CompTIA CySA+ — Practice Questions and Mock Exam

Volatility memory forensics plugins for malware detection: malfind (detects injected code — PAGE_EXECUTE_READWRITE with no disk backing), pstree/pslist (process tree analysis for suspicious parent-child relationships), netscan (network connections), handles (open handles), dlllist (loaded DLLs), cmdline (process command lines), and filescan (file objects in memory). The malfind plugin specifically targets process injection by checking memory protection flags and VAD (Virtual Address Descriptor) tags. Legitimate code rarely needs PAGE_EXECUTE_READWRITE permission.

Security metrics for executive audiences must translate technical security operations into business-relevant insights about risk posture and operational effectiveness. Metrics like MTTD and MTTR measure how quickly the team detects and responds to threats, incident counts by severity show threat landscape trends, and patch compliance against SLAs demonstrates proactive risk management. These are actionable, trend-able, and tied to business outcomes — unlike raw technical metrics such as log volumes or signature counts.

Mature change management frameworks include emergency change procedures for situations where critical vulnerabilities pose imminent risk and the standard approval timeline is too slow. Emergency changes still require approval — typically from a designated authority or subset of the change board — along with documentation, risk assessment, and rollback planning. This approach balances urgency with governance rather than bypassing controls entirely or leaving systems exposed.