CompTIA CS0-003 Practice Test - Questions Answers, Page 34

The MITRE ATT&CK framework is specifically designed for tracking Tactics, Techniques, and Procedures (TTPs) associated with cyber threats. It provides a detailed matrix of known adversarial behaviors, which is useful for correlating SIEM data to known attack patterns. According to CompTIA CySA+, MITRE ATT&CK is an industry-standard framework for threat intelligence and behavior analysis, making it the ideal tool for tracking malicious IP addresses and understanding their tactics. Other options like OSSTMM, the Diamond Model, and OWASP do not focus on TTPs as directly as MITRE ATT&CK does.

Blocking the IP address at the EDR (Endpoint Detection and Response) level provides an immediate, targeted response to the detected reconnaissance activity, preventing further interaction with the high-value assets. EDR tools are designed to detect and block malicious IPs across endpoints. According to CompTIA CySA+, this proactive step is effective for isolating and mitigating threats on specific endpoints. While creating SIEM signatures (B) is useful for monitoring, and policies on WAF (C) and NGFWs (D) can provide additional layers of defense, the most immediate protective action is to block at the endpoint level.

Step 1: Analyzing the SFTP Log

The SFTP log provides a record of file transfer and login activities:

User ''sjames'' logged in from several IP addresses:

192.168.10.32 and 192.168.10.37 (internal network IPs)

32.111.16.37 and 41.21.18.102 (external IPs)

We see file alterations in the /var/www directory, which is commonly the web directory.

Modified files: about_us.html, index.html

Suspicious activity:

192.168.11.102 and 41.21.18.102 modified the files.

32.111.16.37 had failed login attempts, indicating possible unauthorized access attempts.

The most suspicious IP here is 41.21.18.102, as it's associated with direct file modifications, possibly indicating unauthorized access.

Step 2: Reviewing Netstat

The netstat output shows active connections and their states:

IP 41.21.18.102 has an ESTABLISHED connection with port 22, commonly used for SFTP.

IP 32.111.16.37 is also attempting connections, and 32.111.16.37 connections are in a TIME_WAIT state, showing prior connections were recently closed.

The netstat output reaffirms 41.21.18.102 is actively connected and potentially involved in malicious activities.

Step 3: Checking the HTTP Access Log

The HTTP Access log shows access to about_us.html:

32.111.16.37 repeatedly accessed /about_us.html with 404 errors, indicating attempts to reach non-existing pages.

41.21.18.102 accessed the 200 status code, showing successful page requests, but since this IP was modifying files directly on the server, it might be testing or verifying changes.

Again, 41.21.18.102 stands out as it matches both successful file modification and page request patterns, while 32.111.16.37 shows unsuccessful attempts.

Step 4: Selecting the IP of Concern

Based on the above analysis:

Step 5: Identifying the Indicator of Compromise

Potential indicators include unauthorized file modifications:

Modified index.html file is the correct answer, as it indicates direct changes to website content and is often a clear sign of compromise.

Step 6: Selecting Corrective Actions

To mitigate and prevent further compromise:

Change the password on the ''sjames'' account: The account was used across various IPs, indicating potential account compromise.

Block external SFTP access: Restricting SFTP to internal IPs only would prevent unauthorized external modifications. Since 41.21.18.102 was external, this would stop similar threats.

Summary

IP of Concern: 41.21.18.102

Indicator of Compromise: Modified index.html file

Corrective Actions:

Change the password on the sjames account

Block external SFTP access

These selections address both the immediate security breach and implement a preventative measure against future unauthorized access.

Step 1: Reviewing the Vulnerability Remediation Timeframes

The remediation standards require servers to be patched based on their CVSS score:

CVSS > 9.0: Patch within 7 days

CVSS 7.9 - 9.0: Patch within 14 days

CVSS 5.0 - 7.9: Patch within 30 days

CVSS 0 - 5.0: Patch within 60 days

Step 2: Analyzing the Output Tab

From the Output tab:

Server 192.168.76.5 has a CVSS score of 9.2 for an unsupported Microsoft IIS version, indicating a critical vulnerability requiring a patch within 7 days.

Server 192.168.76.6 has a CVSS score of 7.4 for a missing secure attribute on HTTPS cookies, which falls in the 5.0 - 7.9 range, requiring a patch within 30 days.

Since the question asks for the server to be patched within 14 days, we need to focus on servers with CVSS 7.9 - 9.0:

None of the servers have a CVSS score that falls precisely in the 7.9 - 9.0 range.

However, 192.168.76.5, with a CVSS score of 9.2, has a vulnerability that necessitates a quick response and fits as it must be patched within the shortest timeframe (7 days, which includes 14 days).

The server that fits within a 14-day urgency, based on standard practices, would be 192.168.76.5.

Step 3: Reviewing the Environment Tab

The Environment Tab provides additional context for 192.168.76.5:

It's in the dev environment, which is internal and not publicly accessible.

MFA is required, indicating security measures are already present.

Step 4: Selecting the Appropriate Technique and Mitigation

For 192.168.76.5, with the Microsoft IIS unsupported version:

Patch; upgrade IIS to the current release is the most suitable option, as upgrading IIS will resolve the unsupported software vulnerability by bringing it up-to-date with supported versions.

This technique addresses the root cause, which is the unpatched, outdated software.

Summary

Server to be patched within 14 calendar days: 192.168.76.5

Appropriate technique and mitigation: Patch; upgrade IIS to the current release

This approach ensures that the most critical vulnerabilities are addressed promptly, maintaining security compliance.

The lessons-learned register is an essential document that captures insights and feedback from past exercises or incidents, highlighting what went well and what did not. By utilizing this register, the SOC manager can identify specific areas for improvement and develop actionable steps to enhance future response efforts. According to CompTIA's CySA+ and Security+ guidance, lessons learned from tabletop exercises are crucial for iterative improvements in an incident response plan. Options A, B, and C are useful resources, but the lessons-learned register specifically focuses on reflection and improvement, which is the primary objective in this context.

The code snippet provided suggests an SQL injection vulnerability, indicated by the use of '1=1,' which is a common SQL injection technique to bypass authentication. To mitigate this risk, validating user input is the most effective control, as it ensures that any input is properly sanitized and escapes potentially malicious characters before interacting with the database. This is a key principle from CompTIA Security+ guidelines on secure coding practices. Options A and B are unrelated to the vulnerability type here, and while access control (Option C) is generally good practice, it does not specifically prevent SQL injection.

Before taking any action, the SOC analyst should first verify if the Indicators of Compromise (IoC) and Tactics, Techniques, and Procedures (TTPs) reported are relevant to the organization's environment. This involves checking if the vulnerable application or version is actually in use. As per CompTIA's CySA+ guidelines, relevance verification helps in prioritizing resources and response actions effectively, ensuring that time is not wasted on threats that do not impact the organization. Options A, B, and D are important subsequent steps if the threat is deemed relevant.

Command-and-control (C2) beaconing involves compromised systems communicating with an attacker's server at regular intervals, often using HTTPS to blend in with legitimate traffic. This is indicative of a potential compromise where malware communicates back to a command center. The persistent nature of the connections after hours and throughout the day suggests automated beaconing, which is a tell-tale sign of C2 activity. According to CompTIA CySA+, this type of activity should raise immediate suspicion and warrants further investigation and containment. While options B, C, D, and E might indicate other issues, they do not fit the pattern described as well as option A.

The correct regular expression to match a GET request to this API endpoint is 'https://10\.1\.2\.3/api\?id=\d+'. This pattern checks for the specific URL with an id parameter that accepts integer values. The syntax \d+ matches one or more digits, which aligns with the requirement for a single integer argument. Other options either use incorrect syntax or do not accurately capture the expected URL format. Regular expressions are vital in filtering and identifying patterns in logs, as recommended by CompTIA Cybersecurity Analyst (CySA+) practices for threat hunting and log analysis.