Free Practice Questions for CompTIA CS0-003 Exam

The analyst should review PID 768 first because it is the parent process of another suspicious process (PID 1100) and it is also highly suspicious itself due to its unexpected file path.

Why PID 768 is the best first process to review

Path anomaly (strong IoC): Legitimate Windows binaries like calc.exe and cmd.exe are normally found in trusted OS directories (e.g., C:\Windows\System32\). In the table, both CALC.exe and CMD.exe appear in a user’s Documents folder (C:\Users\JDoe\Documents\...). That is a classic sign of masquerading (a malicious binary using a legitimate-sounding name). The All-in-One guide explicitly describes how attackers disguise malicious processes by using legitimate-sounding names and mimicking system processes.

Parent-child relationship (investigation priority): PID 1100 (Documents\CMD.exe) is suspicious, but it is a child of PID 768 (Documents\CALC.exe). Investigating the parent first helps you understand what spawned the suspicious child, what activity preceded it, and whether PID 768 is the root of the execution chain. The All-in-One guide highlights that analysts should examine process parent-child relationships and investigate unexpected dependencies as a way to detect malicious activity:Exact extract (All-in-One Exam Guide): “Analyze process dependencies Examine process parent-child relationships and investigate any unexpected or unusual dependencies that may indicate malicious activity.” It also emphasizes monitoring grandparent/parent/child relationships to detect deviations from normal process hierarchies:Exact extract (All-in-One Exam Guide): “Monitoring the relationships between processes, particularly grandparent, parent, and child relationships, can be a valuable method for detecting unusual activity.”

Abused/LOLBIN context: cmd.exe is a commonly abused Windows utility in attacks. The Sybex Study Guide notes that attackers often abuse built-in tools and that abnormal OS process behavior involving tools like cmd.exe can indicate compromise:Exact extract (Sybex Study Guide): “For Windows systems, a handful of built-in tools are most commonly associated with attacks like these, including cmd.exe…”

Why the other options are less correct

A (533) and B (740) are running from C:\Windows\System32\... which is the expected location for legitimate Windows binaries in normal circumstances, so they’re less suspicious than the copies running from a user Documents folder.

D (1100) is suspicious, but it is a child of PID 768. Investigating 768 first helps determine the origin and execution chain that led to the suspicious cmd instance.

References (CompTIA CySA+ CS0-003 documents / study guides used):

Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): parent/child process dependency analysis; process hierarchy monitoring; masquerading techniques

Mike Chapple & David Seidl, CompTIA CySA+ Study Guide (CS0-003): abnormal OS process behavior; cmd.exe commonly associated with attacks

Port 3389 is commonly used by Remote Desktop Protocol (RDP), which is a service that allows remote access to a system. A vulnerability on this port could allow an attacker to compromise the web server or use it as a pivot point to access other systems. However, if the firewall blocks this port, the risk of exploitation is reduced.

When documenting a physical incident in a network data closet, taking photos provides a clear and immediate record of the situation, which is essential for thorough incident documentation and subsequent investigation.

Proper documentation of an incident in a data closet should include taking photos of the impacted items. This provides visual evidence and helps in understanding the physical context of the incident, which is crucial for a thorough investigation. Backing up configuration files, recording connections, and creating network diagrams, while important, are not the primary means of documenting the physical aspects of an incident.

The correct answer is B because the packet capture shows ICMP echo request traffic carrying data in the packet payload. ICMP echo requests are normally used for ping-style connectivity checks, not for transferring business data. The presence of millions of ICMP packets with payload data, combined with the fact that proprietary information is already appearing on the dark web, strongly indicates data exfiltration over an alternative protocol, often described as ICMP tunneling or protocol misuse.

The official CompTIA CySA+ CS0-003 objectives place this directly under Security Operations, specifically analyzing indicators of potentially malicious activity and using packet capture tools. The objectives explicitly include data exfiltration, unexpected outbound communication, packet capture, Wireshark, and tcpdump as relevant skills and tools for determining malicious activity.

Supporting extract from the CySA+ Study Guide: ICMP echo requests are produced by ping, and “Ping communications take place using the Internet Control Message Protocol (ICMP).” This confirms that the observed Type 8 echo request traffic is ICMP ping-style traffic, not a normal file-transfer or application protocol.

Supporting extract from the Secbay CySA+ guide: “Data Exfiltration: Unauthorized transfer of sensitive data from a system, potentially indicating a data breach or insider threat activity.” The same section also states that “Unexpected Outbound Communication” can indicate communication with malicious or unauthorized entities.

Why the other options are incorrect:

A is not the best answer because the evidence does not prove an insider or a command-and-control channel. The packet capture shows ICMP echo requests with data payloads, which points more directly to exfiltration.

C is incorrect because there is no evidence of malware propagation, scans, sweeps, or attempts to infect other systems.

D is incorrect because an ICMP DDoS would normally involve traffic intended to overwhelm a target. Here, the key indicator is data being carried inside ICMP echo request packets, and the business context is stolen proprietary information on the dark web.

Therefore, the most likely malicious activity is exfiltration over an alternative protocol.

Adding the SHA-256 hash of a legitimate Microsoft-signed binary like svchost.exe to detection signatures would result in the indicator firing on the majority of Windows devices. Svchost.exe is a common and legitimate system process used by Windows, and using its hash as an indicator ofcompromise (IOC) would generate numerous false positives, as it would match the legitimate instances of svchost.exe running on all Windows systems.

Passive scanning is a method of vulnerability identification that does not send any packets or probes to the target devices, but rather observes and analyzes the network traffic passively. Passive scanning can minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process, as it does not interfere with the normal operation of the devices or cause any network disruption. Passive scanning can also detect vulnerabilities that active scanning may miss, such as misconfigured devices, rogue devices or unauthorized traffic. Official References:

https://partners.comptia.org/docs/default-source/resources/comptia-cysa-cs0-002-exam-objectives

https://www.comptia.org/blog/the-new-comptia-cybersecurity-analyst-your-questions-answered

https://www.comptia.org/certifications/cybersecurity-analyst

Mean time to contain is the metric that the cybersecurity team lead should include in the weekly executive briefs, as it measures how long it takes to stop the spread of malware that enters the network. Mean time to contain is the average time it takes to isolate and neutralize an incident or a threat, such as malware, from the time it is detected. Mean time to contain is an important metric for evaluating the effectiveness and efficiency of the incident response process, as well as the potential impact and damage of the incident or threat. A lower mean time to contain indicates a faster and more successful response, which can reduce the risk and cost of the incident or threat. Mean time to contain can also be compared with other metrics, such as mean time to detect or mean time to remediate, to identify gaps or areas for improvement in the incident response process. 

Webhooksenable automatic and event-driven interactions between applications. In the context of code repositories and vulnerability scanning, webhooksautomate the scanning processevery time new code is committed. Thisensures continuous security coveragewithout relying on manual triggers, thereby embedding security checks into the development lifecycle efficiently. This automation leads to improved coverage and faster identification of vulnerabilities at the earliest stage possible in the DevSecOps pipeline.

This is because scanning without admin privileges can limit the scope and accuracy of the vulnerability scan, and potentially miss some critical vulnerabilities that require higher privileges to detect. According to the OWASP Vulnerability Management Guide1, “scanning without administrative privileges will result in a large number of false negatives and an incomplete scan”. Therefore, the analyst should recommend addressing this issue to ensure potential vulnerabilities are identified.