CS0-003 practice questions 11–20

1. Question 11 · 527 in bank

   A company is concerned with finding sensitive file storage locations that are open to the public. The current internal cloud network is flat. Which of the following is the best solution to secure the network?

   • AImplement segmentation with ACLs.
   • BConfigure logging and monitoring to the SIEM.
   • CDeploy MFA to cloud storage locations.
   • DRoll out an IDS.

   Show answer

   Answer: A

   Explanation

   Correct Segmentation involves dividing the network into smaller, isolated segments or zones. Access Control Lists (ACLs) are used to control which network traffic is allowed or denied between these segments. By implementing segmentation with ACLs, the company can effectively control the flow of traffic between different parts of the network, ensuring that sensitive file storage locations are isolated from public access and limiting the attack surface.

   Source: Adapted from community discussion — kmordalv

   Next question

2. Question 12 · 527 in bank

   A security analyst is reviewing the findings of the latest vulnerability report for a company’s web application. The web application accepts files for a Bash script to be processed if the files match a given hash. The analyst is able to submit files to the system due to a hash collision. Which of the following should the analyst suggest to mitigate the vulnerability with the fewest changes to the current script and infrastructure?

   • ADeploy a WAF to the front of the application.
   • BReplace the current MD5 with SHA-256.
   • CDeploy an antivirus application on the hosting system.
   • DReplace the MD5 with digital signatures.

   Show answer

   Answer: B

   Explanation

   Replacing MD5 with digital signatures is a significant change that involves implementing a different authentication mechanism, but with SHA-256 is more straightforward and effective solution to mitigate the vulnerability while minimizing disruption to the current system.

   Source: Adapted from community discussion — johnabayot

   Next question

3. Question 13 · 527 in bank

   An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first?

   • ACDN
   • BVulnerability scanner
   • CDNS
   • DWeb server

   Show answer

   Answer: C

   Explanation

   In the case of an internet outage caused by a Distributed Denial of Service (DDoS) attack that is preventing users from accessing external SaaS resources, the incident response team should review the DNS (Domain Name System) logs first. C. DNS Explanation: DNS Logs: DDoS attacks often involve overwhelming the DNS infrastructure to disrupt normal internet services. By reviewing DNS logs, the incident response team can identify abnormal traffic patterns, unusual queries, and potential signs of a DDoS attack targeting the organization's DNS servers. Analyzing DNS logs can help pinpoint the attack source, the type of attack, and the affected domains.

   Source: Adapted from community discussion — nmap_king_22

   Next question

4. Question 14 · 527 in bank

   A security analyst needs to mitigate a known, exploited vulnerability related to an attack vector that embeds software through the USB interface. Which of the following should the analyst do first?

   • AConduct security awareness training on the risks of using unknown and unencrypted USBs.
   • BWrite a removable media policy that explains that USBs cannot be connected to a company asset.
   • CCheck configurations to determine whether USB ports are enabled on company assets.
   • DReview logs to see whether this exploitable vulnerability has already impacted the company.

   Show answer

   Answer: C

   Explanation

   C) check configurations I agree with ITManager below. Can't find a needle that doesn't exist. Plus, the question says the analyst needs to mitigate (or reduce the risk) of the vulnerability. Checking to see if it has already been exploited (D) doesn't do anything to reduce the risk. It still exists whether the logs show it or not. To reduce the risk, you need to be proactive. C is the best option as it would allow you to disable USB ports if need be.

   Source: Adapted from community discussion — [Removed]

   Next question

5. Question 15 · 527 in bank

   A systems administrator receives reports of an internet-accessible Linux server that is running very sluggishly. The administrator examines the server, sees a high amount of memory utilization, and suspects a DoS attack related to half-open TCP sessions consuming memory. Which of the following tools would best help to prove whether this server was experiencing this behavior?

   • ANmap
   • BTCPDump
   • CSIEM
   • DEDR

   Show answer

   Answer: B

   Explanation

   Correct In this scenario, where the administrator suspects a DoS attack related to half-open TCP sessions consuming memory, TCPDump would be the best tool to use. It can help prove whether the server is experiencing this behavior by capturing and analyzing the network packets to identify patterns consistent with half-open TCP sessions.

   Source: Adapted from community discussion — kmordalv

   Next question

6. Question 16 · 527 in bank

   A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below:

   

   Which of the following vulnerability types is the security analyst validating?

   • ADirectory traversal
   • BXSS
   • CXXE
   • DSSRF

   Show answer

   Answer: C

   Explanation

   XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure, by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks.

   Source: Adapted from community discussion — kmordalv

   Next question

7. Question 17 · 527 in bank

   Which of the following is the most important factor to ensure accurate incident response reporting?

   • AA well-defined timeline of the events
   • BA guideline for regulatory reporting
   • CLogs from the impacted system
   • DA well-developed executive summary

   Show answer

   Answer: A

   Explanation

   Correct Although all of the options presented are important factors in ensuring accurate incident response reporting, but option A, is generally considered the most important factor. Having a detailed timeline of events allows incident responders to understand the sequence of actions, the duration of the incident, and the relationships between different actions. This helps in identifying the root cause of the incident, understanding its scope, and crafting an effective response strategy.

   Source: Adapted from community discussion — kmordalv

   Next question

8. Question 18 · 527 in bank

   A security analyst is trying to detect connections to a suspicious IP address by collecting the packet captures from the gateway. Which of the following commands should the security analyst consider running?

   • Agrep [IP address] packets.pcap
   • Bcat packets.pcap | grep [IP Address]
   • Ctcpdump -n -r packets.pcap host [IP address]
   • Dstrings packets.pcap | grep [IP Address]

   Show answer

   Answer: C

   Explanation

   The command tcpdump -n -r packets.pcap host [IP address] is used to read packets from a packet capture file (packets.pcap) and display only those packets that involve the specified IP address. Here's a breakdown of the command options: tcpdump: The command itself, which is used to capture and analyze network traffic. -n: This option instructs tcpdump to display IP addresses numerically (in dotted-decimal notation) rather than resolving them to hostnames. -r packets.pcap: Specifies the input file (packets.pcap) from which to read packets. host [IP address]: Specifies a filter expression to display packets involving the specified IP address.

   Source: Adapted from community discussion — glenndexter

   Next question

9. Question 19 · 527 in bank

   A security analyst reviews the latest vulnerability scans and observes there are vulnerabilities with similar CVSSv3 scores but different base score metrics. Which of the following attack vectors should the analyst remediate first?

   • ACVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
   • BCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
   • CCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
   • DCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

   Show answer

   Answer: C

   Explanation

   When reviewing vulnerabilities with similar CVSSv3 scores, it's essential to consider the attack vectors and the potential impact on the organization. Looking at all the values, the only one that changes is AV (Attack Vector). According to criticality, the order would be as follows: C, B, D, A The security analyst should focus more on an attack coming from the Network (C). The other options (A,B,D) require the vulnerability to be exploited within the internal network.

   Source: Adapted from community discussion — kmordalv

   Next question

10. Question 20 · 527 in bank

    Select 2

    A security analyst must review a suspicious email to determine its legitimacy. Which of the following should be performed? (Choose two.)

    • AEvaluate scoring fields, such as Spam Confidence Level and Bulk Complaint Level
    • BReview the headers from the forwarded email
    • CExamine the recipient address field
    • DReview the Content-Type header
    • EEvaluate the HELO or EHLO string of the connecting email server
    • FExamine the SPF, DKIM, and DMARC fields from the original email

    Show answer

    Answer: AF

    Explanation

    I think B is a bit of a trick as reviewing the "forwarded" email headers would not provide accurate details of the original path. (unless it is forwarded as an attachment with the original email)

    Source: Adapted from community discussion — greatsparta

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 11. 527 questions available.