CS0-003 practice questions 161–170

1. Question 161 · 527 in bank

   A security analyst receives an alert for suspicious activity on a company laptop. An excerpt of the log is shown below:

   

   Which of the following has most likely occurred?

   • AAn Office document with a malicious macro was opened.
   • BA credential-stealing website was visited.
   • CA phishing link in an email was clicked.
   • DA web browser vulnerability was exploited.

   Show answer

   Answer: A

   Explanation

   The sequence involving PowerShell and Microsoft Word (Event 5) strongly suggests the execution of a macro or script. This is a typical behavior of a malicious macro embedded in an Office document, which often uses PowerShell to perform further actions, such as downloading additional payloads or altering system settings.

   Source: Adapted from community discussion — Chiniwini

   Next question

2. Question 162 · 527 in bank

   During an incident, some IoCs of possible ransomware contamination were found in a group of servers in a segment of the network. Which of the following steps should be taken next?

   • AIsolation
   • BRemediation
   • CReimaging
   • DPreservation

   Show answer

   Answer: A

   Explanation

   Isolation: The immediate priority when dealing with ransomware (or potential ransomware) is to contain the threat to prevent it from spreading further within the network. Isolating the affected servers helps to stop the ransomware from propagating to other systems and limits the damage. This step involves disconnecting the infected servers from the network to halt communication and encryption activities.

   Source: Adapted from community discussion — Chiniwini

   Next question

3. Question 163 · 527 in bank

   An MSSP received several alerts from customer 1, which caused a missed incident response deadline for customer 2. Which of the following best describes the document that was violated?

   • AKPI
   • BSLO
   • CSLA
   • DMOU

   Show answer

   Answer: C

   Explanation

   SLA (Service Level Agreement): An SLA is a formal contract between a service provider (in this case, the MSSP) and a customer that outlines the expected level of service, including incident response times and deadlines. Missing an incident response deadline for customer 2 indicates a breach of the SLA, as it would have specified the response time commitments.

   Source: Adapted from community discussion — Chiniwini

   Next question

4. Question 164 · 527 in bank

   Which of the following is a reason proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response?

   • ATo ensure the report is legally acceptable in case it needs to be presented in court
   • BTo present a lessons-learned analysis for the incident response team
   • CTo ensure the evidence can be used in a postmortem analysis
   • DTo prevent the possible loss of a data source for further root cause analysis

   Show answer

   Answer: A

   Explanation

   Selected Answer: U Correct Answer: A. To ensure the report is legally acceptable in case it needs to be presented in court Analysis: The proper handling and reporting of evidence are crucial to ensure that the evidence is legally admissible if it needs to be presented in court. Adhering to strict procedures for evidence preservation, documentation, and chain of custody ensures that the evidence remains untampered and credible, which is vital in legal proceedings.

   Source: Adapted from community discussion — luiiizsoares

   Next question

5. Question 165 · 527 in bank

   An attacker has just gained access to the syslog server on a LAN. Reviewing the syslog entries has allowed the attacker to prioritize possible next targets. Which of the following is this an example of?

   • APassive network footprinting
   • BOS fingerprinting
   • CService port identification
   • DApplication versioning

   Show answer

   Answer: A

   Explanation

   Passive network footprinting: This involves gathering information about a network without directly interacting with the systems or networks being targeted. By reviewing syslog entries, the attacker is passively collecting information about network activity, system logs, and potentially identifying valuable targets without generating traffic that might alert defenders.

   Source: Adapted from community discussion — Chiniwini

   Next question

6. Question 166 · 527 in bank

   A security analyst observed the following activities in chronological order: 1. Protocol violation alerts on external firewall 2. Unauthorized internal scanning activity 3. Changes in outbound network performance Which of the following best describes the goal of the threat actor?

   • AData exfiltration
   • BUnusual traffic spikes
   • CRogue devices
   • DIrregular peer-to-peer communication

   Show answer

   Answer: A

   Explanation

   A. Data exfiltration Explanation: Protocol violation alerts on external firewall: This might indicate attempts to bypass security controls to establish a connection to an external location or to set up a covert channel. Unauthorized internal scanning activity: This suggests that the threat actor is mapping the network to find valuable data or vulnerable systems. Changes in outbound network performance: This could indicate large amounts of data being transferred out of the network, which is typical of data exfiltration activities. These steps collectively align with a threat actor's goal of identifying valuable data and then exfiltrating it out of the network, often while trying to remain undetected.

   Source: Adapted from community discussion — gomet2000

   Next question

7. Question 167 · 527 in bank

   After reviewing the final report for a penetration test, a cybersecurity analyst prioritizes the remediation for input validation vulnerabilities. Which of the following attacks is the analyst seeking to prevent?

   • ADNS poisoning
   • BPharming
   • CPhishing
   • DCross-site scripting

   Show answer

   Answer: D

   Explanation

   Cross-site scripting (XSS): This attack exploits input validation vulnerabilities. XSS allows attackers to inject malicious scripts into webpages viewed by other users. Proper input validation and sanitization of user inputs are essential to prevent XSS attacks.

   Source: Adapted from community discussion — Chiniwini

   Next question

8. Question 168 · 527 in bank

   A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

   • ACreate a timeline of events detailing the date stamps, user account hostname and IP information associated with the activities
   • BEnsure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation
   • CCreate a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation
   • DNotify the SOC manager for awareness after confirmation that the activity was intentional

   Show answer

   Answer: B

   Explanation

   Because we are dealing with privacy and HR B is the answer. However, A would be the actual investigation to be submitted, hostname and IP isn't really a privacy concern on an organizational network.

   Source: Adapted from community discussion — LifeElevated

   Next question

9. Question 169 · 527 in bank

   During a security test, a security analyst found a critical application with a buffer overflow vulnerability. Which of the following would be best to mitigate the vulnerability at the application level?

   • APerform OS hardening.
   • BImplement input validation.
   • CUpdate third-party dependencies.
   • DConfigure address space layout randomization.

   Show answer

   Answer: B

   Explanation

   Implement input validation: This is crucial for mitigating buffer overflow vulnerabilities. Input validation ensures that the data being input into the application does not exceed the buffer limits, preventing the overflow from occurring. Configure address space layout randomization (ASLR): ASLR is an effective mitigation technique to make exploitation of buffer overflow vulnerabilities more difficult, but it is a system-level mitigation rather than an application-level fix. To directly address and mitigate the buffer overflow vulnerability at the application level, B. Implement input validation is the best approach. This ensures that the application properly checks and controls the input data, thereby preventing buffer overflow conditions.

   Source: Adapted from community discussion — Chiniwini

   Next question

10. Question 170 · 527 in bank

    The SOC received a threat intelligence notification indicating that an employee’s credentials were found on the dark web. The user’s web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled. Which of the following should be done first to mitigate impact to the business networks and assets?

    • APerform a forced password reset.
    • BCommunicate the compromised credentials to the user.
    • CPerform an ad hoc AV scan on the user's laptop.
    • DReview and ensure privileges assigned to the user’s account reflect least privilege.
    • ELower the thresholds for SOC alerting of suspected malicious activity

    Show answer

    Answer: A

    Explanation

    Perform a forced password reset: This is the most immediate and effective action to ensure that the compromised credentials cannot be used. Even if MFA is enabled, resetting the password will render the stolen credentials useless, preventing potential unauthorized access. The primary goal is to prevent any unauthorized access using the compromised credentials. Performing a forced password reset immediately addresses this concern, making A. Perform a forced password reset the first and most critical action to take.

    Source: Adapted from community discussion — Chiniwini

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 161. 527 questions available.