CS0-003 practice questions 211–220

1. Question 211 · 527 in bank

   While reviewing the web server logs, a security analyst notices the following snippet: ..\../..\../boot.ini Which of the following is being attempted?

   • ADirectory traversal
   • BRemote file inclusion
   • CCross-site scripting
   • DRemote code execution
   • EEnumeration of /etc/passwd

   Show answer

   Answer: A

   Explanation

   This is a clear attempt at A. Directory traversal. Directory traversal is an attack technique where an attacker tries to access files and directories outside the intended scope by manipulating URL paths or file paths. In this case, the attacker is trying to access the boot.ini file, which is typically located in the root directory of a Windows system.

   Source: Adapted from community discussion — ChopSNap

   Next question

2. Question 212 · 527 in bank

   A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes what the security program did?

   • AData enrichment
   • BSecurity control plane
   • CThreat feed combination
   • DSingle pane of glass

   Show answer

   Answer: D

   Explanation

   CompTIA Certmaster Topic 4B: Understanding Technology for Security Operations Single pane of glass is a term used to describe a unified view of a computer network or system. It is a graphical user interface that allows network administrators to manage their entire network from one place. The user interface can include monitoring, configuration, and control of the network, its components, and related services (1/2)

   Source: Adapted from community discussion — [Removed]

   Next question

3. Question 213 · 527 in bank

   Exploit code for a recently disclosed critical software vulnerability was publicly available for download for several days before being removed. Which of the following CVSS v.3.1 temporal metrics was most impacted by this exposure?

   • ARemediation level
   • BExploit code maturity
   • CReport confidence
   • DAvailability

   Show answer

   Answer: B

   Explanation

   The CVSS v.3.1 temporal metric most impacted by the early public availability of exploit code is B. Exploit Code Maturity. This metric measures the extent to which exploit code is available and functional. Early public availability of exploit code significantly increases the maturity of the exploit, making it easier for attackers to exploit the vulnerability.

   Source: Adapted from community discussion — ChopSNap

   Next question

4. Question 214 · 527 in bank

   Which of the following in the digital forensics process is considered a critical activity that often includes a graphical representation of process and operating system events?

   • ARegistry editing
   • BNetwork mapping
   • CTimeline analysis
   • DWrite blocking

   Show answer

   Answer: C

   Explanation

   The correct answer is C. Timeline analysis. Explanation: In digital forensics, timeline analysis is a critical activity that involves reconstructing the sequence of events based on data from various sources, such as system logs, timestamps, file metadata, and other artifacts. The purpose of timeline analysis is to establish when specific actions occurred, often to understand the sequence of events leading up to or following an incident. This process often includes a graphical representation (e.g., a timeline or event chart) that visually displays the chronological order of system events and activities, making it easier to correlate and analyze data

   Source: Adapted from community discussion — ChopSNap

   Next question

5. Question 215 · 527 in bank

   Which of the following best describes the importance of KPIs in an incident response exercise?

   • ATo identify the personal performance of each analyst
   • BTo describe how incidents were resolved
   • CTo reveal what the team needs to prioritize
   • DTo expose which tools should be used

   Show answer

   Answer: C

   Explanation

   The correct answer is C. To reveal what the team needs to prioritize. KPIs (Key Performance Indicators) in an incident response exercise help identify areas where the team can improve. By analyzing the performance metrics, the team can determine which areas need more focus, such as: Detection time: How quickly incidents are detected Response time: How quickly the team responds to incidents Incident resolution time: How long it takes to resolve incidents Effectiveness of containment: How well the team can contain the impact of incidents Accuracy of root cause analysis: How accurately the team can identify the root cause of incidents

   Source: Adapted from community discussion — ChopSNap

   Next question

6. Question 216 · 527 in bank

   An organization is conducting a pilot deployment of an e-commerce application. The application’s source code is not available. Which of the following strategies should an analyst recommend to evaluate the security of the software?

   • AStatic testing
   • BVulnerability testing
   • CDynamic testing
   • DPenetration testing

   Show answer

   Answer: C

   Explanation

   Correct Answer: C. Dynamic testing Analysis: Given that the application's source code is not available, dynamic testing is an appropriate method to evaluate the security of the software. Dynamic testing involves analyzing the application by executing it and observing its behavior during runtime, which allows for the identification of security vulnerabilities that may not be evident through code inspection alone.

   Source: Adapted from community discussion — luiiizsoares

   Next question

7. Question 217 · 527 in bank

   A security team needs to demonstrate how prepared the team is in the event of a cyberattack. Which of the following would best demonstrate a real-world incident without impacting operations?

   • AReview lessons-learned documentation and create a playbook.
   • BGather all internal incident response party members and perform a simulation.
   • CDeploy known malware and document the remediation process.
   • DSchedule a system recovery to the DR site for a few applications.

   Show answer

   Answer: B

   Explanation

   B. Gather all internal incident response party members and perform a simulation. A simulation exercise is the best way to test the team's preparedness and response capabilities in a controlled environment. It allows the team to practice: Communication and coordination: How well team members work together Incident handling procedures: Following established protocols Decision-making: Making timely and effective decisions under pressure Tool usage: Effectively utilizing security tools and technologies Incident documentation: Recording actions and lessons learned

   Source: Adapted from community discussion — ChopSNap

   Next question

8. Question 218 · 527 in bank

   A SOC receives several alerts indicating user accounts are connecting to the company’s identity provider through non-secure communications. User credentials for accessing sensitive, business-critical systems could be exposed. Which of the following logs should the SOC use when determining malicious intent?

   • ADNS
   • Btcpdump
   • CDirectory
   • DIDS

   Show answer

   Answer: B

   Explanation

   tcpdump. The keyword is "non-secured communication". tcpdump allows you to analyze the "malicious intent" over a "non-secured communication" as the traffic is readable.

   Source: Adapted from community discussion — linkmonkey239

   Next question

9. Question 219 · 527 in bank

   A vulnerability scan of a web server that is exposed to the internet was recently completed. A security analyst is reviewing the resulting vector strings:

   

   Which of the following vulnerabilities should be patched first?

   • AVulnerability 1
   • BVulnerability 2
   • CVulnerability 3
   • DVulnerability 4

   Show answer

   Answer: A

   Next question

10. Question 220 · 527 in bank

    Each time a vulnerability assessment team shares the regular report with other teams, inconsistencies regarding versions and patches in the existing infrastructure are discovered. Which of the following is the best solution to decrease the inconsistencies?

    • AImplementing credentialed scanning
    • BChanging from a passive to an active scanning approach
    • CImplementing a central place to manage IT assets
    • DPerforming agentless scanning

    Show answer

    Answer: C

    Explanation

    C. Implementing a central place to manage IT assets A central IT asset management system will provide a single source of truth for all IT assets, including their versions, patches, and configurations. By maintaining accurate and up-to-date information, the vulnerability assessment team can identify inconsistencies and prioritize remediation efforts more effectively. Here's why the other options are less effective: A. Implementing credentialed scanning: While credentialed scanning can provide more accurate vulnerability information, it won't address the underlying issue of inconsistent asset information. B. Changing from a passive to an active scanning approach: This might provide more detailed information but won't directly address the inconsistency problem. D. Performing agentless scanning: Agentless scanning can be less intrusive but may not provide as comprehensive information as agent-based scanning.

    Source: Adapted from community discussion — ChopSNap

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 211. 527 questions available.