Data exfiltration is the theft or unauthorized transfer or movement of data from a device or network. It can occur as part of an automated attack or manually, on-site or through an internet connection, and involve various methods. It can affect personal or corporate data, such as sensitive or confidential information. Data exfiltration can be prevented or detected by using compression, encryption, authentication, authorization, and other controls1

The network activity shows that a device on the network is sending an outbound email via a mail client to a non-company email address daily at 10:00 p.m. This could indicate that the device is compromised by malware or an insider threat, and that the email is used to exfiltrate data from the network to an external party. The email could contain attachments, links, or hidden data that contain the stolen information. The timing of the email could be designed to avoid detection by normal network monitoring or security systems.

The correct answer is D. In forensic analysis, the analyst should not repair, rebuild, or modify the original device or evidence. Forensic workflows rely on validated, forensically sound images and working copies. If the analysis copy becomes corrupted, the correct approach is to return to a preserved/archived copy or original validated image and continue from a clean copy.

The Sybex CySA+ Study Guide explains that drive and media images must be captured in a forensically sound manner, validated with hashing, and copied so that the original evidence is retained. It also states that multiple copies are made so the original drive can be retained for evidence. The official CySA+ objectives also include evidence acquisition, validating data integrity, preservation, and chain of custody under incident response activities.

Why the other options are incorrect:

A is incorrect because trying to remediate corruption may further alter evidence.

B is incorrect because bootable media may alter the device or evidence state.

C is incorrect because rebuilding the OS destroys or changes forensic evidence.

D is correct because restoring from a preserved copy maintains forensic integrity.

===========

Reconnaissance is the first stage in the Cyber Kill Chain and involves researching potential targets before carrying out any penetration testing. The reconnaissance stage may include identifying potential targets, finding their vulnerabilities, discovering which third parties are connected to them (and what data they can access), and exploring existing entry points as well as finding new ones. Reconnaissance can take place both online and offline. In this case, an analyst finds that an IP address outside of the company network is being used to run network and vulnerability scans across external-facing assets. This indicates that the analyst is witnessing reconnaissance activity by an attacker. Official References: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

The captured traffic shows TCP packets with the Flags [FPU], which indicate that the FIN, PSH, and URG flags are set. This is characteristic of an Nmap Xmas scan . The Xmas scan is a type of port scan that sends packets with these flags set to determine port states based on responses from the target system. This technique is often used in stealth scanning to evade detection by firewalls or IDS/IPS​.

Nikto ' s web scan (B) is used for identifying web server vulnerabilities but does not generate TCP packets with such unusual flags​.

Socat ' s proxying (C) would not exhibit the specific Xmas scan pattern.

Angry IP Scanner (D) is a general-purpose scanner that does not use the TCP flags seen in this capture​.

Thepost-incident review processhelps an organization identify gaps in its response and security posture. Assigning different departmental groups ensures that flaws inspecific work areas (such as IT, HR, or legal teams)are identified and addressed​.

Option Bis incorrect because not all staff need exposure; the review focuses on relevant stakeholders.

Option Cis a part of the process, but the main goal is improvement, not just playbook verification.

Option D(cross-training) is a benefit but not the main objective.

Thus,A is the best answerbecause it focuses on identifyingflaws in specific areas of incident management.

Quarantining the server is the best action to perform immediately, as it isolates the affected server from the rest of the network and prevents the ransomware from spreading to other systems or data. Quarantining the server also preserves the evidence of the ransomware attack, which can be useful for forensic analysis and law enforcement investigation. The other actions are not as urgent as quarantining the server, as they may not stop the ransomware infection, or they may destroy valuable evidence. Shutting down the server may not remove the ransomware, and it may trigger a data deletion mechanism by the ransomware. Reimaging the server may restore its functionality, but it will also erase any traces of the ransomware and make recovery of encrypted data impossible. Updating the OS to the latest version may fix some vulnerabilities, but it will not remove the ransomware or decrypt the data. Official References:

https://www.cisa.gov/stopransomware/ransomware-guide

https://www.cisa.gov/sites/default/files/publications/Ransomware_Executive_One-Pager_and_Technical_Document-FINAL.pdf

https://www.cisa.gov/stopransomware/ive-been-hit-ransomware

The first step should be to perform a public search for malware reports on taskhw.exe, as this file is suspicious for several reasons: it is located in a non-standard path, it has a high CPU usage, it is signed by an unknown entity, and it is only present on one host. A public search can help to determine if this file is a known malware or a legitimate program. If it is malware, the hunter can then take appropriate actions to remove it and prevent further damage. The other options are either premature or ineffective, as they do not provide enough information to assess the threat level of taskhw.exe. References: Cybersecurity Analyst+ - CompTIA, taskhw.exe Windows process - What is it? - file.net, Taskhostw.exe - What Is Taskhostw.exe & Is It Malware? - MalwareTips Forums

Dictionary attacks involve an attacker attempting to guess passwords by using a list of common passwords. Implementing a lockout policy is effective because it limits the number of login attempts, thereby hindering the attacker ' s ability to repeatedly attempt different passwords. Lockout policies are standard in cybersecurity practices to prevent brute-force and dictionary attacks by temporarilydisabling an account after a certain number of failed login attempts. According to CompTIA Security+ standards, password complexity (option B) and multifactor authentication (option A) are helpful but are not as immediately effective in directly preventing repeated attempts as a lockout policy.

SLA stands for service level agreement, which is a contract or document that defines the expectations and obligations between a service provider and a customer regarding the quality, availability, performance, or scope of a service. An SLA may also specify the metrics, penalties, or remedies for measuring or ensuring compliance with the agreed service levels. An SLA can help the SOC manager review if the team is meeting the appropriate contractual obligations for the customer, such as response time, resolution time, reporting frequency, or communication channels.