CS0-003 practice questions 291–300

1. Question 291 · 527 in bank

   A SOC analyst observes reconnaissance activity from an IP address. The activity follows a pattern of short bursts toward a low number of targets. An open-source review shows that the IP has a bad reputation. The perimeter firewall logs indicate the inbound traffic was allowed. The destination hosts are high-value assets with EDR agents installed. Which of the following is the best action for the SOC to take to protect against any further activity from the source IP?

   • AAdd the IP address to the EDR deny list.
   • BCreate a SIEM signature to trigger on any activity from the source IP subnet detected by the web proxy or firewalls for immediate notification.
   • CImplement a prevention policy for the IP on the WAF.
   • DActivate the scan signatures for the IP on the NGFWs.

   Show answer

   Answer: B

   Explanation

   Stuck between B and D depending on what "further activity" entails, but I'm going with B. Preventing a precursor to a potential attack doesn't seem like it covers the full scope of what they're looking for in "further activity". However, using a SIEM to trigger on any activity from the source would allow an analyst to respond more effectively to tactic shifts / provide a wider safety net. D seems to narrow.

   Source: Adapted from community discussion — Popeyes_Chicken

   Next question

2. Question 292 · 527 in bank

   Select 2

   A company’s internet-facing web application has been compromised several times due to identified design flaws. The company would like to minimize the risk of these incidents from reoccurring and has provided the developers with better security training. However, the company cannot allocate any more internal resources to the issue. Which of the following are the best options to help identify flaws within the system? (Choose two.)

   • ADeploying a WAF
   • BPerforming a forensic analysis
   • CContracting a penetration test
   • DHolding a tabletop exercise
   • ECreating a bug bounty program
   • FImplementing threat modeling

   Show answer

   Answer: CE

   Explanation

   Keyword is the company can not spare anymore internal resources. Thus making creating a bug bounty program and having an external company conduct a penetration test the only answers that involve not using internal resources.

   Source: Adapted from community discussion — donjuanx

   Next question

3. Question 293 · 527 in bank

   Which of the following choices is most likely to cause obstacles in vulnerability remediation?

   • ANot meeting an SLA
   • BPatch prioritization
   • COrganizational governance
   • DProprietary systems

   Show answer

   Answer: D

   Next question

4. Question 294 · 527 in bank

   A security analyst needs to identify services in a small, critical infrastructure ICS network. Many components in the network are likely to break if they receive malformed or unusually large requests. Which of the following is the safest method to use when identifying service versions?

   • AUse nmap -sV to identify all assets on the network.
   • BUse Burp Suite to conduct service identification.
   • CUse nc to manually perform banner grabbing.
   • DUse Nessus with restricted concurrent connections.

   Show answer

   Answer: C

   Explanation

   Manual banner grabbing with netcat (nc) lets the analyst send minimal, carefully crafted inputs to elicit a service banner. This minimizes the risk of accidentally sending a request that could disrupt operations.

   Source: Adapted from community discussion — exitbob

   Next question

5. Question 295 · 527 in bank

   A web application has a function to retrieve content from an internal URL to identify CSRF attacks in the logs. The security analyst is building a regular expression that will filter out the correctly formatted requests. The target URL is https://10.1.2.3/api, and the receiving API only accepts GET requests and uses a single integer argument named “id.” Which of the following regular expressions should the analyst use to achieve the objective?

   • A^(?!https://10\.1\.2\.3/api\?id=[0-9]+)
   • B^https://10\.1\.2\.3/api\?id=\d+
   • C(?:^https://10\.1\.2\.3/api\?id=[0-9]+)
   • D^https://10\.1\.2\.3/api\?id=[0-9]+$

   Show answer

   Answer: D

   Explanation

   Who's going to memorize regex for an exam? You have to be kidding... Anyway, just memorized it start with an ^ and ends with a $ sign. -_-

   Source: Adapted from community discussion — hashed_pony

   Next question

6. Question 296 · 527 in bank

   A security analyst needs to identify a computer based on the following requirements to be mitigated: • The attack method is network based with low complexity. • No privileges or user action is needed. • The confidentiality and availability level is high with a low integrity level. Given the following CVSS 3.1 output: Computer1 - CVSS3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H Computer2 - CVSS3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H Computer3 - CVSS3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H Computer4 - CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H Which of the following machines should the analyst mitigate?

   • AComputer1
   • BComputer2
   • CComputer3
   • DComputer4

   Show answer

   Answer: D

   Explanation

   I think computer 4 perfectly matches all the criteria: Network attack vector, low complexity, no user action, and high confidentiality/availability with low integrity.

   Source: Adapted from community discussion — ruelgo

   Next question

7. Question 297 · 527 in bank

   A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?

   • AExternal
   • BAgent-based
   • CNon-credentialed
   • DCredentialed

   Show answer

   Answer: B

   Explanation

   "The advantages of agent-based scanning are to reduce the impact on the network and reduce the chances of causing service outages. Another advantage is that server-based scans might not have the opportunity to assess devices that connect to the network temporarily and infrequently, such as mobiles and laptops. One drawback is that the range of agents may be limited to a particular operating system. There is also the chance that an adversary could compromise the agent software. It is often right to use both approaches to cover different asset classes. For example, agent-based scanning might be used for client PCs and mobiles, while active server-based scanning is used for network servers and routing/switching infrastructure, and passive scanning is used for embedded systems networks." (The Official CompTIA CySA+ Student Guide Exam CS0-002 page 354)

   Source: Adapted from community discussion — kmordalv

   Next question

8. Question 298 · 527 in bank

   An analyst would like to start automatically ingesting IoCs into the EDR tool. Which of the following sources would be the most cost effective for the analyst to use?

   • AGovernment bulletins
   • BSocial media
   • CDark web
   • DBlogs

   Show answer

   Answer: A

   Next question

9. Question 299 · 527 in bank

   During normal security monitoring activities, the following activity was observed: cd C:\Users\Documents\HR\Employees takeown/f .* SUCCESS: Which of the following best describes the potentially malicious activity observed?

   • ARegistry changes or anomalies
   • BData exfiltration
   • CUnauthorized privileges
   • DFile configuration changes

   Show answer

   Answer: C

   Explanation

   That command allows the user to take ownership of all the files in that file directory allowing them to preform unauthorized privileges

   Source: Adapted from community discussion — Wolf541

   Next question

10. Question 300 · 527 in bank

    A security administrator has found indications of dictionary attacks against the company’s external-facing portal. Which of the following should be implemented to best mitigate the password attacks?

    • AMultifactor authentication
    • BPassword complexity
    • CWeb application firewall
    • DLockout policy

    Show answer

    Answer: B

    Explanation

    They're definitely looking for password complexity here with the key term dictionary attack. Dictionary attacks thrive off of weak passwords.

    Source: Adapted from community discussion — Popeyes_Chicken

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 291. 527 questions available.