CompTIA CySA+ Prep Online

A NULL pointer dereference occurs when the program tries to use a pointer that has the value NULL (often represented as address 0x00000000) as if it pointed to valid memory. A crash report indicating a segmentation fault/access violation while reading address 0x00000000 is strong evidence of this condition and supports the risk of a service crash (DoS). The choice mentioning legacy TLS cipher suites describes a cryptographic configuration weakness, not a memory-safety crash. The choice about peak-time latency is consistent with performance or load issues without confirming a dereference. The choice about steadily increasing memory usage suggests a resource leak pattern rather than a specific dereference at a null address.

An incident timeline (timeline of events) records key incident milestones with timestamps, such as detection, escalation, containment actions, and response steps. Those timestamps allow you to calculate the duration from detection to the first response action. The choice mentioning an incident discovery log typically focuses on how and when the incident was first identified, not the full sequence of response actions. A security alerts summary is usually a listing of alerts and may not include correlated response timestamps. A threat intelligence record contains information about adversaries/indicators and is not intended to measure response timing.

Once the case is closed, required retention has elapsed, and there is no hold requiring preservation, keeping physical evidence longer than necessary increases risk (loss, theft, unauthorized access) and adds unnecessary storage/handling burden. The appropriate action is to securely sanitize or destroy the artifacts according to organizational policy and to record the disposition (closing out chain-of-custody and demonstrating proper handling). The choices describing moving to a backup location, performing annual reviews, or archiving indefinitely conflict with the stated condition that no further retention is required.