Mean Time to Detect (MTTD) is the most appropriate Key Performance Indicator (KPI) to monitor the effectiveness of an incident response reporting and communication program among the choices provided.
* Why B is correct: The primary goal of an " incident reporting " program (whether automated by tools or reported by users/staff) is to alert the security team to an issue as quickly as possible. MTTD measures the average time it takes for an organization to identify (detect and report) an incident after it has occurred. A lower MTTD directly indicates that the reporting mechanisms and communication channels from the source to the analysts are operating effectively.
* Why A is incorrect: Incident volume measures the quantity of incidents, which reflects the threat landscape or workload rather than the effectiveness of the response program itself. While an increase in user-reported volume can indicate better awareness, MTTD is the standard performance metric for the process.
* Why C is incorrect: Average time to patch is a KPI for Vulnerability Management, not Incident Response reporting.
* Why D is incorrect: Remediated incidents refers to the volume of resolved issues (Response/Recovery phase) and does not specifically measure the speed or quality of the reporting and communication (detection) phase.
In Domain 4 (Reporting and Communication) and Domain 1 (Security Operations), CompTIA emphasizes the use of time-based metrics to evaluate process maturity.
* MTTD (Mean Time to Detect): Measures " dwell time " and the efficiency of the Detection & Reporting phase.
* MTTR (Mean Time to Respond): Measures the efficiency of the Response & Recovery phase.

A tabletop exercise is the most likely action that an analyst would perform after an incident has been investigated. A tabletop exercise is a simulation of a potential incident scenario that involves the key stakeholders and decision-makers of the organization. The purpose of a tabletop exercise is to evaluate the effectiveness of the incident response plan, identify the gaps and weaknesses in the plan, and improve the communication and coordination among the incident response team and other parties. A tabletop exercise can help the analyst to learn from the incident investigation, test the assumptions and recommendations made during the investigation, and enhance the preparedness and resilience of the organization for future incidents12. Risk assessment, root cause analysis, and incident response plan are all actions that an analyst would perform before or during an incident investigation, not after. Risk assessment is the process of identifying, analyzing, and evaluating the risks that may affect the organization. Root cause analysis is the method of finding the underlying or fundamental causes of an incident. Incident response plan is the document that defines the roles, responsibilities, procedures, and resources for responding to an incident345.
References: Tabletop Exercises: Six Scenarios to Help Prepare Your Cybersecurity Team, Tabletop Exercises for Incident Response - SANS Institute, Risk Assessment - NIST, Root Cause Analysis - OWASP, Incident Response Plan | Ready.gov

AUSB drop attackis acommon method for delivering ransomware, where an attacker leaves infected USB drives in strategic locations,tricking employees into plugging them into corporate devices.
* Option B (LFI - Local File Inclusion)exploitsweb applications, but the scenario lacksnetwork intrusion indicators.
* Option C (Cross-site request forgery - CSRF)is used forexploiting authenticated web sessions, not ransomware delivery.
* Option D (SQL injection)is used fordatabase exploitation, not file encryption malware.
Thus,A (USB drop) is the correct answer, asphysical malware introduction is a known ransomware attack vector.

To determine which system to remediate first using only CVSS vectors, the analyst should prioritize the vulnerability that is most severe and most easily exploitable, especially when it is exploitable over the network and requires no privileges and no user interaction.
The Web server has the most dangerous combination of exploitability and impact:
* Attack Vector = Network (AV:N) # exploitable remotely over a network
* Attack Complexity = Low (AC:L) # no special conditions required
* Privileges Required = None (PR:N) # attacker doesn't need credentials
* User Interaction = None (UI:N) # no user action required
* Impact = High for Confidentiality, Integrity, and Availability (C:H / I:H / A:H) # full compromise potential The Sybex CySA+ Study Guide explains that CVSS provides a 0-10 severity score and that analysts must be able to interpret key metrics like Attack Vector, Attack Complexity, Privileges Required, User Interaction, and Impact.
The All-in-One guide defines Attack Vector and notes that the more remote the vector, the higher the score (Network is remotely exploitable).
And Secbay Press states that organizations use CVSS as a basis for prioritization, typically addressing higher scores first.
Exact extract (Secbay Press): "Organizations often use CVSS scores as a basis for prioritizing vulnerabilities, addressing those with higher scores first." Why the other assets are lower priority than the Web server (based on the vectors)
* File server (AV:L) is local attack vector, meaning the attacker must already have local access; that generally reduces priority compared to a remotely exploitable (AV:N) issue. (Attack vector definitions and scoring emphasize Network vs Local distinctions.)
* Mail server (AC:H) requires high attack complexity, lowering exploitability compared to the Web server's AC:L.
* Domain controller (PR:R, UI:R) requires privileges and user interaction, which lowers exploitability compared to PR:N/UI:N on the Web server.
Bottom line: The Web server is the most immediately dangerous because it is remotely exploitable (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), and has high impact across C/I/A-making it the strongest candidate for first remediation under CVSS-based prioritization.
References (CompTIA CySA+ CS0-003 documents / study guides used):
* Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): CVSS used to prioritize; higher scores addressed first
* Mike Chapple & David Seidl, CompTIA CySA+ Study Guide (CS0-003): CVSS metrics and interpretation (AV/AC/PR/UI/Impact) and severity score concept
* Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): Attack Vector/Attack Complexity definitions; remote vectors score higher

The first and most urgent step to mitigate the impact of compromised credentials on the dark web is to perform a forced password reset for the affected user. This will prevent the cybercriminals from using the stolen credentials to access the company's network and systems. Multifactor authentication is a good security measure, but it is not foolproof and can be bypassed by sophisticated attackers. Therefore, changing the password as soon as possible is the best practice to reduce the risk of a data breach or other cyber attack123 References: 1: How to monitor the dark web for compromised employee credentials 2: How to prevent corporate credentials ending up on the dark web 3: Data Breach Prevention: Identifying Leaked Credentials on the Dark Web