High GPU utilization is the most likely indicator that cryptomining is occurring, as it reflects the intensive computational work that is required to solve the complex mathematical problems involved in mining cryptocurrencies. Cryptomining is the process of generating new units of a cryptocurrency by using computing power to verify transactions and create new blocks on the blockchain. Cryptomining can be done legitimately by individuals or groups who participate in a mining pool and share the rewards, or illegitimately by threat actors who use malware or scripts to hijack the computing resources of unsuspecting victims and use them for their own benefit. This practice is called cryptojacking, and it can cause performance degradation, increased power consumption, and security risks for the affected systems. Cryptomining typically relies on the GPU (graphics processing unit) rather than the CPU (central processing unit), as the GPU is better suited for parallel processing and can handle more calculations per second. Therefore, a high GPU utilization rate can be a sign that cryptomining is taking place on a system, especially if there is no other explanation for the increased workload. The other options are not as indicative of cryptomining as high GPU utilization, as they can have other causes or explanations. Bandwidth consumption can be affected by many factors, such as network traffic, streaming services, downloads, or updates. It is not directly related to cryptomining, which does not require a lot of bandwidth to communicate with the mining pool or the blockchain network.
Unauthorized changes can be a result of many types of malware or cyberattacks, such as ransomware, spyware, or trojans. They are not specific to cryptomining, which does not necessarily alter any files or settings on the system, but rather uses its processing power. Unusual traffic spikes can also be caused by various factors, such as legitimate surges in demand, distributed denial-of-service attacks, or botnets. They are not indicative of cryptomining, which does not generate a lot of traffic or requests to or from the system.

The shell script function that could help identify possible network addresses from different source networks belonging to the same company and region is:
function y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ".in-addr" '{print $1}').origin.asn.cymru.com TXT +short } This function takes an IP address as an argument and performs two DNS lookups using the dig command. The first lookup uses the -x option to perform a reverse DNS lookup and get the hostname associated with the IP address. The second lookup uses the origin.asn.cymru.com domain to get the autonomous system number (ASN) and other information related to the IP address, such as the country code, registry, or allocation date.
The function then prints the IP address and the ASN information, which can help identify any network addresses that belong to the same ASN or region

The question asks for the best technical method to protect sensitive data at an organizational level. Among the options, Data Loss Prevention (DLP) is explicitly a technical control category designed to prevent sensitive data leakage/exfiltration across the organization, especially at network boundaries (egress points) and via endpoints.
Why DLP (Option D) is best:
* DLP is built specifically to stop sensitive data from leaving where it should be contained (data exfiltration/leakage prevention) and can be applied broadly across the enterprise (network + endpoints).
The Sybex CySA+ Study Guide defines DLP this way:Exact extract (Sybex Study Guide): "DLP systems and software work to protect data from leaving the organization..."
* DLP is commonly implemented at network egress points (and also endpoints), which aligns directly with "egress and ingress" monitoring in the option wording. The Secbay Press guide reinforces this deployment model:Exact extract (Secbay Press): "Network DLP... Installed at network egress points near the perimeter"
* DLP is also a key technique to help detect/prevent data exfiltration, which is a major concern for sensitive data protection programs:Exact extract (All-in-One Exam Guide): "Implement DLP tools to detect and prevent sensitive data from being transferred outside the organization."
* Finally, DLP is explicitly part of the CS0-003 exam objectives under Sensitive data protection, making it the most "officially aligned" technical method in the answer choices:Exact extract (CompTIA CS0-
003 Objectives): "Sensitive data protection - Data loss prevention (DLP)" Why the other options are not "best":
* A (Block port 8080 / VLAN): Too narrow and mis-scoped. Port-based blocking doesn't reliably stop sensitive data movement (data could leave on 443/HTTPS, email, cloud apps, etc.). Also, "traffic on port 8080 with sensitive information" is not how traffic filtering is normally expressed and isn't an enterprise-wide sensitive data protection strategy.
* B (Python script for email PII): Helpful as a tactical control, but limited to email only, brittle to evasion
/encryption, and not an enterprise-wide standardized control like DLP. (Also corrected typo: "Pll" # PII.)
* C (Restrictive policy): A policy is an administrative/managerial control, not a technical method. The question explicitly asks for the best technical method.
References (CompTIA CySA+ CS0-003 documents / study guides used):
* CompTIA CySA+ CS0-003 Exam Objectives (v4.0): Sensitive data protection includes DLP
* Mike Chapple & David Seidl, CompTIA CySA+ Study Guide (CS0-003): DLP "protect[s] data from leaving the organization..."
* Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): Network DLP at egress points
* Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): DLP helps "detect and prevent sensitive data" transfer outside

A nation-state actor is a group or individual that conducts cyberattacks on behalf of a government or a political entity. They are usually motivated by national interests, such as espionage, sabotage, or influence operations. They are often highly skilled, resourced, and persistent, and they operate with the protection or support of their state sponsors. Therefore, they are less likely to be concerned with the forensic analysis for legal action of their actions, as they are unlikely to face prosecution or extradition in their own country or by international law. They are more likely to be concerned with the detection by the MITRE ATT&CK framework, which is a knowledge base of adversary tactics and techniques based on real-world observations.
The MITRE ATT&CK framework can help defenders identify, prevent, and respond to cyberattacks by nation-state actors. They are also likely to be concerned with the detection or prevention of reconnaissance activities, which are the preliminary steps of cyberattacks that involve gathering information about the target, such as vulnerabilities, network topology, or user credentials. Reconnaissance activities can expose the presence, intent, and capabilities of the attackers, and allow defenders to take countermeasures. Finally, they are likely to be concerned with the examination of their actions and objectives, which can reveal their motives, strategies, and goals, and help defenders understand their threat profile and attribution.
References:
* 1: MITRE ATT&CK
* 2: What is the MITRE ATT&CK Framework? | IBM
* 3: MITRE ATT&CK | MITRE
* 4: Cyber Forensics Explained: Reasons, Phases & Challenges of Cyber Forensics | Splunk
* 5: Digital Forensics: How to Identify the Cause of a Cyber Attack - G2

* SOAR (Security Orchestration, Automation, and Response) platforms help automate and orchestrate incident response tasks, including phishing triage.
* SOAR reduces triage time by automatically:
* Parsing phishing emails (checking headers, links, attachments).
* Running automated playbooks to check for known malicious indicators.
* Escalating real threats while dismissing false positives.
Why Not Other Options?
* B (Increase security awareness) # Helps prevent phishing but does NOT reduce triage time.
* C (Implement EDR) # EDR is useful for endpoint protection but does NOT specifically reduce phishing triage time.
* D (Install a "Report Phishing" button) # Helps report phishing but does NOT automate the triage process.
Reference: CompTIA CySA+ CS0-003, Chapter 7: "Security Operations and Automation," Section: "SOAR and Incident Response Efficiency"