CS0-003 practice questions 171–180

1. Question 171 · 527 in bank

   Select 2

   A security analyst is working on a server patch management policy that will allow the infrastructure team to be informed more quickly about new patches. Which of the following would most likely be required by the infrastructure team so that vulnerabilities can be remediated quickly? (Choose two.)

   • AHostname
   • BMissing KPI
   • CCVE details
   • DPOC availabilty
   • EIoCs
   • Fnpm identifier

   Show answer

   Answer: AC

   Explanation

   The question doesn't mention anything about deciding which patch should be prioritized, so POC availability doesn't seem relevant. Since the question asks, 'Which of the following would most likely be required by the infrastructure team so that vulnerabilities can be remediated quickly?' I believe the correct answers are Hostname and CVE details. The hostname tells the infrastructure team which host needs to be remediated, and the CVE provides information on how to fix the vulnerability. Without the hostname, they'd have to check all assets, which would slow things down.

   Source: Adapted from community discussion — whoamyou

   Next question

2. Question 172 · 527 in bank

   Chief Information Security Officer (CISO) wants to disable a functionality on a business-critical web application that is vulnerable to RCE in order to maintain the minimum risk level with minimal increased cost. Which of the following risk treatments best describes what the CISO is looking for?

   • ATransfer
   • BMitigate
   • CAccept
   • DAvoid

   Show answer

   Answer: B

   Explanation

   Mitigate involves taking steps to reduce the risk to an acceptable level. In this case, the CISO wants to disable a functionality that is vulnerable to Remote Code Execution (RCE) to reduce the risk associated with that vulnerability. Avoiding risk involves completely eliminating the risk by discontinuing the activity that introduces the risk. While disabling the functionality might seem like avoiding, in the context of risk management, avoiding would typically mean ceasing the use of the entire application or process, which is not the intent here.

   Source: Adapted from community discussion — CountVlad

   Next question

3. Question 173 · 527 in bank

   A company has a primary control in place to restrict access to a sensitive database. However, the company discovered an authentication vulnerability that could bypass this control. Which of the following is the best compensating control?

   • ARunning regular penetration tests to identify and address new vulnerabilities.
   • BConducting regular security awareness training of employees to prevent social engineering attacks.
   • CDeploying an additional layer of access controls to verify authorized individuals.
   • DImplementing intrusion detection software to alert security teams of unauthorized access attempts

   Show answer

   Answer: C

   Explanation

   C. Deploying an additional layer of access controls to verify authorized individuals: This directly addresses the authentication vulnerability by adding another layer of security. Examples include multi-factor authentication (MFA), additional identity verification steps, or implementing more stringent access control mechanisms. This would help ensure that even if the primary authentication mechanism is bypassed, the additional layer would prevent unauthorized access.

   Source: Adapted from community discussion — Chiniwini

   Next question

4. Question 174 · 527 in bank

   An analyst discovers unusual outbound connections to an IP that was previously blocked at the web proxy and firewall. Upon further investigation, it appears that the proxy and firewall rules that were in place were removed by a service account that is not recognized. Which of the following parts of the Cyber Kill Chain does this describe?

   • ADelivery
   • BCommand and control
   • CReconnaissance
   • DWeaponization

   Show answer

   Answer: B

   Explanation

   the proxy and firewall rules that were in place were removed by a service account. First keyword "Removing" is not part of gathering. Second, "Outbound traffic "It must have been done by C2C. Another

   Source: Adapted from community discussion — maggie22

   Next question

5. Question 175 · 527 in bank

   An organization's email account was compromised by a bad actor. Given the following information:

   

   Which of the following is the length of time the team took to detect the threat?

   • A25 minutes
   • B40 minutes
   • C45 minutes
   • D2 hours

   Show answer

   Answer: B

   Explanation

   The help desk's escalation at 8:55 a.m. was just an alert, not a formal recognition of the issue as an incident. The actual detection—when the organization officially recognized the situation as an incident—occurred at 9:10 a.m., when the CISO declared it an incident.

   Source: Adapted from community discussion — Eluis007

   Next question

6. Question 176 · 527 in bank

   A threat hunter seeks to identify new persistence mechanisms installed in an organization’s environment. In collecting scheduled tasks from all enterprise workstations, the following host details are aggregated:

   

   Which of the following actions should the hunter perform first based on the details above?

   • AAcquire a copy of taskhw.exe from the impacted host.
   • BScan the enterprise to identify other systems with taskhdw.exe present.
   • CPerform a public search for malware reports on the taskhw.exe.
   • DChange the account that runs the taskhw.exe scheduled task.

   Show answer

   Answer: A

   Explanation

   The fact that "UpdateService" is the only task running under a user account (PROD\sam) and located in a suspicious directory (C:\Users\sam\AppData\Roaming\Temp\taskhw.exe), the first action the hunter should perform is to acquire a copy of taskhw.exe from the impacted host. The first step should be to acquire a copy of taskhw.exe from the impacted host for analysis. This will allow the threat hunter to determine if the file is malicious and understand its behavior, which is crucial for planning further actions.

   Source: Adapted from community discussion — Chiniwini

   Next question

7. Question 177 · 527 in bank

   A SOC analyst is analyzing traffic on a network and notices an unauthorized scan. Which of the following types of activities is being observed?

   • APotential precursor to an attack
   • BUnauthorized peer-to-peer communication
   • CRogue device on the network
   • DSystem updates.

   Show answer

   Answer: A

   Explanation

   A. Potential precursor to an attack: Unauthorized network scans are often used by attackers to gather information about the network, such as identifying open ports, services, and vulnerabilities. This information can then be used to plan and execute an attack. The detection of an unauthorized scan is indicative of A. Potential precursor to an attack, as such scans are typically part of the reconnaissance phase in the cyber kill chain, used by attackers to identify potential targets and vulnerabilities within the network.

   Source: Adapted from community discussion — Chiniwini

   Next question

8. Question 178 · 527 in bank

   HOTSPOT - Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the help desk ticket queue. INSTRUCTIONS - Click on the ticket to see the ticket details. Additional content is available on tabs within the ticket. First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   High CPU Usage: Sometimes, wuauclt.exe may cause high CPU usage, which could slow down the system. This typically happens when the process is actively downloading or installing updates.

   Source: Adapted from community discussion — Wole_excel

   

   Next question

9. Question 179 · 527 in bank

   Which of the following is the first step that should be performed when establishing a disaster recovery plan?

   • AAgree on the goals and objectives of the plan
   • BDetermine the site to be used during a disaster
   • CDemonstrate adherence to a standard disaster recovery process
   • DIdentify applications to be run during a disaster

   Show answer

   Answer: A

   Explanation

   Yes, this holds true in marriage as well. If you and your partner have 0% goals and objectives together... TIME FOR DIVORCE!.... Oh sorry, I went off the rails here! :-)

   Source: Adapted from community discussion — dave_delete_me

   Next question

10. Question 180 · 527 in bank

    SIMULATION - A company recently experienced a security incident. The security team has determined a user clicked on a link embedded in a phishing email that was sent to the entire company. The link resulted in a malware download, which was subsequently installed and run. INSTRUCTIONS - Part 1 - Review the artifacts associated with the security Incident. Identify the name of the malware, the malicious IP address, and the date and time when the malware executable entered the organization. Part 2 - Review the kill chain items and select an appropriate control for each that would improve the security posture of the organization and would have helped to prevent this incident from occurring. Each control may only be used once, and not all controls will be used. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    I think this is correct except for the Malware Download should be Firewall File type filter: Phishing email: Email filtering Active links: Plain text email format Malicious website access: IP blocklist Malware download: Firewall File type filter Malware install: Restricted local user permissions Malware execution: Updated antivirus File encryption: Disk-level encryption

    Source: Adapted from community discussion — thisguyfucks

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 171. 527 questions available.