CS0-003 practice questions 91–100

1. Question 91 · 527 in bank

   A SOC manager is establishing a reporting process to manage vulnerabilities. Which of the following would be the best solution to identify potential loss incurred by an issue?

   • ATrends
   • BRisk score
   • CMitigation
   • DPrioritization

   Show answer

   Answer: B

   Explanation

   B. Risk score A risk score is a numerical value assigned to a vulnerability that represents its potential impact and likelihood of exploitation. By using risk scores, the SOC manager can prioritize vulnerabilities based on the potential loss they could cause. This approach helps in focusing resources on addressing the most critical vulnerabilities first, thereby reducing the overall risk to the organization.

   Source: Adapted from community discussion — Nishaw

   Next question

2. Question 92 · 527 in bank

   While configuring a SIEM for an organization, a security analyst is having difficulty correlating incidents across different systems. Which of the following should be checked first?

   • AIf appropriate logging levels are set
   • BNTP configuration on each system
   • CBehavioral correlation settings
   • DData normalization rules

   Show answer

   Answer: B

   Explanation

   NTP configuration is critical because even if data is normalized, if the timestamps between systems are out of sync, correlation won't work properly. Most SIEM tools rely heavily on accurate timestamps to tie events together, so time synchronization is often checked first.

   Source: Adapted from community discussion — cy_analyst

   Next question

3. Question 93 · 527 in bank

   During a scan of a web server in the perimeter network, a vulnerability was identified that could be exploited over port 3389. The web server is protected by a WAF. Which of the following best represents the change to overall risk associated with this vulnerability?

   • AThe risk would not change because network firewalls are in use
   • BThe risk would decrease because RDP is blocked by the firewall
   • CThe risk would decrease because a web application firewall is in place
   • DThe risk would increase because the host is external facing

   Show answer

   Answer: D

   Explanation

   Port 3389 is used for Remote Desktop Protocol (RDP), which isn't typically something a Web Application Firewall (WAF) would protect against. A WAF primarily filters and monitors HTTP/HTTPS traffic, and RDP doesn't fall into this category. The fact that the host is external facing and the vulnerability is over an exposed service (like RDP) increases the overall risk because it could potentially be exploited from the internet. While firewalls might block RDP access, the mere presence of the vulnerability on an external-facing server increases risk, especially if the firewall rules or protections could be bypassed or misconfigured.

   Source: Adapted from community discussion — cy_analyst

   Next question

4. Question 94 · 527 in bank

   Select 2

   Several vulnerability scan reports have indicated runtime errors as the code is executing. The dashboard that lists the errors has a command-line interface for developers to check for vulnerabilities. Which of the following will enable a developer to correct this issue? (Choose two.)

   • APerforming dynamic application security testing
   • BReviewing the code
   • CFuzzing the application
   • DDebugging the code
   • EImplementing a coding standard
   • FImplementing IDS

   Show answer

   Answer: BD

   Explanation

   DAST tools typically do not assist in identifying and resolving runtime errors within the code. Instead, they focus on testing the application's behavior from the outside, by interacting with its interfaces and observing how it responds to various inputs.

   Source: Adapted from community discussion — Brick69

   Next question

5. Question 95 · 527 in bank

   A security analyst is trying to validate the results of a web application scan with Burp Suite. The security analyst performs the following:

   

   Which of the following vulnerabilities is the security analyst trying to validate?

   • ASQL injection
   • BLFI
   • CXSS
   • DCSRF

   Show answer

   Answer: B

   Next question

6. Question 96 · 527 in bank

   A cybersecurity team has witnessed numerous vulnerability events recently that have affected operating systems. The team decides to implement host-based IPS, firewalls and two-factor authentication. Which of the following does this most likely describe?

   • ASystem hardening
   • BHybrid network architecture
   • CContinuous authorization
   • DSecure access service edge

   Show answer

   Answer: A

   Explanation

   A. System Hardening System hardening enhances the security of an operating system, application, device, or service by reducing its attack surface. Hardening involves enabling or disabling specific features and restricting access to sensitive areas of the system, such as protected operating system files, windows registry, configuration files, and logs. Hardening includes disabling unnecessary services, limiting user privileges, patching the operating system, and many other changes. Best-practice hardening configurations can be very complex. Examples of best-practice hardening guides include DoD STIGs (https://public.cyber.mil/stigs/) and CIS Benchmarks™ (https://www.cisecurity.org/cis-benchmarks/). Version 1.0.0 of the CIS Microsoft Windows 11 Enterprise Benchmark contains over 1,200 pages of recommendations.

   Source: Adapted from community discussion — Kmelaun

   Next question

7. Question 97 · 527 in bank

   A security analyst needs to secure digital evidence related to an incident. The security analyst must ensure that the accuracy of the data cannot be repudiated. Which of the following should be implemented?

   • AOffline storage
   • BEvidence collection
   • CIntegrity validation
   • DLegal hold

   Show answer

   Answer: C

   Explanation

   Integrity validation ensures that your data hasn’t undergone any unauthorized alterations during transmission or storage. Think of it as a seal on an envelope; any attempt to tamper with the contents would break the seal, signaling interference.

   Source: Adapted from community discussion — jspecht

   Next question

8. Question 98 · 527 in bank

   An analyst investigated a website and produced the following:

   

   Which of the following syntaxes did the analyst use to discover the application versions on this vulnerable website?

   • Anmap -sS -T4 -F insecure.org
   • Bnmap -C insecure.org
   • Cnmap -sV -T4 -F insecure.org
   • Dnmap -A insecure.org

   Show answer

   Answer: C

   Explanation

   This command instructs Nmap to perform a fast scan (-F) with version detection (-sV) using an aggressive timing template (-T4) against the target insecure.org.

   Source: Adapted from community discussion — glenndexter

   Next question

9. Question 99 · 527 in bank

   A cybersecurity analyst is doing triage in a SIEM and notices that the time stamps between the firewall and the host under investigation are off by 43 minutes. Which of the following is the most likely scenario occurring with the time stamps?

   • AThe NTP server is not configured on the host
   • BThe cybersecurity analyst is looking at the wrong information
   • CThe firewall is using UTC time
   • DThe host with the logs is offline

   Show answer

   Answer: A

   Explanation

   I would imagine that if the problem was with UTC time, then the logs would be asynchronised in intervals of 30 minutes or full hours, depending on which time zones are involved. This should be NTC issue in my opinion.

   Source: Adapted from community discussion — FT000

   Next question

10. Question 100 · 527 in bank

    A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

    • AScan the employee's computer with virus and malware tools
    • BReview the actions taken by the employee and the email related to the event
    • CContact human resources and recommend the termination of the employee
    • DAssign security awareness training to the employee involved in the incident

    Show answer

    Answer: B

    Explanation

    There's no indication malware was involved here so no need to scan anything. Decisions about termination or training can be made after the facts of the incident are fully understood. The only reasonable answer here is B.

    Source: Adapted from community discussion — jspecht

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 91. 527 questions available.