CS0-003 practice questions 281–290

1. Question 281 · 527 in bank

   A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?

   • ASLA
   • BMOU
   • CNDA
   • DLimitation of liability

   Show answer

   Answer: A

   Explanation

   A) SLA MOU (memorandum of understanding) is not legally binding. SLA (service level agreement is). Certmaster Topic 7B: Understanding Vulnerability Reporting Outcomes and Action Plans A memorandum of understanding (MoU) is a legal document that outlines the terms and conditions of an agreement between two or more parties. It is an agreement that is not legally binding but serves as a document of understanding and good faith among the parties involved. A service-level agreement (SLA) is a legally binding contract between two or more parties that defines the level of service to be provided by one party to another. It often governs the relationship with a third-party service provider. It outlines the services provided, the terms of service, the responsibilities of each party, and the penalties for failing to meet them

   Source: Adapted from community discussion — [Removed]

   Next question

2. Question 282 · 527 in bank

   An organization identifies a method to detect unexpected behavior, crashes, or resource leaks in a system by feeding invalid, unexpected, or random data to stress the application. Which of the following best describes this testing methodology?

   • AReverse engineering
   • BStatic
   • CFuzzing
   • DDebugging

   Show answer

   Answer: C

   Next question

3. Question 283 · 527 in bank

   A Chief Information Security Officer (CISO) has decided the cost to protect an asset is greater than the cost of losing the asset. Which of the following risk management principles is the CISO following?

   • AAccept
   • BAvoid
   • CTransfer
   • DMitigate

   Show answer

   Answer: A

   Next question

4. Question 284 · 527 in bank

   After an upgrade to a new EDR, a security analyst received reports that several endpoints were not communicating with the SaaS provider to receive critical threat signatures. To comply with the incident response playbook, the security analyst was required to validate connectivity to ensure communications. The security analyst ran a command that provided the following: ComputerName: comptia007 - RemotePort: 443 - InterfaceAlias: Ethernet 3 - TopTestSucceeded: False - Which of the following did the analyst use to ensure connectivity?

   • Anmap
   • Btnc
   • Cping
   • Dtracert

   Show answer

   Answer: B

   Next question

5. Question 285 · 527 in bank

   A company was able to reduce triage time by focusing on historical trend analysis. The business partnered with the security team to achieve a 50% reduction in phishing attempts year over year. Which of the following action plans led to this reduced triage time?

   • APatching
   • BConfiguration management
   • CAwareness, education, and training
   • DThreat modeling

   Show answer

   Answer: C

   Next question

6. Question 286 · 527 in bank

   Select 2

   A security audit for unsecured network services was conducted, and the following output was generated:

   

   Which of the following services should the security team investigate further? (Choose two.)

   • A21
   • B22
   • C23
   • D636
   • E1723
   • F3389

   Show answer

   Answer: CE

   Explanation

   PPTP (Point-to-Point Tunneling Protocol) is considered insecure because it uses weak encryption standards, outdated authentication methods like MS-CHAP. It's vulnerable to various attacks due to its outdated design, making it easy for adversaries to intercept and decrypt data transmitted through a PPTP connection. Telnet transmits data in cleartext, ssh should be used instead.

   Source: Adapted from community discussion — Popeyes_Chicken

   Next question

7. Question 287 · 527 in bank

   Several incidents have occurred with a legacy web application that has had little development work completed. Which of the following is the most likely cause of the incidents?

   • AMisconfigured web application firewall
   • BData integrity failure
   • COutdated libraries
   • DInsufficient logging

   Show answer

   Answer: C

   Next question

8. Question 288 · 527 in bank

   An incident response team is assessing attack vectors of malware that is encrypting data with ransomware. There are no indications of a network-based intrusion. Which of the following is the most likely root cause of the incident?

   • AUSB drop
   • BLFI
   • CCross-site forgery
   • DSQL injection

   Show answer

   Answer: A

   Explanation

   Agree. It's A. USB drop is like leaving a poisoned apple in a shared office. If someone eats it (plugs in the USB), the system gets infected without needing network access.

   Source: Adapted from community discussion — ruelgo

   Next question

9. Question 289 · 527 in bank

   Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

   • ACommand and control
   • BActions on objectives
   • CExploitation
   • DDelivery

   Show answer

   Answer: A

   Explanation

   A) C&C Already been exploited, so it's not C or D. Can't be B ) actions on objectives until clear communication has been established through a C&C, even if it's in the process of doing so (i.e., "attempting"). Cyber Kill Chain detects and responds to processes, not necessarily after the fact. CompTIA certmaster Topic 10B: Explaining Attack Methodology Frameworks Command and Control (C&C or C2)—The weaponized code establishes a reliable channel to a remote server used to manage the session and often downloads additional tools to help advance the attack.

   Source: Adapted from community discussion — [Removed]

   Next question

10. Question 290 · 527 in bank

    A company is launching a new application in its internal network, where internal customers can communicate with the service desk. The security team needs to ensure the application will be able to handle unexpected strings with anomalous formats without crashing. Which of the following processes is the most applicable for testing the application to find how it would behave in such a situation?

    • AFuzzing
    • BCoding review
    • CDebugging
    • DStatic analysis

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 281. 527 questions available.