Study Hub / CompTIA CySA+ (CS0-004) / Domain 3.0
CompTIA CySA+ (CS0-004) Domain 3.0: Incident Response and Management — Explained
Domain 3.0 is what happens when prevention fails: the disciplined, phased process of handling a live security incident — from preparation through lessons learned — plus the forensics fundamentals that make the response provable.
The IR phases in order
- Preparation — before anything happens: playbooks, contact lists, tooling, trained team, tested backups. IR quality is decided before the incident.
- Detection & analysis — an alert or report becomes a confirmed incident: scope it (which systems? how long? what data?), classify severity, and decide the response level.
- Containment — stop the bleeding without destroying evidence: isolate hosts from the network (short-term), then segment/block attacker infrastructure (long-term). Contain first, then dig.
- Eradication — remove the attacker's presence: kill persistence (rogue accounts, scheduled tasks, backdoors), patch the entry vector. Eradicating before full scoping just teaches the attacker to hide better.
- Recovery — restore systems from known-good backups, bring services online in priority order, and monitor closely — reinfection now means the eradication missed something.
- Lessons learned — the blameless post-mortem: timeline, what worked, what failed, action items with owners. An incident without lessons learned is tuition paid for nothing.
Forensics fundamentals
- Order of volatility — collect the most ephemeral first: CPU cache/registers → RAM → network state → running processes → disk → logs → archives. RAM before disk, always — rebooting destroys memory evidence.
- Imaging — bit-for-bit copies (hash-verified, e.g., SHA-256) so analysis happens on the copy, never the original. Matching hashes prove the copy is faithful — the foundation of admissibility.
- Chain of custody — documented who handled evidence, when, and why, at every step. A gap in the chain is a gap a defense attorney drives through.
- Write blockers — hardware/software preventing writes to the original media during imaging. Analysis never alters the source.
- Memory forensics — RAM holds what disk doesn't: running malware, decrypted content, network connections, encryption keys. Fileless malware only exists here.
Evidence, legal, and communication
- Legal hold — when litigation is possible, preserve everything relevant and stop routine deletion. Destroying evidence under hold is its own offense.
- Communication discipline — need-to-know updates, pre-approved messaging, legal review before external statements. Loose talk during an incident becomes Exhibit A.
- Containment vs. evidence tension — pulling the plug kills volatile evidence; leaving it running lets the attacker act. The professional answer: capture memory first, then isolate — planned, not improvised.
- Root cause — the incident isn't over when systems are back; it's over when you know how they got in and closed it. Unknown entry vector = expected recurrence.
The must-memorize table: order of volatility
Collect most-ephemeral first.
| Priority | Evidence | Why first |
|---|---|---|
| 1 | CPU cache, registers | Gone in microseconds once power/state changes |
| 2 | RAM / memory | Lost on reboot; holds fileless malware, keys |
| 3 | Network state, connections | Transient by nature |
| 4 | Running processes | Die with the system |
| 5 | Disk / filesystem | Persistent — image it |
| 6 | Logs, archives, backups | Most durable; collect last |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A workstation shows ransomware behavior. The responder's first actions should be:
- A. A. Immediately wipe and reimage the machine
- B. B. Capture volatile evidence (memory) first, then isolate the host from the network
- C. C. Pay the ransom to save time
- D. D. Delete the encrypted files to stop the spread
Show answer & reasoning
B. Volatile evidence dies on reboot/power-off, so memory capture comes first; then isolate to stop spread — without wiping (which destroys evidence and the chance to understand the attack). Wiping first (A) is evidence destruction disguised as decisiveness. Capture, contain, then investigate.
2. During analysis, the team finds an attacker-created admin account and a scheduled task re-downloading malware. They remove both and patch the exploited service. Which phase is this?
- A. A. Containment
- B. B. Eradication — removing persistence mechanisms and closing the entry vector
- C. C. Recovery
- D. D. Lessons learned
Show answer & reasoning
B. Eradication = remove the attacker's presence and persistence (rogue accounts, backdoors, scheduled tasks) and fix how they got in. Containment (A) was the earlier "stop the spread" step; recovery (C) is restoring service afterward. Order: contain the bleeding, then remove the cause.
3. Why must forensic analysis be performed on a hashed copy rather than the original drive?
- A. A. Copies are faster to analyze
- B. B. Hash-verified copies preserve the original unaltered and prove the evidence is faithful — required for chain of custody and admissibility
- C. C. Original drives can't be read by forensic tools
- D. D. It saves disk space
Show answer & reasoning
B. The original must remain pristine; analysis on a bit-for-bit copy (with matching hashes proving fidelity) plus documented chain of custody is what makes evidence admissible. Analyzing the original alters timestamps and content — destroying exactly what you'd need to prove.
4. An incident is "resolved" — systems restored — but nobody determined the initial entry vector. What is the problem?
- A. A. None — restoration is the goal
- B. B. Without root cause, the vulnerability remains open and recurrence is expected — the IR isn't actually complete
- C. C. The lessons-learned meeting can be skipped
- D. D. Forensics was unnecessary
Show answer & reasoning
B. Recovery without root cause is rebuilding on a compromised foundation: the attacker's way in still works. True closure requires knowing how (entry vector closed, persistence removed) — otherwise you've scheduled the next incident, not finished this one.
This was one domain. The simulator drills all 4.
This free preview covered Incident Response and Management (Domain 3.0, 24%). Not covered here: Reporting and Communication (Domain 4.0, 16%). The reporting and communication domain plus advanced vulnerability-management and threat-hunting detail stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CySA+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy