CompTIA CS0-004 Dumps

The ZAP finding concerns information disclosure through the HTTP Server response header , so the correct remediation is to suppress or minimize that header while leaving the website operational. OWASP ZAP maintains specific alerts for servers that disclose the web-server application or version through this response field. The version-disclosure rule is categorized as information exposure because detailed server identification can assist reconnaissance and vulnerability targeting.

Removing unnecessary product and version information reduces information available to an attacker without interrupting legitimate HTTP requests. This directly satisfies the requirement to remediate the finding while maintaining service availability.

Geo-blocking does not correct server-version disclosure and may unnecessarily deny legitimate users based on location. OCSP stapling relates to certificate-revocation status in TLS and is irrelevant to an HTTP server-header disclosure. Blocking incoming HTTP entirely would make the current endpoint unavailable, contradicting the requirement to keep the site operational.

The remediation principle is therefore minimize externally exposed implementation details while preserving application functionality . Server banners are not themselves an exploit, but they can improve an attacker's ability to fingerprint technology and select applicable exploits.

Study Guide Reference: Vulnerability Management → Web Application Scanning → OWASP ZAP → Information Disclosure → HTTP Server Headers → Banner Suppression → Secure Configuration.

Chain of custody is the formal process used to document the collection, possession, transfer, handling, analysis, and disposition of evidentiary artifacts. Its purpose is to establish an auditable history demonstrating who controlled the evidence, when custody changed, why it was transferred, and what actions were performed on it.

NIST defines chain of custody as tracking evidence throughout its collection, safeguarding, and analysis lifecycle while documenting each individual who handled it, relevant timestamps, and the purpose of transfers. This is critical when multiple systems, analysts, forensic teams, or external parties participate in an investigation because undocumented handling could undermine confidence in the evidence's integrity or admissibility.

Packaging and labeling are important evidence-preservation procedures, but they represent only individual activities within the broader evidence-management process. Storage and containment protect artifacts from alteration or unauthorized access but do not provide the complete historical record of possession. Post-incident reporting documents investigation conclusions and response actions after the incident rather than tracking evidence throughout its lifecycle.

The decisive phrase is “properly recorded.” A defensible record of every evidence transfer and handler is specifically the function of chain of custody.

Study Guide Reference: Incident Response and Management → Digital Forensics → Evidence Acquisition → Chain of Custody → Evidence Integrity → Documentation and Preservation.

PRODWEB-01 represents the highest remediation priority because vulnerability prioritization should combine asset value, vulnerability risk, and exploitation likelihood , rather than relying on severity alone. A production web server is typically more exposed and operationally significant than a development endpoint, and the correlated CMDB information provides the business context required to determine whether exploitation would materially affect organizational operations.

A mature vulnerability-management process evaluates technical severity together with internet exposure, business criticality, existing controls, active exploitation, threat intelligence, and the availability of remediation. CISA specifically recommends using known exploitation evidence as an input into vulnerability prioritization and provides risk-based methodologies such as SSVC for determining appropriate response actions.

This explains why simply choosing the system with the numerically highest isolated vulnerability score would be inadequate. DEVWIN11-01, for example, may contain significant findings but carries lower production value. A control-system asset may have high business importance but can present different exposure and exploitability conditions. The correlated attributes associated with PRODWEB-01 establish the strongest combined risk.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization → Asset Criticality → Exploitability → Threat Intelligence → CMDB Context → Risk-Based Remediation.

Triage occurs during the analysis phase because responders must determine what an alert represents, how serious it is, which assets are affected, and what response priority should be assigned before taking broader containment or recovery actions.

Triage typically involves validating the alert, gathering supporting telemetry, establishing whether the event is a true positive, determining scope and impact, identifying affected identities or systems, correlating indicators, and assigning severity. The outcome provides the evidence required to decide whether an event should be escalated into formal incident handling and what subsequent actions are justified. NIST incident-handling guidance has historically emphasized analyzing incident-related information in order to determine the appropriate response, while the current NIST framework continues to emphasize efficient incident detection, response, and recovery.

Isolation belongs to containment because it restricts the compromised asset's ability to communicate or spread malicious activity. Reimaging normally occurs during recovery after the environment has been contained and malicious persistence addressed. Alert writing is part of detection engineering or security-monitoring operations rather than a defining incident-analysis activity.

The sequence is therefore important: detect → analyze/triage → contain → eradicate → recover → conduct post-incident activities .

Study Guide Reference: Incident Response and Management → Incident Response Process → Detection → Analysis/Triage → Containment → Eradication → Recovery.

The analyst must construct an accurate incident timeline . Patient zero is the earliest compromised system from which subsequent malicious activity originated or propagated. Determining it requires ordering events chronologically across all affected hosts and correlating authentication activity, process execution, network connections, malware creation times, lateral movement, and other evidence.

Raw logs alone do not communicate this sequence effectively. Logs from different systems must first use reliable timestamps and then be normalized and correlated. Once events are ordered, the analyst can work backward from known compromises to determine which host displayed the earliest credible signs of intrusion and whether subsequent systems were reached from that host.

Enabling additional monitoring helps detect future activity but does not reconstruct historical sequence by itself. Isolation is necessary during containment but does not establish which system was initially compromised. Shift-handoff improvements are useful organizationally but do not answer the forensic question. Malware composition analysis may identify relationships between samples, but it does not establish system-level chronology.

NIST's incident-response guidance emphasizes analysis, documentation, root-cause understanding, and after-action reporting as inputs to continuous improvement.

Study Guide Reference: Incident Response and Management → Timeline Analysis → Event Correlation → Patient Zero → Root Cause Analysis → After-Action Review.

Attack methodology frameworks help defenders analyze security from an adversary-centric perspective . Rather than focusing exclusively on individual vulnerabilities, these frameworks organize how attackers pursue objectives, which behaviors they use, and how their activity progresses or relates across an intrusion.

MITRE ATT & CK is a representative example. MITRE describes ATT & CK as a knowledge base based on real-world adversarial behavior and states that tactics represent why an adversary performs an action, while techniques represent how the adversary achieves that objective. By understanding these behaviors, defenders can design detections, controls, threat hunts, and response procedures that address realistic attacker methods rather than isolated theoretical weaknesses.

Option A describes continuous vulnerability remediation or rapid operational deployment. Option B describes risk-based vulnerability prioritization using probability and consequence. Option D describes Zero Trust architecture, which assumes that access should not be trusted solely because of network location or prior authentication.

The central purpose of an attack methodology framework is therefore to model and understand adversary behavior so defensive controls can be aligned against realistic attack techniques and objectives .

Study Guide Reference: Security Operations → Attack Methodology Frameworks → MITRE ATT & CK → Adversary Behavior → Tactics → Techniques → Procedures → Defensive Mapping.

A paid, subscription-based threat intelligence service is best classified as closed-source intelligence because access is restricted to authorized subscribers rather than being freely available to the public. Commercial threat-intelligence providers typically collect, analyze, correlate, and curate indicators and adversary information before distributing that intelligence through authenticated portals, APIs, or feeds.

NIST identifies several external intelligence-source categories, including open-source repositories, commercial threat feeds, and external information-sharing partners . A commercial feed relevant to a company's specific industry may provide higher-context intelligence regarding threat actors, infrastructure, malware, vulnerabilities, campaigns, and indicators affecting that vertical.

OSINT, by contrast, originates from publicly accessible sources and normally does not require restricted subscription access. Threat mapping is the activity of associating adversary behavior or intelligence with infrastructure, campaigns, frameworks, or organizational assets. Threat modeling is a structured process used to identify potential threats and weaknesses in systems or applications; it is not an intelligence-source classification.

The examination clue is “paid subscription.” Restricted commercial access distinguishes the feed from publicly obtainable OSINT.

Study Guide Reference: Security Operations → Threat Intelligence → Intelligence Sources → Open-Source Intelligence → Closed/Commercial Intelligence → Industry-Specific Threat Feeds.

/var/log/auth.log is the appropriate source because it records authentication and authorization activity on Debian/Ubuntu-style Linux systems, including password-related events, SSH logins, PAM authentication, and other authorization events. Canonical's Ubuntu documentation specifically identifies /var/log/auth.log as the authorization log used for password prompts, sudo, and remote logins.

The command performs three operations. cat /var/log/auth.log sends the log contents to standard output. The pipe forwards that data to grep "User1", which selects records containing the required username. Finally, > linux-events.txt redirects the resulting matching records into the requested flat-file report. Because auth.log can contain both accepted and rejected authentication activity, the command can capture successful and unsuccessful events associated with User1.

sssd is not the general authentication log path shown in the scenario and may contain only SSSD-specific events. A faillog-oriented source emphasizes failed logins and therefore does not satisfy the requirement to collect both successful and failed activity. /var/log/syslog contains broad system messages but is less precise than the dedicated authentication log.

Study Guide Reference: Security Operations → Linux Log Analysis → /var/log/auth.log → cat → grep → Output Redirection → Authentication Investigation.

A zero-day vulnerability presents a special remediation problem because the affected organization may have confirmed exposure while no vendor patch is available. Until permanent remediation becomes possible, the organization should increase continuous monitoring for evidence that the vulnerability is being targeted or exploited. Threat-intelligence IoCs can be incorporated into SIEM, EDR, IDS/IPS, network monitoring, and threat-hunting workflows to identify suspicious connections, processes, authentication events, or other behaviors associated with the threat actor.

Continuous monitoring does not eliminate the vulnerability, but it strengthens detection capability during the exposure window and supports rapid containment if exploitation occurs. This approach should ordinarily be combined with available compensating controls such as segmentation, access restrictions, service disabling, configuration changes, or other vendor-recommended workarounds.

Sinkholing is primarily used to redirect malicious network traffic, particularly command-and-control or malicious-domain traffic, and is not a general solution for an unpatched zero-day. Eradication occurs after malicious artifacts or persistence mechanisms have been identified during incident response. Evidence acquisition is a forensic activity and does not reduce the immediate exploitation risk.

CS0-004 requires analysts to consider active exploitation/threat intelligence, patch/remediation availability, context, and compensating controls when prioritizing and mitigating vulnerabilities.

Study Guide Reference: Vulnerability Management → Prioritization → Active Exploitation → Patch Availability → Compensating Controls and Continuous Monitoring.

The analyst completed substantial analysis by validating the URL, confirming its credential-harvesting purpose, and establishing that the user accessed the malicious site. However, the investigation was closed without performing adequate containment . Even though there is no evidence that stolen credentials were subsequently used, the user's authentication material must be considered potentially exposed because the phishing site was specifically designed to collect credentials.

Containment should reduce the immediate opportunity for an attacker to exploit that exposure. Appropriate measures can include resetting the affected password, revoking active authentication sessions or tokens, temporarily restricting the account when warranted, blocking the malicious URL or domain, and checking the endpoint for additional malicious activity. The absence of observed credential misuse does not establish that credential capture did not occur.

Remedial training is valuable, but it is principally a corrective or post-incident measure and does not neutralize the immediate technical risk. Recovery would follow containment and eradication when affected services or systems require restoration.

NIST's current incident-response guidance emphasizes effective detection, response, and recovery actions to reduce incident impact rather than stopping after validation.

Study Guide Reference: Incident Response and Management → Incident Response Process → Analysis → Containment → Eradication → Recovery → Post-Incident Activities.

Operational technology environments frequently contain specialized controllers, industrial control systems, supervisory control and data acquisition equipment, embedded operating systems, and vendor-specific devices that were designed primarily for availability, safety, deterministic operation, and long service life. Traditional enterprise security controls—such as endpoint detection agents, vulnerability scanners, host-based firewalls, aggressive patching mechanisms, or modern authentication software—may not be supported and can potentially interfere with operational processes.

For this reason, organizations often implement compensating controls around OT assets when the preferred security control cannot be deployed directly. Examples include network segmentation, tightly controlled firewall rules, protocol allowlisting, passive monitoring, secure jump servers, access restrictions, enhanced logging, and additional physical controls. These measures reduce risk without requiring unsupported software to be installed on sensitive industrial devices.

High network bandwidth consumption is not the defining reason for compensating controls. Scheduled outage windows can actually facilitate maintenance rather than explain why alternative controls are required. Likewise, lack of encryption may be a weakness in some environments, but it does not explain the broader compatibility problem.

CS0-004 specifically places OT, ICS, and SCADA under critical-infrastructure concepts in Security Operations and separately recognizes compensating controls as a formal vulnerability mitigation strategy.

Study Guide Reference: Security Operations → Critical Infrastructure → OT/ICS/SCADA → Security Architecture → Compatibility Constraints and Compensating Controls.

The attacker is attempting lateral movement because an already compromised identity is being used to move from one cloud environment or subscription into another. Lateral movement describes adversary activity intended to reach additional systems, services, accounts, or resources after an initial foothold has been established.

MITRE ATT & CK specifically includes cloud-oriented lateral movement. Its Lateral Movement tactic documents adversaries using valid accounts to access additional cloud services and resources within compromised environments. MITRE also documents cloud-role manipulation that may enable movement into additional accounts, demonstrating how identity and role relationships can become lateral-movement pathways in cloud architectures.

Privilege escalation would apply if the attacker were primarily attempting to obtain greater permissions within the current security context. Persistence concerns maintaining long-term access. Execution concerns running malicious code or commands. Credential access involves obtaining credentials or authentication material.

In this scenario, the attacker already possesses a compromised user role. The objective is to use that existing access to traverse a trust boundary and reach another isolated subscription. That movement between security domains is the decisive indicator of the Lateral Movement tactic.

Study Guide Reference: Security Operations → MITRE ATT & CK → Lateral Movement → Cloud Services → Valid Accounts → IAM Roles → Cross-Subscription Access.

Compensating controls are appropriate when the preferred remediation cannot currently be implemented but the organization must still reduce exposure. A mission-critical system with an unpatched vulnerability for which no vendor patch exists is a classic example. The system cannot simply be removed from service because the business requires it, and conventional patching is unavailable.

The organization may therefore deploy alternative controls such as network segmentation, restrictive firewall rules, application allowlisting, disabling unnecessary services, enhanced monitoring, IPS signatures, access restrictions, or isolation of affected functionality. These measures do not eliminate the underlying defect; instead, they reduce the probability or impact of exploitation while a permanent solution is developed.

NIST's control framework is designed to allow security controls to be selected and tailored according to organizational mission requirements and risk, supporting the broader principle that organizations may apply appropriate alternative safeguards when operational constraints exist.

Option B requires no compensating control because remediation has already occurred. Option C describes a vulnerability that is not applicable to the organization's systems. Option D represents a false positive and therefore does not constitute an actual exposure requiring mitigation.

Study Guide Reference: Vulnerability Management → Mitigation → Compensating Controls → Patch Availability → Mission-Critical Systems → Segmentation and Monitoring.

Mean time to close is the most relevant measurement because the manager needs to quantify how long cases or incidents remain open before all required closure activities—including after-action documentation—are completed.

An incident may already be technically contained and remediated while administrative closure remains outstanding. Mean time to remediate measures how long it takes to correct or neutralize the security problem, but it does not necessarily include final reporting and formal case closure. Mean time to respond measures how quickly responders begin or perform response activity after detection. Mean time between failures is primarily a reliability metric describing the average operating duration between failures and does not measure SOC reporting performance.

Current Microsoft Sentinel SOC guidance explicitly includes mean time to closure and time-to-closure percentiles among incident-management metrics used to evaluate SOC performance. This directly maps to the manager's concern: if after-action reports delay completion of incidents, the organization's mean closure time will increase and can be trended by analyst, severity, team, or incident category.

Therefore, B provides the quantitative evidence needed to determine whether after-action reporting is preventing incidents from being closed promptly.

Study Guide Reference: Reporting and Communication → Incident Metrics → Mean Time to Close → After-Action Reporting → SOC Performance Measurement → Continuous Improvement.

Zero Trust is based on the principle that access should not be implicitly trusted merely because a user, workload, or device has already entered the enterprise environment. Access decisions are continuously evaluated using identity, authentication state, device posture, authorization, contextual information, and resource sensitivity. The scenario's emphasis on continuously validating and verifying access therefore directly describes Zero Trust.

Traditional perimeter-oriented models tend to treat internal network position as a degree of trust. Zero Trust removes that assumption and requires explicit verification before granting access to protected resources. It also supports least privilege, granular authorization, segmentation, and ongoing assessment of sessions or identities.

Secure access service edge combines networking and security capabilities delivered through a distributed service architecture and can support Zero Trust implementations, but SASE itself is not the fundamental principle described. A next-generation firewall provides application-aware traffic inspection and policy enforcement but does not by itself establish continuous identity-centric verification. Privileged access management specifically controls elevated or administrative accounts; it is an important component of access security but addresses a narrower scope than Zero Trust.

The CS0-004 objectives explicitly identify Zero Trust Network Architecture , SASE, hybrid cloud, IAM, PAM, authentication, and authorization as Security Operations architecture concepts.

Study Guide Reference: Security Operations → Network Architecture → Zero Trust Network Architecture → IAM → Authentication and Authorization → Least Privilege.

YARA is specifically designed to identify and classify suspicious or malicious files through pattern-based rules . A YARA rule can contain textual strings, hexadecimal byte sequences, regular expressions, metadata, file characteristics, and Boolean conditions. This makes YARA particularly effective when an analyst already has a binary specimen on an isolated analysis system and needs to determine whether it contains patterns associated with malware.

The official YARA documentation describes YARA as a tool for helping malware researchers identify and classify malware samples using textual and binary patterns. Rules consist primarily of strings and logical conditions that determine whether a file matches the defined characteristics.

The strings utility can reveal printable characters embedded within a binary and is useful during preliminary static analysis, but it does not itself classify the file against structured malware-detection signatures. VirusTotal can perform multi-engine analysis, but submitting a potentially sensitive binary from an isolated environment to an external service may be inappropriate and is unnecessary when local YARA detection is available. WHOIS provides registration information about internet resources and has no direct binary-malware detection capability.

Study Guide Reference: Security Operations → Malware Analysis → Static Analysis → YARA → Signature and Pattern Matching → Binary/File Analysis.

AI usage policies establish organizational boundaries for how artificial intelligence systems may be selected, accessed, configured, and used. They allow an organization to obtain operational benefits from AI while controlling risks involving confidential information, intellectual property, regulated data, model outputs, external AI services, and inappropriate automation. A strong policy can define approved platforms, prohibited data categories, validation requirements, human oversight, retention rules, acceptable use, and escalation procedures.

Prompt engineering is a technical method for constructing inputs that produce more useful model responses. It can improve output quality but does not establish enterprise-wide safeguards for protecting business objectives or sensitive information. A non-disclosure agreement establishes contractual confidentiality obligations between parties; it cannot govern the full technical and operational use of AI systems. An incident response policy determines how security incidents are managed and escalated, but it is reactive and not designed to establish routine AI governance.

CS0-004 explicitly addresses AI within Security Operations. The objectives identify AI risks including hallucinations, data exposure, model poisoning, and malicious prompts and identify governance considerations including legal or regulatory compliance and AI usage policies . AI use cases include log analysis, artifact comparison, incident investigation, event correlation, and automation.

Study Guide Reference: Security Operations → AI in Security Operations → AI Risks → Governance → AI Usage Policies → Data Protection.

Option C represents the appropriate YARA matching approach because the analyst is searching for an encoded representation of ActiveMime , not necessarily the literal plaintext string. The grep -rail ActiveMime * command performs a case-insensitive recursive search for the textual value ActiveMime. If the payload contains that value encoded—commonly through Base64 or another transformed representation—the literal byte sequence will not be present and grep will therefore fail to identify it.

YARA is designed specifically for pattern-based identification of malicious or suspicious content. Its string modifiers support encoded representations. YARA's official documentation states that the base64 modifier searches for Base64-encoded forms of a specified string, while base64wide extends this behavior to wide-character representations. Therefore, a rule constructed to detect the encoded form of ActiveMime can identify relevant documents without requiring the literal plaintext sequence to occur in the file.

The essential examination concept is the distinction between literal text searching and malware-oriented encoded-pattern matching . Rules that search only for ordinary ASCII ActiveMime reproduce the limitation of the unsuccessful grep command.

Study Guide Reference: Security Operations → Malware Analysis → YARA → Signature/Pattern Matching → Encoded Content → Base64/Base64wide → File Analysis.

The observed activity corresponds to privilege escalation , meaning the attacker attempted to move from a lower level of authorization to a more powerful security context. Privilege escalation becomes important after initial compromise because an account or process obtained during initial access frequently lacks the permissions required to disable controls, access sensitive resources, modify protected system settings, dump credentials, or establish deeper persistence.

MITRE ATT & CK defines the Privilege Escalation tactic as adversary activity intended to obtain higher-level permissions on a system or network. Techniques can include exploiting vulnerabilities, manipulating access tokens, modifying accounts or group memberships, abusing misconfigurations, or executing processes under more privileged identities.

Exfiltration specifically concerns removing information from the compromised environment. Remote code execution describes obtaining the ability to execute attacker-controlled commands or code remotely; while RCE can sometimes lead to privilege escalation, they represent different objectives. Spoofing involves impersonating or falsifying an identity, address, or other trusted characteristic.

The critical analytical distinction is therefore the attacker's objective demonstrated by the logs : attempting to obtain elevated access indicates privilege escalation rather than merely establishing execution or transferring data.

Study Guide Reference: Security Operations → Malicious Activity Analysis → MITRE ATT & CK → Privilege Escalation → Account/Permission Changes → System Log Interpretation.

MITRE ATT & CK Navigator is primarily a visualization and analytical tool for understanding adversary behavior and evaluating defensive coverage against ATT & CK tactics and techniques. Analysts can create layers over ATT & CK matrices, highlight techniques associated with specific threat groups, compare adversary profiles, record detection coverage, and identify techniques for which defensive visibility or controls are insufficient.

MITRE explicitly states that ATT & CK Navigator can be used to visualize defensive coverage, support red-team and blue-team planning, and represent the frequency of detected techniques. MITRE's ATT & CK design guidance also recognizes defensive gap assessment as a means of identifying areas where an enterprise lacks sufficient defenses or visibility.

Navigator itself does not replicate adversary behavior; adversary-emulation platforms and red-team tools perform that function. It is not a malware reverse-engineering platform, nor does it independently build defensive tools or execute incident-response actions.

Its major operational value is translating ATT & CK's behavioral knowledge base into a visual map that lets defenders answer two questions: What behaviors are relevant to the threats we face, and where do our detections or controls have gaps?

Study Guide Reference: Security Operations → MITRE ATT & CK → ATT & CK Navigator → Tactics and Techniques → Threat Mapping → Detection Coverage → Gap Analysis.

The analyst should first establish a legal hold because the suspected breach involves personnel records and evidence that may become relevant to regulatory, disciplinary, civil, or other legal proceedings. A legal hold prevents potentially relevant information from being deleted, overwritten, modified, rotated out under normal retention schedules, or otherwise destroyed before the organization's legal and investigative obligations are understood.

Preservation must precede destructive or potentially evidence-altering actions. NIST describes digital forensics as retrieving, storing, and analyzing electronic information while ensuring that evidence is captured reliably without alteration. RFC 3227 similarly emphasizes preserving evidence, following proper collection procedures, documenting handling, and maintaining chain of custody.

Log correlation and timeline construction are important investigative activities, but they should occur after preservation requirements have been established. Resetting credentials may subsequently be required for containment, but the scenario first raises an evidence-preservation obligation. Restoring files from backup would be especially premature because it could alter timestamps, overwrite artifacts, or otherwise complicate forensic analysis.

The examination principle is therefore preserve first when legal implications are reasonably foreseeable; analyze and remediate afterward under controlled procedures .

Study Guide Reference: Incident Response and Management → Evidence Acquisition → Legal Hold → Evidence Preservation → Chain of Custody → Timeline Analysis → Regulatory/Legal Considerations.

Legacy systems present a significant security problem because they frequently cannot support current operating systems, security agents, encryption mechanisms, authentication controls, or vendor patches. When a business-critical legacy system cannot be remediated normally, strong network segmentation becomes an important compensating control. The objective is to reduce the system's reachable attack surface and restrict which users, hosts, protocols, and applications can communicate with it.

A segmented legacy asset might be placed in a dedicated VLAN or security zone and protected through restrictive firewall access-control rules, jump hosts, allowlisting, enhanced logging, and continuous monitoring. Even though segmentation does not remove the underlying vulnerability, it decreases exposure and makes exploitation or lateral movement considerably more difficult.

Degraded functionality is generally an effect or remediation constraint rather than the strongest reason for isolation. Asset obfuscation does not provide reliable security because hidden systems can still be discovered through enumeration or traffic analysis. A proprietary server is not automatically vulnerable merely because its implementation is proprietary; it may still support modern patches and security controls.

CS0-004 specifically covers segmentation as a vulnerability-scanning consideration, compensating controls as a mitigation strategy, and legacy systems as an important inhibitor to remediation.

Study Guide Reference: Vulnerability Management → Vulnerability Prioritization and Mitigation → Compensating Controls → Segmentation → Legacy-System Constraints.

Rebuilding the environment from infrastructure-as-code definitions is a recovery activity because the organization is restoring trusted operational capability after the ransomware incident has been controlled. IaC provides a particularly effective recovery mechanism because infrastructure can be reconstructed according to predefined, version-controlled configurations instead of attempting to repair every potentially compromised component manually.

During detection and analysis, responders establish that malicious activity occurred and determine its scope. Containment limits additional damage or spread. Eradication removes malicious artifacts, persistence, compromised credentials, and the underlying causes of the incident. Recovery then restores affected systems and services to normal operation while ensuring they are returned in a trustworthy state.

NIST defines recovery as the restoration of assets and operations affected by cybersecurity incidents and emphasizes verifying restored assets before normal operations resume. Tearing down potentially compromised infrastructure and deploying fresh resources from controlled IaC templates directly fulfills that purpose.

Post-incident activities occur after operational restoration and focus on lessons learned, reporting, process improvement, and corrective recommendations.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Recovery → Infrastructure as Code → Rebuilding from Known-Good Configurations → Validation.

A service-level agreement (SLA) formally establishes measurable service expectations between a provider and a customer. These expectations commonly include availability targets, response times, resolution times, service quality thresholds, escalation conditions, reporting requirements, and other measurable performance indicators. NIST describes an SLA as a document that specifies technical performance promises and how performance or disputes will be handled. NIST security-control guidance also notes that service-level agreements can define performance expectations and measurable outcomes.

That makes an SLA the appropriate document when management needs to determine whether contractual performance requirements were violated. KPIs contained in the agreement provide objective measures against which actual service performance can be compared.

TTPs describe adversary behavior and have no contractual purpose. A return-on-investment report evaluates financial effectiveness rather than service obligations. A risk management plan describes how organizational risks will be identified and treated. A memorandum of understanding records cooperation or intent between parties, but it typically does not provide the detailed operational performance guarantees associated with an SLA.

The clues are customer, signed agreement, contractual breach, and measurable KPIs —all of which strongly identify a service-level agreement.

Study Guide Reference: Reporting and Communication → Service-Level Agreements → KPIs → Contractual Requirements → Performance Metrics → Compliance and Escalation.