CS0-003 practice questions 271–280

1. Question 271 · 527 in bank

   A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?

   • AChange the display filter to ftp.active.port
   • BChange the display filter to tcp.port==20
   • CChange the display filter to ftp-data and follow the TCP streams
   • DNavigate to the File menu and select FTP from the Export objects option

   Show answer

   Answer: C

   Explanation

   To see the entire contents of the downloaded files in the FTP session captured in Wireshark, the analyst should perform the following steps: C. Change the display filter to ftp-data and follow the TCP streams. By changing the display filter to "ftp-data" and then following the TCP streams, the analyst can access and view the entire data transfer, which includes the contents of the downloaded files. This method allows you to reconstruct and view the files being transferred over FTP

   Source: Adapted from community discussion — nmap_king_22

   Next question

2. Question 272 · 527 in bank

   A security analyst must assist the IT department with creating a phased plan for vulnerability patching that meets established SLAs. Which of the following vulnerability management elements will best assist with prioritizing a successful plan?

   • AAffected hosts
   • BRisk score
   • CMitigation strategy
   • DAnnual recurrence

   Show answer

   Answer: B

   Next question

3. Question 273 · 527 in bank

   A Chief Information Security Officer has requested a dashboard to share critical vulnerability management goals with company leadership. Which of the following would be the best to include in the dashboard?

   • AKPI
   • BMOU
   • CSLO
   • DSLA

   Show answer

   Answer: A

   Explanation

   KPIs are designed to track and report on progress toward objectives, such as the time to remediate vulnerabilities, percentage of critical vulnerabilities addressed, etc. These are the types of data leadership would want to see.

   Source: Adapted from community discussion — Popeyes_Chicken

   Next question

4. Question 274 · 527 in bank

   Numerous emails were sent to a company’s customer distribution list. The customers reported that the emails contained a suspicious link. The company’s SOC determined the links were malicious. Which of the following is the best way to decrease these emails?

   • ADMARC
   • BDKIM
   • CSPF
   • DSMTP

   Show answer

   Answer: A

   Next question

5. Question 275 · 527 in bank

   A security analyst is conducting a vulnerability assessment of a company’s online store. The analyst discovers a critical vulnerability in the payment processing system that could be exploited, allowing attackers to steal customer payment information. Which of the following should the analyst do next?

   • ALeave the vulnerability unpatched until the next scheduled maintenance window to avoid potential disruption to business.
   • BPerform a risk assessment to evaluate the potential impact of the vulnerability and determine whether additional security measures are needed.
   • CIgnore the vulnerability since the company recently passed a payment system compliance audit.
   • DPatch the vulnerability as soon as possible to ensure customer payment information is secure.

   Show answer

   Answer: D

   Next question

6. Question 276 · 527 in bank

   Results of a SOC customer service evaluation indicate high levels of dissatisfaction with the inconsistent services provided after regular work hours. To address this, the SOC lead drafts a document establishing customer expectations regarding the SOC’s performance and quality of services. Which of the following documents most likely fits this description?

   • ARisk management plan
   • BVendor agreement
   • CIncident response plan
   • DService-level agreement

   Show answer

   Answer: D

   Next question

7. Question 277 · 527 in bank

   A systems administrator needs to gather security events with repeatable patterns from Linux log files. Which of the following would the administrator most likely use for this task?

   • AA regular expression in Bash
   • BFilters in the vi editor
   • CVariables in a PowerShell script
   • DA playbook in a SOAR tool

   Show answer

   Answer: A

   Next question

8. Question 278 · 527 in bank

   Which of the following is most appropriate to use with SOAR when the security team would like to automate actions across different vendor platforms?

   • ASTIX/TAXII
   • BAPIs
   • CData enrichment
   • DThreat feed

   Show answer

   Answer: B

   Explanation

   APIs (Application Programming Interfaces) are the most appropriate choice for integrating a SOAR (Security Orchestration, Automation, and Response) platform with different vendor platforms to automate actions. Here's why: Vendor Integration: APIs allow SOAR platforms to communicate directly with various tools and platforms, such as firewalls, SIEMs, EDR solutions, and threat intelligence feeds. Automation of Actions: APIs enable SOAR to execute automated actions like blocking IPs, quarantining endpoints, or updating policies across different vendor platforms. Interoperability: APIs are the standard method for interoperability between different tools, regardless of vendor-specific implementations. Flexibility: Using APIs, SOAR platforms can trigger specific workflows and tasks tailored to the organization's security requirements.

   Source: Adapted from community discussion — hackerguy

   Next question

9. Question 279 · 527 in bank

   Thousands of computers were compromised in a breach, but the vulnerability that caused the compromise was detected on only three computers during the latest vulnerability scan. An analyst conducts an after action review to determine why the vulnerability was not detected on more computers. The analyst recreates the following configuration that was used to scan the network:

   

   Which of the following best explains the reason the vulnerability was found only on three computers?

   • AIncorrect remote port specified
   • BLack of concurrent threads dedicated
   • CUse of a credentialed vulnerability scan
   • DConfiguring an incorrect subnet mask

   Show answer

   Answer: D

   Explanation

   Choosing D 1.) The question said THOUSANDS of computers were infected. This would at least require a /21 for 2048 IPs not excluding first usable and broadcast address 2.) In the image the subnet is 172.16.0.0/24. This subnet is only capable of having 254 hosts after assigning the first usable and broadcast address.

   Source: Adapted from community discussion — NetworkDisciple

   Next question

10. Question 280 · 527 in bank

    A security analyst needs to develop a solution to protect a high-value asset from an exploit like a recent zero-day attack. Which of the following best describes this risk management strategy?

    • AAvoid
    • BTransfer
    • CAccept
    • DMitigate

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 271. 527 questions available.