The correct answer is B. CASB. A Cloud Access Security Broker is specifically designed to sit between users and cloud services, monitor cloud activity, enforce access policies, and provide visibility into unauthorized cloud storage use. This directly matches the question's requirement: showing user access to prohibited cloud storage and whether a file was downloaded to a personal device.
Exact supporting extract: the All-in-One CySA+ guide explains that a CASB "sits between each user and each cloud service," monitors activity, enforces policies, and alerts when something is wrong. It also lists visibility as a CASB pillar, including whether users are connecting to unauthorized resources such as cloud storage not controlled by the organization.
The Sybex CySA+ Study Guide also states that CASB tools enforce security policies when cloud resources and services are used, and can help with data security, service usage and access visibility, and risk management.
The official CompTIA CySA+ CS0-003 objectives include Cloud Access Security Broker (CASB) under identity and access management / security operations architecture concepts.
Why the other options are incorrect:
A). SASE is broader architecture that may include CASB, SWG, FWaaS, and SD-WAN, but the specific tool for cloud-service visibility and policy logging is CASB.
C). EDR focuses on endpoint detection and response, not cloud storage access monitoring across cloud services.
D). SDN is software-defined networking and does not provide user-level cloud storage access logs.

An incident manager should work with the legal and public relations entities to ensure correct processes are adhered to when communicating incident reporting to the general public, as a best practice. The legal entity can provide guidance on the legal implications and obligations of disclosing the incident, such as compliance with data protection laws, contractual obligations, and liability issues. The public relations entity can help craft the appropriate message and tone for the public communication, as well as manage the reputation and image of the organization in the aftermath of the incident. These two entities can help the incident manager balance the need for transparency and accountability with the need for confidentiality and security12.
References: Incident Communication Templates, Incident Management: Processes, Best Practices & Tools - Atlassian

Non-repudiation ensures that a message sender cannot deny the authenticity of their sent message. This is crucial in banking communications for legal and security reasons.
The goal of allowing a message recipient to prove the message's origin is non-repudiation. This ensures that the sender cannot deny the authenticity of their message. Non-repudiation is a fundamental aspect of secure messaging systems, especially in banking and financial communications.

1. Analyze the Log Evidence: The log displays a specific sequence of rapid-fire events (within 18 seconds) characteristic of automated reconnaissance tools used to map Active Directory environments.
* 20:06:05 (LDAP Reads): The attacker queries the directory for high-value groups (Domain Admins) and critical infrastructure (Domain Servers). They are not trying to log in; they are reading the membership lists to see who is important and where the servers are.
* 20:06:09 (EDR Enumeration): The attacker checks the local Administrators group. This is to see if the current compromised user has admin rights or who does.
* 20:06:23 (SMB Connections): The host PC021 attempts to connect to multiple other hosts. This indicates the attacker is testing where they can move laterally using the credentials or access they currently have.
2. Why this is " Finding the Shortest Path " (Option A): This behavior is the textbook signature of tools like BloodHound (or its data collector, SharpHound).
* Concept: Adversaries use these tools to visualize relationships in Active Directory. They query LDAP to find out: " I am User A. Which computers can I access? Who is a Domain Admin? Is a Domain Admin logged into a computer I can access? "
* Goal: The tool calculates the mathematical " shortest path " (graph theory) from the attacker ' s current low-level foothold to the ultimate target (Domain Admin).
* The combination of LDAP querying (mapping the graph) and SMB connection attempts (verifying sessions/local admin rights) confirms the adversary is mapping out the network to find the most efficient route to total compromise.
Why the other options are incorrect:
* B. An adversary is performing a vulnerability scan: Vulnerability scanners (like Nessus or Qualys) typically probe ports and services to identify unpatched software (CVEs). They generally do not focus on querying LDAP for " Domain Admins " group membership as their primary action.
* C. An adversary is escalating privileges: While the attacker intends to escalate privileges eventually, the logs show enumeration (Discovery phase). They are currently looking for the path to escalate, not actively exploiting a vulnerability (like a kernel exploit) to change their privilege level in this specific snapshot.
* D. An adversary is performing a password stuffing attack: Password stuffing involves high volumes of failed authentication attempts against a login service. The logs here show read operations and connection attempts, not the " Invalid Credential " errors associated with stuffing.

Vulnerability 2 has the highest impact metrics, specifically the highest attack vector (AV) and attack complexity (AC) values. This means that the vulnerability is more likely to be exploited and more difficult to remediate.
References:
CVSS v3.1 Specification Document, section 2.1.1 and 2.1.2
The CVSS v3 Vulnerability Scoring System, section 3.1 and 3.2