CS0-003 practice questions 151–160

1. Question 151 · 527 in bank

   A systems administrator notices unfamiliar directory names on a production server. The administrator reviews the directory listings and files, and then concludes the server has been compromised. Which of the following steps should the administrator take next?

   • AInform the internal incident response team.
   • BFollow the company's incident response plan.
   • CReview the lessons learned for the best approach.
   • DDetermine when the access started.

   Show answer

   Answer: B

   Explanation

   Gotta follow the plan, when stuck, CompTIA always want you to select "follow the plan". Even if following the plan means A, B is more correct because there may be a specific protocol for how it is communicated to the IRT.

   Source: Adapted from community discussion — kinny4000

   Next question

2. Question 152 · 527 in bank

   Which of the following is a nation-state actor least likely to be concerned with?

   • ADetection by MITRE ATT&CK framework.
   • BDetection or prevention of reconnaissance activities.
   • CExamination of its actions and objectives.
   • DForensic analysis for legal action of the actions taken.

   Show answer

   Answer: D

   Explanation

   Nation-state actors are often protected by their government's policies and diplomatic immunity, making them less worried about legal repercussions compared to other actors. Their primary concerns are usually focused on achieving their strategic objectives, avoiding detection, and maintaining operational security.

   Source: Adapted from community discussion — Todd69420

   Next question

3. Question 153 · 527 in bank

   Which of the following is a commonly used four-component framework to communicate threat actor behavior?

   • ASTRIDE
   • BDiamond Model of Intrusion Analysis
   • CCyber Kill Chain
   • DMITRE ATT&CK

   Show answer

   Answer: B

   Explanation

   The Diamond Model is a conceptual framework used in cyber security to analyze and understand cyber threats, intrusions, or attacks. It uses four key components: adversary, victim, infrastructure, and capability.

   Source: Adapted from community discussion — Gabuu

   Next question

4. Question 154 · 527 in bank

   An employee downloads a freeware program to change the desktop to the classic look of legacy Windows. Shortly after the employee installs the program, a high volume of random DNS queries begin to originate from the system. An investigation on the system reveals the following: Add-MpPreference –ExclusionPath ‘%Program Files%\ksyconfig’ Which of the following is possibly occurring?

   • APersistence
   • BPrivilege escalation
   • CCredential harvesting
   • DDefense evasion

   Show answer

   Answer: D

   Explanation

   Breakdown of the Command: Add-MpPreference: This is a cmdlet used in PowerShell to add or change preferences for Windows Defender settings. –ExclusionPath: This parameter specifies a path to exclude from scanning by Windows Defender. Files and directories located at the specified path will not be scanned for malware or other threats. ‘%Program Files%\ksyconfig’: This specifies the actual path to be excluded from scans. The %Program Files% is an environment variable that points to the Program Files directory, which is typically located at C:\Program Files on most Windows installations. The ksyconfig is presumably a folder within the Program Files directory. The answer is D, Defense Evasion.

   Source: Adapted from community discussion — lNSOMNiA

   Next question

5. Question 155 · 527 in bank

   An organization discovered a data breach that resulted in PII being released to the public. During the lessons learned review, the panel identified discrepancies regarding who was responsible for external reporting, as well as the timing requirements. Which of the following actions would best address the reporting issue?

   • ACreating a playbook denoting specific SLAs and containment actions per incident type
   • BResearching federal laws, regulatory compliance requirements, and organizational policies to document specific reporting SLAs
   • CDefining which security incidents require external notifications and incident reporting in addition to internal stakeholders
   • DDesignating specific roles and responsibilities within the security team and stakeholders to streamline tasks

   Show answer

   Answer: B

   Explanation

   The best approach to address the reporting issue in this scenario would be Option B: researching federal laws, regulatory compliance requirements, and organizational policies to document specific reporting Service Level Agreements (SLAs). By understanding the legal and regulatory landscape, the organization can establish clear guidelines for external reporting, ensuring timely and accurate notifications when incidents occur. This proactive approach helps prevent discrepancies and ensures compliance with reporting obligations.

   Source: Adapted from community discussion — LB54

   Next question

6. Question 156 · 527 in bank

   During an incident, a security analyst discovers a large amount of PII has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee’s personal email. Which of the following should the analyst recommend be done first?

   • APlace a legal hold on the employee’s mailbox.
   • BEnable filtering on the web proxy.
   • CDisable the public email access with CASB.
   • DConfigure a deny rule on the firewall.

   Show answer

   Answer: C

   Explanation

   recommending to place a legal hold on the employee's mailbox should be handled by legal or compliance departments rather than a security analyst. The security analyst's role would be more focused on identifying and containing the breach, gathering evidence, and analyzing the impact. Given the options, a more appropriate initial step would be to disable the public email access with CASB (Option C), as it would immediately prevent further data exfiltration and control the situation. This action helps to contain the breach and limit the exposure of sensitive data.

   Source: Adapted from community discussion — Jay2021aws

   Next question

7. Question 157 · 527 in bank

   A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment. Which of the following implications should be considered on the new hybrid environment?

   • AThe current scanners should be migrated to the cloud
   • BCloud-specific misconfigurations may not be detected by the current scanners
   • CExisting vulnerability scanners cannot scan IaaS systems
   • DVulnerability scans on cloud environments should be performed from the cloud

   Show answer

   Answer: B

   Explanation

   B) Cloud-specific misconfigurations If they move to an Azure or Google cloud, then Prowler, for example, wouldn't be able to scan for misconfigurations on those since it only works on AWS. Of the 4 choices, this one makes the most sense. See below for reference. From CompTIA Certmaster Topic 12B: Analyzing Cloud Vulnerabilities Prowler (github.com/toniblyx/prowler) is an audit tool for use with AWS only. It can detect misconfigurations and security issues, such as weak passwords, unpatched systems, and insecure protocol use. It can also be used to evaluate cloud infrastructure against the CIS Benchmarks™ for AWS (cisecurity.org/benchmark/amazon_web_services) and perform regulatory compliance checks.

   Source: Adapted from community discussion — [Removed]

   Next question

8. Question 158 · 527 in bank

   Which of the following can be used to learn more about TTPs used by cybercriminals?

   • AZenMAP
   • BMITRE ATT&CK
   • CNational Institute of Standards and Technology
   • DtheHarvester

   Show answer

   Answer: B

   Next question

9. Question 159 · 527 in bank

   Which of the following statements best describes the MITRE ATT&CK framework?

   • AIt provides a comprehensive method to test the security of applications.
   • BIt provides threat intelligence sharing and development of action and mitigation strategies.
   • CIt helps identify and stop enemy activity by highlighting the areas where an attacker functions.
   • DIt tracks and understands threats and is an open-source project that evolves.
   • EIt breaks down intrusions into a clearly defined sequence of phases.

   Show answer

   Answer: C

   Explanation

   Both C and D correctly describe key aspects of the MITRE ATT&CK framework. However, the most comprehensive description that captures the essence of the MITRE ATT&CK framework’s purpose and use is: C. It helps identify and stop enemy activity by highlighting the areas where an attacker functions.

   Source: Adapted from community discussion — Studybun

   Next question

10. Question 160 · 527 in bank

    A Chief Information Security Officer (CISO) is concerned that a specific threat actor who is known to target the company’s business type may be able to breach the network and remain inside of it for an extended period of time. Which of the following techniques should be performed to meet the CISO’s goals?

    • AVulnerability scanning
    • BAdversary emulation
    • CPassive discovery
    • DBug bounty

    Show answer

    Answer: B

    Explanation

    Adversary emulation involves simulating the tactics, techniques, and procedures (TTPs) of specific threat actors that are known to target an organization or its industry. By doing so, the organization can assess its ability to detect, respond to, and recover from a breach by these threat actors. This approach allows the security team to see how well the existing defenses work against realistic threats and to identify gaps where improvements are needed. This technique is particularly useful when the concern is not just about whether a breach can occur, but how long an attacker could remain undetected in the network, which aligns with the CISO's concern. The other options, while useful in different contexts, do not directly address the CISO's specific concern.

    Source: Adapted from community discussion — gomet2000

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 151. 527 questions available.