CompTIA Updated CS0-003 Exam Questions and Answers by daniella

The suspicious entry on the host-based IDS logs indicates that a reverse shell was executed on the host, which connects to the remote IP address 10.1.2.3 on port 8080. The shell script option D uses the netstat command to check if there is any active connection to that IP address and port, and prints “Malicious activity” if there is, or “OK” otherwise. This is the most accurate way to confirm if the reverse shell is still active, as the other options may not detect the connection or may produce false positives.

ReferencesCompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 8: Incident Response, page 339.Reverse Shell Cheat Sheet, Bash section.

The Diamond Model of Intrusion Analysis is a framework that helps analysts to understand the relationships between the adversary, the victim, the infrastructure, and the capability involved in an attack. It also enables analytical pivoting, which is the process of moving from one piece of information to another related one, and identifies knowledge gaps that need further investigation. 

Zero Trust Network Access (ZTNA)simplifies secure remote access to cloud and SaaS applications byenforcing identity-based, least-privilege access policies. It eliminates the need to extend traditional network-based access models to the cloud. ZTNA ensures thateach user is verified continuouslyregardless of their network location, aligning perfectly with complex multi-cloud or SaaS environments.

RADIUS (A)is an older authentication protocol, not ideal for SaaS cloud scale.

SDN (B)controls network flow, not identity management.

SWG (D)is a secure web proxy, not for access control and IAM extension.

???? Reference:

CS0-003 Exam Objectives 1.1 – Identity and Access Management

Sybex Study Guide – Chapple & Seidl, Chapter 2: Zero Trust & Cloud IAM

Using CVSS v4.0, the highest-priority remediation is typically the vulnerability that is most remotely exploitable and requires the least attacker effort (low complexity, no special conditions, low/no privileges, and no user interaction).

System D is the strongest “fix first” candidate because it combines:

AV:N (Network) → remotely exploitable over the network; severity increases the more remote the attacker can be.

AC:L (Low) → easier to exploit than High complexity.

AT:N (None) → “does not depend on deployment/execution conditions”; attacker can expect the exploit to work under most instances.

PR:L (Low) → only basic user privileges required (still relatively accessible).

UI:N (None) → most important differentiator vs System A. CVSS v4.0 explicitly states: “The resulting score is greatest when no user interaction is required.”

E:P (Proof-of-Concept) → publicly available PoC code exists (more exploitable than “Unreported”), increasing urgency compared to U.

Why not System A (the closest competitor)?

System A is also AV:N/AC:L/AT:N/PR:L, but it has UI:A (Active), meaning exploitation requires a targeted user to perform specific actions. CVSS v4.0 defines Active (A) as requiring “specific, conscious interactions… or actively subvert protection mechanisms.”

System D’s UI:N makes it exploitable purely at the attacker’s will, which CVSS treats as more severe.

Why the others are lower priority

System B (AV:A, AC:H, AT:P): adjacent-only, high complexity, and attack requirements present → significantly harder/less broadly exploitable.

System C (AV:P) and System E (AV:P): require physical access, which reduces the pool of potential attackers and generally lowers priority versus network-exploitable issues.

References (Official CVSS v4.0 specification used):

FIRST, CVSS v4.0 Specification Document:

User Interaction values (None/Passive/Active) and “score is greatest when no user interaction is required”

Attack Requirements (AT) definitions (None vs Present)

Exploit Maturity (E) values (X/A/P/U) and meanings

Attack Vector remoteness increases severity