The first step in building a disaster recovery plan (DRP) for critical on-prem applications is to determine what is actually "critical" to the business, how long the organization can tolerate those applications being down, and therefore what restoration order (prioritization) is required. That prioritization must come from business
/data owners and stakeholders, because they understand operational dependencies, business impact, and acceptable downtime.
This is essentially the start of a Business Impact Analysis (BIA) and related continuity prioritization work, which precedes choices like vendors, contracts, or site geography. You don't select a DR site/vendor or negotiate agreements until you know which systems must be restored first and what recovery objectives you must meet.
Supporting exact extracts:
* The All-in-One CS0-003 guide explains that the foundation is identifying critical systems and determining tolerable outage time (used to prioritize restoration):Exact extract (All-in-One Exam Guide): "The key is to determine which of the organization's critical systems are needed for survival and then estimate the outage time that can be tolerated by the organization..." It then connects those determinations directly to prioritization:Exact extract (All-in-One Exam Guide): "These estimates will help you determine how to prioritize response team efforts to restore these assets."
* The Secbay Press CS0-003 guide lays out the early BIA/risk identification steps in order, starting with identifying what's critical before recovery priorities:Exact extract (Secbay Press): "1. Identify critical processes and resources2. Identify outage impacts and estimate downtime3. Identify resource requirements4. Identify recovery priorities" Why the other options are not the first step:
* A / C (vendor selection / vendor agreements): those come after requirements are defined (RTO/MTD, criticality, order of restoration).
* D (define geographic area): location considerations are important, but they are driven by requirements and constraints discovered during BIA/continuity prioritization (what needs to be recovered, how fast, and with what dependencies).
References (CompTIA CySA+ CS0-003 documents / study guides used):
* Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): determine critical systems and tolerable outage time; used to prioritize restoration
* Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): BIA / risk identification process steps (identify critical processes/resources # estimate downtime # recovery priorities)

The described behavior(pivoting across network segments, targeting domain servers, and exfiltrating data to an unknown location)is characteristic of anadvanced persistent threat (APT), often linked to nation-state actors.
* Option A (Hacktivist)attackers typically engage indefacements or disruptionrather thanstealthy exfiltration.
* Option B (Zombie)refers tocompromised hosts in a botnet, but botnets do not usually pivot across networks.
* Option C (Insider threat)could involve unauthorized access, but the traffic pattern suggests anexternal attacker withlateral movementtechniques.
Thus,D is the correct answer, asnation-state actors often use sophisticated tactics, including data exfiltration and network pivoting.

Reverse engineering is a technique that involves analyzing a binary file to understand its structure, functionality, and behavior. Reverse engineering can help security analysts perform malware analysis, vulnerability research, exploit development, and software debugging. Reverse engineering can be done using various tools, such as disassemblers, debuggers, decompilers, and hex editors.

The first step for the security team when receiving a legal hold request is to notify the relevant departments to preserve all potentially relevant information. This ensures that no data is altered, deleted, or otherwise tampered with, which is critical for maintaining the integrity of the evidence. Preserving information includes emails, documents, and any other data that might be relevant to the legal matter. Establishing a chain of custody and backing up data are also important steps, but notifying the involved parties is the immediate priority to prevent data loss.

This is because scanning without admin privileges can limit the scope and accuracy of the vulnerability scan, and potentially miss some critical vulnerabilities that require higher privileges to detect. According to the OWASP Vulnerability Management Guide1, "scanning without administrative privileges will result in a large number of false negatives and an incomplete scan". Therefore, the analyst should recommend addressing this issue to ensure potential vulnerabilities are identified.