CS0-003 practice questions 21–30

1. Question 21 · 527 in bank

   A vulnerability analyst received a list of system vulnerabilities and needs to evaluate the relevant impact of the exploits on the business. Given the constraints of the current sprint, only three can be remediated. Which of the following represents the least impactful risk, given the CVSS3.1 base scores?

   • AAV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Base Score 6.0
   • BAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Base Score 7.2
   • CAV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Base Score 6.4
   • DAV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L - Base Score 6.5

   Show answer

   Answer: D

   Explanation

   The answer is D. A. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.22 = 1.34 B. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.22 = 1.34 C. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.56 = 1.68 D. Total Impact Score = C + I + A = 0.22 + 0.22 + 0.22 = 0.66 Therefore, vulnerability D represents the least impactful risk, given the CVSS3.1 base scores, as it has the lowest total impact score.

   Source: Adapted from community discussion — BanesTech

   Next question

2. Question 22 · 527 in bank

   A recent vulnerability scan resulted in an abnormally large number of critical and high findings that require patching. The SLA requires that the findings be remediated within a specific amount of time. Which of the following is the best approach to ensure all vulnerabilities are patched in accordance with the SLA?

   • AIntegrate an IT service delivery ticketing system to track remediation and closure
   • BCreate a compensating control item until the system can be fully patched
   • CAccept the risk and decommission current assets as end of life
   • DRequest an exception and manually patch each system

   Show answer

   Answer: A

   Explanation

   Correct By integrating an IT service delivery ticketing system, you establish a structured and organized process to track the remediation progress of each vulnerability. This approach enables you to efficiently manage the patching process, assign responsibilities, set deadlines, monitor progress, and ensure that all vulnerabilities are addressed within the specified SLA. It provides visibility into the status of each vulnerability and facilitates communication among teams responsible for the patching process.

   Source: Adapted from community discussion — kmordalv

   Next question

3. Question 23 · 527 in bank

   Which of the following would help an analyst to quickly find out whether the IP address in a SIEM alert is a known-malicious IP address?

   • AJoin an information sharing and analysis center specific to the company's industry
   • BUpload threat intelligence to the IPS in STIX'TAXII format
   • CAdd data enrichment for IPs in the ingestion pipeline
   • DReview threat feeds after viewing the SIEM alert

   Show answer

   Answer: C

   Explanation

   C. Add data enrichment for IPs in the ingestion pipeline. Here's why: Data Enrichment: Data enrichment is the process of adding additional context and information to the data in your SIEM. By enriching the SIEM data with threat intelligence feeds that contain information about known-malicious IP addresses, you can quickly identify whether an IP address in an alert is associated with known threats. This process allows for real-time analysis and correlation of SIEM alerts with known threat indicators.

   Source: Adapted from community discussion — FoeMarc

   Next question

4. Question 24 · 527 in bank

   A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

   • AWeaponization
   • BReconnaissance
   • CDelivery
   • DExploitation

   Show answer

   Answer: D

   Explanation

   In this scenario, the threat actor has already gained access to the internal network through social engineering, indicating that the Exploitation stage has occurred. The threat actor's objective at this point is to maintain access to the network to continue the attack, which aligns with the Actions on Objectives stage. However, since the question specifically asks about the current stage of the Cyber Kill Chain, the threat actor is currently operating in the Exploitation stage.

   Source: Adapted from community discussion — BanesTech

   Next question

5. Question 25 · 527 in bank

   An organization was compromised, and the usernames and passwords of all employees were leaked online. Which of the following best describes the remediation that could reduce the impact of this situation?

   • AMultifactor authentication
   • BPassword changes
   • CSystem hardening
   • DPassword encryption

   Show answer

   Answer: B

   Explanation

   Another excellent question from Comptia. How do you sweeten your tea? 1 - Pour hot water and add sugar; or 2 - Add sugar and pour hot water.

   Source: Adapted from community discussion — Sebatian20

   Next question

6. Question 26 · 527 in bank

   A company is deploying new vulnerability scanning software to assess its systems. The current network is highly segmented, and the networking team wants to minimize the number of unique firewall rules. Which of the following scanning techniques would be most efficient to achieve the objective?

   • ADeploy agents on all systems to perform the scans
   • BDeploy a central scanner and perform non-credentialed scans
   • CDeploy a cloud-based scanner and perform a network scan
   • DDeploy a scanner sensor on every segment and perform credentialed scans

   Show answer

   Answer: A

   Explanation

   This ones tough. D can be a good answer but I actually think this is A. If its that segmented and they want to minimize firewall rules, deploying a scanner sensor on every segment doesn't seem practical. It specifically says they're assessing systems, and if the option to deploy the agent directly to the systems is there, then it is less resource heavy and less maintenance to do an agent-based discovery.

   Source: Adapted from community discussion — [Removed]

   Next question

7. Question 27 · 527 in bank

   Select 2

   Executives at an organization email sensitive financial information to external business partners when negotiating valuable contracts. To ensure the legal validity of these messages, the cybersecurity team recommends a digital signature be added to emails sent by the executives. Which of the following are the primary goals of this recommendation? (Choose two.)

   • AConfidentiality
   • BIntegrity
   • CPrivacy
   • DAnonymity
   • ENon-reduplication
   • FAuthorization

   Show answer

   Answer: BE

   Explanation

   That has to be a typo. Digital signatures don't inherently provide authorization. They provide integrity by ensuring data hasn't been tampered with and non-repudiation. Which validates the identity of the sender.

   Source: Adapted from community discussion — Popeyes_Chicken

   Next question

8. Question 28 · 527 in bank

   A security administrator needs to import PII data records from the production environment to the test environment for testing purposes. Which of the following would best protect data confidentiality?

   • AData masking
   • BHashing
   • CWatermarking
   • DEncoding

   Show answer

   Answer: A

   Explanation

   Correct Data masking is a technique used to protect sensitive information, such as personally identifiable information (PII), by replacing original data with fictitious but realistic data. This ensures that the sensitive information is not exposed in the test environment while still maintaining the overall structure and format of the data. Data masking helps maintain data confidentiality by preventing unauthorized access to sensitive information during testing or development processes.

   Source: Adapted from community discussion — kmordalv

   Next question

9. Question 29 · 527 in bank

   The email system administrator for an organization configured DKIM signing for all email legitimately sent by the organization. Which of the following would most likely indicate an email is malicious if the company's domain name is used as both the sender and the recipient?

   • AThe message fails a DMARC check
   • BThe sending IP address is the hosting provider
   • CThe signature does not meet corporate standards
   • DThe sender and reply address are different

   Show answer

   Answer: A

   Explanation

   DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing. A DMARC policy uses both SPF (Sender Policy Framework) and DKIM to validate emails. If an email fails a DMARC check, it means it did not pass SPF or DKIM validation, which is a strong indicator of a malicious or spoofed email, especially if the domain in the sender's address is being impersonated.

   Source: Adapted from community discussion — b0ad9e1

   Next question

10. Question 30 · 527 in bank

    During an incident involving phishing, a security analyst needs to find the source of the malicious email. Which of the following techniques would provide the analyst with this information?

    • AHeader analysis
    • BPacket capture
    • CSSL inspection
    • DReverse engineering

    Show answer

    Answer: A

    Explanation

    Correct. Email headers contain valuable information about the email's origin, route, and servers involved in its transmission. By examining the email headers, an analyst can trace back the source IP address and potentially identify the sender's location or originating mail server. (The Official CompTIA CySA+ Student Guide Exam)

    Source: Adapted from community discussion — kmordalv

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 21. 527 questions available.