XDR logs will confirm the malware infection because XDR is a system that collects and analyzes data from multiple sources, such as endpoints, networks, cloud applications, and email security, to detect and respond to advanced threats12. XDR can provide a comprehensive view of the attack chain and the context of the malware infection. Firewall logs, IDS logs, and MFA logs are not sufficient to confirm the malware infection, as they only provide partial or indirect information about the network traffic, intrusion attempts, or user authentication. References: Cybersecurity Analyst+ - CompTIA, XDR: definition and benefits for MSPs| WatchGuard Blog, Extended detection and response - Wikipedia

Mean Time to Detect (MTTD) is the most appropriate Key Performance Indicator (KPI) to monitor the effectiveness of an incident response reporting and communication program among the choices provided.
* Why B is correct: The primary goal of an " incident reporting " program (whether automated by tools or reported by users/staff) is to alert the security team to an issue as quickly as possible. MTTD measures the average time it takes for an organization to identify (detect and report) an incident after it has occurred. A lower MTTD directly indicates that the reporting mechanisms and communication channels from the source to the analysts are operating effectively.
* Why A is incorrect: Incident volume measures the quantity of incidents, which reflects the threat landscape or workload rather than the effectiveness of the response program itself. While an increase in user-reported volume can indicate better awareness, MTTD is the standard performance metric for the process.
* Why C is incorrect: Average time to patch is a KPI for Vulnerability Management, not Incident Response reporting.
* Why D is incorrect: Remediated incidents refers to the volume of resolved issues (Response/Recovery phase) and does not specifically measure the speed or quality of the reporting and communication (detection) phase.
In Domain 4 (Reporting and Communication) and Domain 1 (Security Operations), CompTIA emphasizes the use of time-based metrics to evaluate process maturity.
* MTTD (Mean Time to Detect): Measures " dwell time " and the efficiency of the Detection & Reporting phase.
* MTTR (Mean Time to Respond): Measures the efficiency of the Response & Recovery phase.

Automatingthe generation of NIDS (Network Intrusion Detection System) rulesbased onStructured Threat Information eXpression (STIX) messagesis apractical use of automationin security operations.
* Option B (Privileged access requests)should involve human oversight due to thehigh risk of unauthorized access.
* Option C (PKI identity verification)requires manualdocument verificationandhuman approval.
* Option D (Malware analysis)often requiressandboxing and behavioral analysis, which benefit from human expertise.
Thus,A is the correct answer, asautomating threat intelligence ingestion and rule creation enhances efficiency in intrusion detection.

The correct answer is B because this is a critical infrastructure / ICS / OT environment. The safest option listed is a targeted, low-impact banner-grabbing approach against the known standard ports: TCP 80 for HTTP and TCP 502 for Modbus. In critical infrastructure, the analyst should avoid aggressive or broad scanning methods that could disrupt fragile industrial systems.
Exact supporting extract: the Secbay CySA+ guide states that vulnerability scanning of OT environments, including ICS and SCADA systems, requires specialized tools and methodologies because these environments have unique security requirements and constraints. It also states that vulnerabilities in ICS can have severe operational and safety implications.
The same guide explains that Modbus is a protocol used in industrial control systems and enables communication among devices connected to the same network.
The Sybex CySA+ Study Guide explains that service identification may be done by connecting and grabbing the banner or connection information provided by the service. It also explains that Nmap can perform service and version detection, but the more aggressive options are less appropriate for sensitive ICS environments.
Why the other options are incorrect:
A is incorrect because a general IT vulnerability scanner may be too intrusive for an oil and gas pipeline ICS environment.
C is incorrect because -A enables aggressive Nmap detection features, which may include OS detection, version detection, scripts, and traceroute. That is riskier in ICS/OT environments.
D is incorrect because Masscan is designed for high-speed scanning and is inappropriate for sensitive critical infrastructure networks.
B is best because it targets only the known ports and uses a less aggressive identification method.

Single Sign-On (SSO) allows users to log in with a single ID and password to access multiple applications. It eliminates the need for different passwords for various internal applications, streamlining the authentication process.