MITRE ATT & CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. It can help security professionals understand, detect, and mitigate cyber threats by providing a comprehensive framework of TTPs.

An incident response plan (IRP) is a document that defines the roles and responsibilities, procedures, and guidelines for responding to a security incident. It helps the security team to act quickly and effectively, minimizing the impact and cost of the incident. An IRP should specify who should conduct the next steps following a security event, such as containment, eradication, recovery, and analysis12. References: CompTIA CySA+ CS0-003 Certification Study Guide, page 362; 6 Incident Response Steps to Take After a Security Event, section 2.

Application security scanning is a process that involves testing and analyzing applications for security vulnerabilities, such as injection flaws, broken authentication, cross-site scripting, and insecure configuration. Application security scanning can help identify and fix security issues before they become exploitable by attackers. Using application security scanning as part of the pipeline for the continuous integration/continuous delivery (CI/CD) flow can help mitigate the problem of finding the same vulnerabilities in a critical application during security scanning. This is because application security scanning can be integrated into the development lifecycle and performed automatically and frequently as part of the CI/CD process.

The correct answer is D because MITRE ATT & CK maps adversary tactics, techniques, and procedures to stages or tactical goals of an attack. When the incident response team can align observed activity to a specific ATT & CK stage, the team can better understand the attacker’s intent, determine what has likely already happened, and anticipate what the attacker may try next.

The CySA+ All-in-One guide explains that attack frameworks break a cyberattack “from initial reconnaissance to final exfiltration of data” into steps or phases. It also states that studying attacker TTPs helps analysts “better anticipate and prepare for potential attacks” and develop stronger incident response plans.

The guide further explains that MITRE ATT & CK provides a structured methodology for modeling and understanding attacker TTPs, with tactics representing high-level goals and techniques representing the methods attackers use to achieve those goals.

It also states that in incident response, analysts can map observed attacker behavior to the appropriate ATT & CK technique to better understand the attacker’s goals and motivations, identify other potentially compromised areas, and prioritize remediation.

Why the other options are incorrect:

A is partially true, but it focuses more on communicating indicators to monitoring teams, not on why stage alignment helps incident responders.

B is too narrow because it focuses on SIEM alert creation rather than incident response decision-making.

C is partially true because visualization can improve speed, but the best reason is not simply that a visual map is faster than a white paper.

D is correct because stage alignment helps the IR team understand attacker intent and anticipate the next likely action.

The correct answer is A. To provide metrics and test continuity controls.

A disaster recovery exercise is a simulation or a test of the disaster recovery plan, which is a set of procedures and resources that are used to restore the normal operations of an organization after a disaster or a major incident. The goal of a disaster recovery exercise is to provide metrics and test continuity controls, which are the measures that ensure the availability and resilience of the critical systems and processes of an organization. A disaster recovery exercise can help evaluate the effectiveness, efficiency, and readiness of the disaster recovery plan, as well as identify and address any gaps or issues .

The other options are not the best descriptions of the goal of a disaster recovery exercise. Verifying the roles of the incident response team (B) is a goal of an incident response exercise, which is a simulation or a test of the incident response plan, which is a set of procedures and roles that are used to detect, contain, analyze, and remediate an incident. Providing recommendations for handling vulnerabilities © is a goal of a vulnerability assessment, which is a process of identifying and prioritizing the weaknesses and risks in an organization’s systems or network. Performing tests against implemented security controls (D) is a goal of a penetration test, which is an authorized and simulated attack on an organization’s systems or network to evaluate their security posture and identify any vulnerabilities or misconfigurations.

Comprehensive and Detailed Step-by-Step Explanation:The logs indicate that the OWASP DirBuster tool is being used. This tool is designed for directory brute-forcing to find hidden files or directories on a web server, which aligns with reconnaissance activities. The series of GET and HEAD requests further confirm directory and file enumeration attempts.

In case of a phishing attack, it’s crucial to review what actions were taken by the employee and analyze the phishing email to understand its nature and impact.References: CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 6, page 246; CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 6, page 255.

Mean time to detect (MTTD) is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system. MTTD is a metric that measures how long it takes to detect a security incident or threat from the time it occurs. MTTD can be improved by using tools and processes that can collect, correlate, analyze, and alert on security data from various sources. SIEM, SOAR, and ticketing systems are examples of such tools and processes that can help reduce MTTD and enhance security operations. Official References: https://www.eccouncil.org/cybersecurity-exchange/threat-intelligence/cyber-kill-chain-seven-steps-cyberattack

To determine which system to remediate first using only CVSS vectors, the analyst should prioritize the vulnerability that is most severe and most easily exploitable, especially when it is exploitable over the network and requires no privileges and no user interaction.

The Web server has the most dangerous combination of exploitability and impact:

Attack Vector = Network (AV:N) → exploitable remotely over a network

Attack Complexity = Low (AC:L) → no special conditions required

Privileges Required = None (PR:N) → attacker doesn’t need credentials

User Interaction = None (UI:N) → no user action required

Impact = High for Confidentiality, Integrity, and Availability (C:H / I:H / A:H) → full compromise potential

The Sybex CySA+ Study Guide explains that CVSS provides a 0–10 severity score and that analysts must be able to interpret key metrics like Attack Vector, Attack Complexity, Privileges Required, User Interaction, and Impact.

The All-in-One guide defines Attack Vector and notes that the more remote the vector, the higher the score (Network is remotely exploitable).

And Secbay Press states that organizations use CVSS as a basis for prioritization, typically addressing higher scores first.

Exact extract (Secbay Press): “Organizations often use CVSS scores as a basis for prioritizing vulnerabilities, addressing those with higher scores first.”

Why the other assets are lower priority than the Web server (based on the vectors)

File server (AV:L) is local attack vector, meaning the attacker must already have local access; that generally reduces priority compared to a remotely exploitable (AV:N) issue. (Attack vector definitions and scoring emphasize Network vs Local distinctions.)

Mail server (AC:H) requires high attack complexity, lowering exploitability compared to the Web server’s AC:L.

Domain controller (PR:R, UI:R) requires privileges and user interaction, which lowers exploitability compared to PR:N/UI:N on the Web server.

Bottom line: The Web server is the most immediately dangerous because it is remotely exploitable (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), and has high impact across C/I/A—making it the strongest candidate for first remediation under CVSS-based prioritization.

References (CompTIA CySA+ CS0-003 documents / study guides used):

Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): CVSS used to prioritize; higher scores addressed first

Mike Chapple & David Seidl, CompTIA CySA+ Study Guide (CS0-003): CVSS metrics and interpretation (AV/AC/PR/UI/Impact) and severity score concept

Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): Attack Vector/Attack Complexity definitions; remote vectors score higher

The MTTD (Mean Time To Detect) is calculated by averaging the time elapsed in detecting incidents. From the given data: (180+150+170+140)/4 = 160 minutes. This is the correct answer according to the CompTIA CySA+ CS0-003 Certification Study Guide1, Chapter 4, page 161. References: CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 4, page 153; CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 4, page 161.