CS0-003 practice questions 141–150

1. Question 141 · 527 in bank

   A cybersecurity analyst is participating with the DLP project team to classify the organization's data. Which of the following is the primary purpose for classifying data?

   • ATo identify regulatory compliance requirements
   • BTo facilitate the creation of DLP rules
   • CTo prioritize IT expenses
   • DTo establish the value of data to the organization

   Show answer

   Answer: D

   Explanation

   I did my research thoroughly and the answer is without a doubt D. Both for knowledge sake and common sense. This question is also on CISSP Practice questions as well where D is the only option that is the same (Comptia). We can't create rules or look into regulations unless we know the crown jewels and other minor data. 1. Understand your sensitive data 2. Create rules to control and protect 3. Check to ensure regulatory compliance of what you've put place (best way to do this sometimes is an audit) You can't do 1 and 2 without knowing the TYPE of data you have.

   Source: Adapted from community discussion — Freshly

   Next question

2. Question 142 · 527 in bank

   A security analyst observed the following activity from a privileged account: • Accessing emails and sensitive information • Audit logs being modified • Abnormal log-in times Which of the following best describes the observed activity?

   • AIrregular peer-to-peer communication
   • BUnauthorized privileges
   • CRogue devices on the network
   • DInsider attack

   Show answer

   Answer: D

   Explanation

   The observed activity from a privileged account, which includes accessing emails and sensitive information, modifying audit logs, and abnormal login times, best fits the description of: D. Insider attack. An insider attack occurs when a person with authorized access to an organization's systems and data misuses that access for malicious purposes. In this scenario, the activity observed suggests that a privileged insider, who has access to sensitive information and has the ability to modify audit logs, is engaging in unauthorized and potentially malicious actions. The abnormal login times further indicate suspicious behavior associated with the privileged account.

   Source: Adapted from community discussion — glenndexter

   Next question

3. Question 143 · 527 in bank

   A vulnerability management team found four major vulnerabilities during an assessment and needs to provide a report for the proper prioritization for further mitigation. Which of the following vulnerabilities should have the highest priority for the mitigation process?

   • AA vulnerability that has related threats and IoCs, targeting a different industry
   • BA vulnerability that is related to a specific adversary campaign, with IoCs found in the SIEM
   • CA vulnerability that has no adversaries using it or associated IoCs
   • DA vulnerability that is related to an isolated system, with no IoCs

   Show answer

   Answer: B

   Next question

4. Question 144 · 527 in bank

   Select 2

   A security analyst received an alert regarding multiple successful MFA log-ins for a particular user. When reviewing the authentication logs, the analyst sees the following:

   

   Which of the following are most likely occurring, base on the MFA logs? (Choose two.)

   • ADictionary attack
   • BPush phishing
   • CImpossible geo-velocity
   • DSubscriber identity module swapping
   • ERogue access point
   • FPassword spray

   Show answer

   Answer: BC

   Explanation

   Based on the MFA logs provided in the image, the most likely occurrences are: C. Impossible geo-velocity: The logs show logins from geographically distant locations (United States and Russia) within a short time frame, which is not physically possible. B. Push phishing: Multiple successful MFA log-ins suggest that someone might be tricking the user into approving authentication requests. Push phishing is a better option because it aligns more closely with the observed pattern of multiple successful MFA log-ins from different locations, suggesting the user might be unknowingly approving fraudulent requests. SIM swapping would not account for the impossible geo-velocity observed in the logs.

   Source: Adapted from community discussion — LB54

   Next question

5. Question 145 · 527 in bank

   A security analyst has identified a new malware file that has impacted the organization. The malware is polymorphic and has built-in conditional triggers that require a connection to the internet. The CPU has an idle process of at least 70%. Which of the following best describes how the security analyst can effectively review the malware without compromising the organization’s network?

   • AUtilize an RDP session on an unused workstation to evaluate the malware.
   • BDisconnect and utilize an existing infected asset off the network.
   • CCreate a virtual host for testing on the security analyst workstation.
   • DSubscribe to an online service to create a sandbox environment.

   Show answer

   Answer: D

   Explanation

   A sandbox environment is a secure, isolated virtual space where untrusted programs can be run safely. It prevents the malware from interacting with the host system or network, thereby protecting the organization’s network from potential harm. This is particularly important when dealing with polymorphic malware, which can change its code to evade detection, and malware that requires an internet connection, as it may communicate with an external server or download additional malicious components.

   Source: Adapted from community discussion — kitkat007

   Next question

6. Question 146 · 527 in bank

   Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

   • AMean time to detect
   • BNumber of exploits by tactic
   • CAlert volume
   • DQuantity of intrusion attempts

   Show answer

   Answer: A

   Explanation

   A. Mean time to detect (MTTD) is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system. MTTD is a metric that measures how long it takes to detect a security incident or threat from the time it occurs

   Source: Adapted from community discussion — eapau6022

   Next question

7. Question 147 · 527 in bank

   Which of the following threat-modeling procedures is in the OWASP Web Security Testing Guide?

   • AReview of security requirements
   • BCompliance checks
   • CDecomposing the application
   • DSecurity by design

   Show answer

   Answer: C

   Explanation

   Broadly speaking, the process of threat modeling involves five essential steps Identify and define security objectives Analyze and decompose the application Identify and rank potential threats Establish countermeasures and mitigation strategies Generate a comprehensive threat modeling repor

   Source: Adapted from community discussion — Mataria

   Next question

8. Question 148 · 527 in bank

   Which of the following would an organization use to develop a business continuity plan?

   • AA diagram of all systems and interdependent applications
   • BA repository for all the software used by the organization
   • CA prioritized list of critical systems defined by executive leadership
   • DA configuration management database in print at an off-site location

   Show answer

   Answer: C

   Next question

9. Question 149 · 527 in bank

   The management team requests monthly KPI reports on the company’s cybersecurity program. Which of the following KPIs would identify how long a security threat goes unnoticed in the environment?

   • AEmployee turnover
   • BIntrusion attempts
   • CMean time to detect
   • DLevel of preparedness

   Show answer

   Answer: C

   Next question

10. Question 150 · 527 in bank

    Which of the following best describes the key elements of a successful information security program?

    • ABusiness impact analysis, asset and change management, and security communication plan
    • BSecurity policy implementation, assignment of roles and responsibilities, and information asset classification
    • CDisaster recovery and business continuity planning, and the definition of access control requirements and human resource policies
    • DSenior management organizational structure, message distribution standards, and procedures for the operation of security management systems

    Show answer

    Answer: B

    Explanation

    Security policy implementation, assignment of roles and responsibilities, and information asset classification: This option covers essential aspects of a successful information security program: Security policy implementation: Establishes the rules and guidelines for maintaining security within the organization. Assignment of roles and responsibilities: Ensures that there is clear accountability and ownership of security tasks and processes. Information asset classification: Identifies and categorizes information assets to apply appropriate levels of protection based on their value and sensitivity.

    Source: Adapted from community discussion — Chiniwini

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 141. 527 questions available.