A signal-shielded bag and a tamper-evident seal are tools that can be used to maintain the integrity of the mobile phone while it is transported. A signal-shielded bag prevents the phone from receiving or sending any signals that could compromise the data or evidence on the device. A tamper-evident seal ensures that the phone has not been opened or altered during the transportation. References: Mobile device forensics, Section:
Acquisition

Host03 should be patched first, based on the metrics, as it has the highest risk score and the highest number of critical vulnerabilities. The risk score is calculated by multiplying the CVSS score by the exposure factor, which is the percentage of systems that are vulnerable to the exploit. Host03 has a risk score of 10 x 0.9 = 9, which is higher than any other host. Host03 also has 5 critical vulnerabilities, which are the most severe and urgent to fix, as they can allow remote code execution, privilege escalation, or data loss. The other hosts have lower risk scores and lower numbers of critical vulnerabilities, so they can be patched later.

This log shows multiple 404 errors being triggered from requests to different directories or paths, which strongly suggests adirectory brute-force attack. In this type of attack, an adversary uses automated tools to enumerate directory or file paths in an attempt to find hidden or misconfigured resources. The frequent 404
"Not Found" HTTP responses from a single IP address attempting to access different URL paths is the signature pattern for directory brute-forcing. This behavior is not consistent with XSS, SQLi, or RCE, which would involve payloads or specific encoded commands, not merely probing paths.
Reference:
Chapple & Seidl,CompTIA CySA+ Practice Tests(Sybex, 2023), Question 149, p. 297 Objective 1.2 of CySA+ CS0-003 Exam Objectives: Analyze indicators of malicious activity such as scans
/sweeps, unusual traffic spikes, activity on unexpected ports

The correct answer is B. The packet capture shows ICMP echo request traffic, which is normally associated with ping. However, the scenario shows millions of packets carrying data payloads to an external destination, while proprietary data is already being sold on the dark web. That strongly indicates data is being hidden inside ICMP traffic, which is exfiltration over an alternative protocol.
The CompTIA CySA+ CS0-003 objectives list data exfiltration, unexpected outbound communication, and packet capture tools such as Wireshark and tcpdump under Security Operations malicious activity analysis.
The Sybex CySA+ Study Guide explains that ping uses ICMP echo requests and that ICMP is normally used to check whether a remote host is reachable. The All-in-One guide defines data exfiltration as unauthorized transfer of sensitive information from a compromised system to an external location and notes that attackers may use covert channels to exfiltrate data.
Why the other options are incorrect:
A is incorrect because the evidence does not prove an insider or normal command-and-control activity.
C is incorrect because there is no evidence of virus propagation, scanning, or lateral spread.
D is incorrect because an ICMP DDoS would focus on overwhelming a target, not carrying data payloads outbound.

The threat was detected from the time the emails were sent at 8:30 a.m. to when the recipients started alerting the organization's help desk about the email at 8:45 a.m., taking a total of 15 minutes. The detection time is the time elapsed between the occurrence of an incident and its discovery by the security team . The other options are either too short or too long based on the given information. References: : Detection Time :
Incident Response Metrics: Mean Time to Detect and Mean Time to Respond