CySA+ CS0-004 - Domain 3: Incident Response and Management (24%)

Built from CompTIA's official CS0-004 V4 exam objectives (v2.0)

Cyber Kill Chain stages

Reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives

Diamond Model of Intrusion Analysis

Four features of every intrusion event: adversary, capability, infrastructure, victim

MITRE ATT&CK in IR

Maps observed behavior to tactics and techniques to understand what an attacker is doing and what to look for next

Kill Chain vs. ATT&CK

Kill Chain: linear high-level stages. ATT&CK: detailed matrix of tactics and techniques, not strictly linear

IR process phases (CS0-004)

Preparation, detection, analysis, containment, eradication, recovery, post-incident

Preparation phase

Build the IR plan, playbooks, team roles, tools, training, and communication channels before an incident

Detection phase

Identify potential incidents via alerts, logs, user reports, and threat intel

Analysis phase

Validate the incident, determine scope, severity, and impact

Containment phase

Limit spread and damage (isolate hosts, block IPs, disable accounts)

Eradication phase

Remove the root cause: malware, persistence, compromised accounts, exploited vulnerability

Recovery phase

Restore systems to normal operation and monitor for reinfection

Post-incident phase

Lessons learned, root cause analysis, after action report, and process improvement

Incident response plan vs. communication plan

IR plan: how the organization responds. Communication plan: who is told what, when, and how

Tabletop vs. simulation exercise

Tabletop: discussion-based walkthrough. Simulation: hands-on realistic exercise with technical actions

Log collection, correlation, and enrichment

Gather logs, link related events across sources, add context (reputation, asset data)

Triage

Quickly assess and prioritize alerts or incidents by severity and impact

Establishing a timeline

Order events by time across systems to understand the attack sequence (needs time synchronization)

Determining severity and impact

Assess affected systems, data sensitivity, business disruption, and spread

Evidence gathering: four key terms

Chain of custody, data integrity validation, preservation, legal hold

Chain of custody

Documented record of who handled evidence, when, and why, to prove it was not altered

Data integrity validation

Using hashes (e.g., SHA-256) to prove evidence is unchanged

Legal hold

Order to preserve potentially relevant data; do not delete or alter it

Order of volatility

Collect most volatile first: CPU/cache and memory, then network state, running processes, disk, remote logs/backups

Why take a memory capture before powering off?

RAM holds volatile evidence (processes, connections, keys) that is lost on shutdown

Isolating affected targets

Remove from network (VLAN quarantine, EDR isolate) without powering off, to preserve evidence

Escalation (IR)

Raising an incident to higher tiers or management as severity or scope increases

Remediation and verification

Fix the issue, then confirm the fix and that the attacker is gone

Release from isolation

Return a cleaned host to the network only after verification

Restoration

Rebuilding or restoring systems from known-good backups or images

Root cause analysis (RCA)

Finding the underlying reason an incident occurred, not just the symptom

Corrective action development

Creating actions to fix the root cause and prevent recurrence

Scenario: ransomware spreading across the network. First priority?

Contain: isolate affected hosts and segments to stop spread, preserving evidence

Scenario: analyst finds malware on a host. Reimage right away?

No. Preserve evidence (memory/disk image, hashes) and document first, then eradicate and restore

Scenario: unusual outbound traffic from a server at 3 AM

Likely exfiltration or C2: verify in logs, scope affected data, then contain

Scenario: phishing email reported by a user

Analyze headers and links, check other recipients, block sender/URL, reset exposed credentials

CSIRT / CERT

Cybersecurity (or Computer Emergency) Incident Response Team: group that handles incidents

Alerts and notifications in IR

Automated and manual signals that trigger response and inform the right people

Defining roles in IR

Assigning responsibilities (incident commander, analysts, comms, legal) before an incident

Data exfiltration

Unauthorized transfer of data out of the organization

Command and control (C2)

Attacker channel used to remotely control compromised systems, often beaconing at regular intervals

Persistence

Methods attackers use to keep access after reboot (scheduled tasks, services, registry run keys, new accounts)

Lateral movement

Attackers moving from one compromised system to others inside the network