Solstice Financial's quarterly vulnerability scan is in. For each finding, weigh the CVSS score, whether an exploit is available, the asset's exposure and business criticality, and any compensating controls already noted — then assign the right remediation priority. A high CVSS score alone doesn't always mean "patch immediately," and a lower score doesn't always mean it can wait.

VULNERABILITY SCAN FINDINGS — set a priority for each

AssetFindingCVSSNotesPriority
0/0correct
Solstice Financial's SIEM has surfaced unusual DNS activity from a workstation, followed by an SMB connection and remote process creation on a database host. Review the log excerpt, flag every entry that's part of the attack, then answer the questions below.

SIEM / EDR LOG EXCERPT — click a row to flag it

TimeSourceDestinationEvent
What do the repeated, long encoded-subdomain DNS queries to baddomain.net indicate?
Long, randomized/encoded subdomains queried repeatedly against one external domain is the classic signature of DNS tunneling — data is being smuggled out inside DNS queries, a channel that's often allowed through the firewall by default.
What best describes the SMB admin$ connection and remote process creation between WKS-114 and FIN-DB-02?
An admin-share connection immediately followed by a remotely spawned process, between two hosts that have never talked before, is the signature of lateral movement (PsExec-style remote execution) — the attacker pivoting from the first compromised host deeper into the network.
Which host is the original point of compromise, responsible for both the tunneling and the pivot?
WKS-114 is the first host seen tunneling data out, and it's also the source of the SMB connection into FIN-DB-02 — everything else follows from that one machine.
0/0points
Forensics is now involved. First, order these evidence sources by volatility — most volatile (lost first if the system stays powered on) to least volatile — so responders know what to collect first. Then answer three short questions about preserving evidence properly.

PART A — DRAG TO ORDER, MOST VOLATILE FIRST

0/0in correct position

PART B — EVIDENCE HANDLING

0/0correct
The incident is contained. Now it has to be communicated — to the right people, in the right form. Match each situation to who needs to hear it or what it's measuring.

PART A — WHO GETS TOLD?

PART B — NAME THE METRIC

0/0correct
Practice simulations modeled on the interaction styles CompTIA describes for CySA+ PBQs (scan triage, log review, ordered ranking, matching) — not official CompTIA items or pulled from the real exam bank. All four tabs follow one continuous incident at a fictional company, start to finish.