CompTIA Updated CS0-002 Exam Questions and Answers by kasper

DNS sinkholing is a mechanism that can prevent internal network ranges from communicating with a list of IP addresses of known command-and-control domains by returning a false or controlled IP address for those domains. This can reduce the load on the firewall by intercepting the DNS requests before they reach the firewall and diverting them to a sinkhole server. The other options are not relevant or effective for this purpose. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 9; https://www.enisa.europa.eu/topics/incident-response/glossary/dns-sinkhole

Developing a query to search for the indicators of compromise is the first action the analyst should take in this situation. Indicators of compromise (IOCs) are pieces of information that suggest a system or network has been compromised by an attacker. IOCs can include IP addresses, domain names, file hashes, URLs, or other artifacts that are associated with malicious activity. Developing a query to search for IOCs can help to identify any potential incidents or threats in the environment and initiate further investigation or response .

A breach notification is a communication to affected individuals or entities that informs them of a security incident involving their personal or sensitive information. A breach notification may include details such as what information was compromised, when and how the incident occurred, what actions are being taken to mitigate the impact, and what steps the recipients should take to protect themselves3 A breach notification may be required by law or regulation, depending on the type and location of the information involved and the jurisdiction of the affected parties. Different countries or regions may have different breach notification requirements, such as who must be notified, when, how, and what information must be disclosed4 Therefore, the best role to determine the breach notification requirements for a company that experienced a breach of sensitive information affecting customers across multiple geographical regions is legal counsel. Legal counsel can advise the company on its legal obligations and liabilities, as well as help draft and deliver appropriate breach notifications.

EDR stands for endpoint detection and response, which is a type of security solution that monitors and protects all devices that are connected to a network, such as laptops and mobile phones. EDR can help to ensure that all devices are patched and running some sort of protection against malicious software by providing continuous visibility, threat detection, incident response, and remediation capabilities. EDR can also help to enforce security policies and compliance requirements across all devices .