CS0-003 practice questions 131–140

1. Question 131 · 527 in bank

   A company has decided to expose several systems to the internet. The systems are currently available internally only. A security analyst is using a subset of CVSS3.1 exploitability metrics to prioritize the vulnerabilities that would be the most exploitable when the systems are exposed to the internet. The systems and the vulnerabilities are shown below:

   

   Which of the following systems should be prioritized for patching?

   • Abrown
   • Bgrey
   • Cblane
   • Dsullivan

   Show answer

   Answer: C

   Explanation

   For internet facing systems, the most vulnerable are those who have attach vectors which are on the network (AV/N), have low complexity (AC/L) and have high impact on CIA (A/H). Option C, blane ticks all the 3 boxes and hence is most vulnerable and needs to be prioritised for patching

   Source: Adapted from community discussion — FT000

   Next question

2. Question 132 · 527 in bank

   During an incident in which a user machine was compromised, an analyst recovered a binary file that potentially caused the exploitation. Which of the following techniques could be used for further analysis?

   • AFuzzing
   • BStatic analysis
   • CSandboxing
   • DPacket capture

   Show answer

   Answer: C

   Explanation

   For analyzing a recovered binary file to understand its behavior and potential malicious actions, the following techniques are most appropriate: B. Static analysis - This involves examining the binary file without executing it. Analysts can disassemble the code to study its structure and identify any malicious patterns or functions. C. Sandboxing - This involves executing the binary in a controlled and isolated environment to observe its behavior without risking damage to actual systems. This can help in understanding what actions the binary performs, such as connecting to external servers, modifying files, or other potentially harmful activities. Because the word "controlled environment" wasn't used I'd go with "Static Analysis" ComPTIA needs to do a better job in writing quality questions, looks like the questions are written by some 5th grades kids.

   Source: Adapted from community discussion — Omo_Mushin

   Next question

3. Question 133 · 527 in bank

   A leader on the vulnerability management team is trying to reduce the team's workload by automating some simple but time-consuming tasks. Which of the following activities should the team leader consider first?

   • AAssigning a custom recommendation for each finding
   • BAnalyzing false positives
   • CRendering an additional executive report
   • DRegularly checking agent communication with the central console

   Show answer

   Answer: D

   Explanation

   Given the goal of reducing workload through automation, the team leader should prioritize tasks that are repetitive and time-consuming. Option D, "Regularly checking agent communication with the central console," is the most suitable choice for automation. This task involves monitoring and ensuring that all agents are communicating properly with the central console, which can be automated through scripts or monitoring tools, freeing up human resources for more critical tasks. Options A, B, and C may also benefit from automation eventually, but they involve more nuanced decision-making and may require human judgment, making them less suitable for immediate automation to reduce workload.

   Source: Adapted from community discussion — Dub3

   Next question

4. Question 134 · 527 in bank

   The Chief Information Security Officer (CISO) of a large management firm has selected a cybersecurity framework that will help the organization demonstrate its investment in tools and systems to protect its data. Which of the following did the CISO most likely select?

   • APCI DSS
   • BCOBIT
   • CISO 27001
   • DITIL

   Show answer

   Answer: C

   Explanation

   The cybersecurity framework most likely selected by the Chief Information Security Officer (CISO) of a large management firm to demonstrate the organization's investment in tools and systems to protect its data is: C. ISO 27001. ISO 27001 is an internationally recognized standard for information security management systems (ISMS). It provides a systematic approach to managing sensitive company information, ensuring its confidentiality, integrity, and availability. ISO 27001 certification demonstrates an organization's commitment to implementing and maintaining robust information security practices, including the selection and deployment of appropriate tools and systems to protect data.

   Source: Adapted from community discussion — glenndexter

   Next question

5. Question 135 · 527 in bank

   An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to?

   • APCI Security Standards Council
   • BLocal law enforcement
   • CFederal law enforcement
   • DCard issuer

   Show answer

   Answer: D

   Explanation

   Correct. First to the card issuer. Under the terms of PCI DSS, an organization that has experienced a breach of customer transactions should report the breach to the card issuer. The card issuer is responsible for authorizing and processing the transactions. The card issuer may have specific reporting requirements and procedures for the organization to follow in the event of a breach.

   Source: Adapted from community discussion — kmordalv

   Next question

6. Question 136 · 527 in bank

   A high volume of failed RDP authentication attempts was logged on a critical server within a one-hour period. All of the attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following would be the most effective mitigating control to reduce the rate of success of this brute-force attack?

   • AEnabling a user account lockout after a limited number of failed attempts
   • BInstalling a third-party remote access tool and disabling RDP on all devices
   • CImplementing a firewall block for the remote system's IP address
   • DIncreasing the verbosity of log-on event auditing on all devices

   Show answer

   Answer: A

   Explanation

   Locking down a administrator account especially if it's a production account can be disruptive, I don't like the options CompTIA gives here. A better answer would be to setup whitelisting from specific IP addresses. Locking the account due to many failed attemps can cause A LOT of problems. What is stopping the attacker from doing it again? Blocking them IP address here, would make the most real world practical sense as it does not affect production. But they can easily switch IP addresses, so that's why I think setting up whitelisting would be a better option, or even setting up rate limiting or requiring MFA are better options too. I'm gonna go with A, but I don't really agree with either of these answers.

   Source: Adapted from community discussion — badgerino

   Next question

7. Question 137 · 527 in bank

   Select 2

   An incident response analyst is investigating the root cause of a recent malware outbreak. Initial binary analysis indicates that this malware disables host security services and performs cleanup routines on its infected hosts, including deletion of initial dropper and removal of event log entries and prefetch files from the host. Which of the following data sources would most likely reveal evidence of the root cause? (Choose two.)

   • ACreation time of dropper
   • BRegistry artifacts
   • CEDR data
   • DPrefetch files
   • EFile system metadata
   • FSysmon event log

   Show answer

   Answer: BE

   Explanation

   The question says that the Malware would disables any host security services (which is C. EDR) and performs clean-up routines on it's affected host in eluding deletion of initial dropper (A.Creation time of dropper) and removal of event log entries (F.Sysmon event log) and prefetch files from the host (D.Prefetch files). So wouldn't the only left be B.Registry artifacts and E. File System metadata?

   Source: Adapted from community discussion — Kmelaun

   Next question

8. Question 138 · 527 in bank

   When undertaking a cloud migration of multiple SaaS applications, an organization's systems administrators struggled with the complexity of extending identity and access management to cloud-based assets. Which of the following service models would have reduced the complexity of this project?

   • ACASB
   • BSASE
   • CZTNA
   • DSWG

   Show answer

   Answer: A

   Explanation

   The correct answer is A. CASB (Cloud Access Security Broker). Here’s why: A CASB is a software or hardware program that sits between users and a cloud service to enforce security policies around cloud-based resources. CASBs help enterprises spot unusual or malicious activity and better manage cloud access with deep visibility and granular control. It ensures organizations have comprehensive visibility of their network and protects their cloud applications against security threats. It also helps businesses reduce workloads and the complexity of their IT, which is crucial as employees use personal devices to access corporate networks from new locations.

   Source: Adapted from community discussion — RiccardoBellitto

   Next question

9. Question 139 · 527 in bank

   A security analyst reviews the following extract of a vulnerability scan that was performed against the web server:

   

   Which of the following recommendations should the security analyst provide to harden the web server?

   • ARemove the version information on http-server-header.
   • BDisable tcp_wrappers.
   • CDelete the /wp-login.php folder.
   • DClose port 22.

   Show answer

   Answer: A

   Explanation

   In general, removing version information from HTTP headers is a best practice for hardening web servers and improving overall security.

   Source: Adapted from community discussion — Jay2021aws

   Next question

10. Question 140 · 527 in bank

    A security analyst is responding to an incident that involves a malicious attack on a network data closet. Which of the following best explains how the analyst should properly document the incident?

    • ABack up the configuration file for all network devices.
    • BRecord and validate each connection.
    • CCreate a full diagram of the network infrastructure.
    • DTake photos of the impacted items.

    Show answer

    Answer: D

    Explanation

    I understand the confusion. They are talking about network and malicious attack, so we assume it is logical. However. it is mentioned that Network data closet (a physical room in a building) was maliciously attacked. I.e., cables ripped, hardware devised snatched or broken. This is a physical attack that happened to a network data room. Pictures can be taken with a camera for investigation. Hope this helps.

    Source: Adapted from community discussion — Instguy

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 131. 527 questions available.