectively, minimizing the impact and cost of the incident. An IRP should specify who should conduct the next steps following a security event, such as containment, eradication, recovery, and analysis12. References: CompTIA CySA+ CS0-003 Certification Study Guide, page 362; 6 Incident Response Steps to Take After a Security Event, section 2.