CS0-003 practice questions 321–330

1. Question 321 · 527 in bank

   A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?

   • Afunction x() { info=$(geoiplookup $1) && echo "$1 | $info" }
   • Bfunction x() { info=$(ping -c 1 $1 | awk -F "/" ’END{print $5}’) && echo "$1 | $info" }
   • Cfunction x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ".in-addr" ’{print $1} ').origin.asn.cymru.com TXT +short) && echo "$1 | $info" }
   • Dfunction x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo "$1 | $info" }

   Show answer

   Answer: D

   Explanation

   D. function x() { info=$(traceroute -m 40 $1 | awk 'END{print $1}') && echo "$1 | $info" } This shell function uses traceroute to trace the route packets take to reach the destination specified by $1. The -m 40 option specifies a maximum of 40 hops for the trace. The awk 'END{print $1}' part extracts the final hop from the traceroute output, and then the function echoes the destination and the info.

   Source: Adapted from community discussion — chaddman

   Next question

2. Question 322 · 527 in bank

   There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?

   • AImplement step-up authentication for administrators
   • BImprove employee training and awareness
   • CIncrease password complexity standards
   • DDeploy mobile device management

   Show answer

   Answer: B

   Explanation

   To improve the company's security posture against sensitive information disclosure via file sharing services, the most relevant security control would be: B. Improve employee training and awareness Explanation: User Awareness: Sensitive information disclosure often occurs due to user error or lack of awareness. By providing better training and raising employee awareness, the company can reduce the likelihood of employees inadvertently sharing sensitive data. This training should cover the proper use of file sharing services, recognizing sensitive data, and understanding the potential risks. Data Handling Policies: Employee training can be complemented by implementing clear data handling policies that specify how sensitive information should be treated, shared, and stored. Employees should be educated on these policies and their importance.

   Source: Adapted from community discussion — nmap_king_22

   Next question

3. Question 323 · 527 in bank

   Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?

   • ADetermine the sophistication of the audience that the report is meant for
   • BInclude references and sources of information on the first page
   • CInclude a table of contents outlining the entire report
   • DDecide on the color scheme that will effectively communicate the metrics

   Show answer

   Answer: A

   Explanation

   A. Determine the sophistication of the audience that the report is meant for. Understanding the sophistication of your audience is crucial in tailoring your report to effectively communicate the relevant information. This will help you decide on the appropriate level of technical detail, language, and depth of analysis to include in your report. It ensures that your report meets the needs and expectations of the audience, making it more relevant and impactful.

   Source: Adapted from community discussion — RobV

   Next question

4. Question 324 · 527 in bank

   A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?

   • AUpload the binary to an air gapped sandbox for analysis
   • BSend the binaries to the antivirus vendor
   • CExecute the binaries on an environment with internet connectivity
   • DQuery the file hashes using VirusTotal

   Show answer

   Answer: A

   Explanation

   An air-gapped sandbox is an isolated environment with no internet connectivity, which allows the analyst to analyze the malware in a controlled manner without any risk of the malware communicating with its command-and-control (C2) servers or alerting the attackers. This setup ensures that the analysis stays private, and no information is leaked to the attackers.

   Source: Adapted from community discussion — cy_analyst

   Next question

5. Question 325 · 527 in bank

   Select 2

   Which of the following responsibilities does the legal team have during an incident management event? (Choose two).

   • ACoordinate additional or temporary staffing for recovery efforts.
   • BReview and approve new contracts acquired as a result of an event.
   • CAdvise the incident response team on matters related to regulatory reporting.
   • DEnsure all system security devices and procedures are in place.
   • EConduct computer and network damage assessments for insurance.
   • FVerify that all security personnel have the appropriate clearances.

   Show answer

   Answer: BC

   Next question

6. Question 326 · 527 in bank

   Which of the following would help to minimize human engagement and aid in process improvement in security operations?

   • AOSSTMM
   • BSIEM
   • CSOAR
   • DOWASP

   Show answer

   Answer: C

   Explanation

   SOAR platforms, are specifically designed to automate and streamline security operations processes. They integrate with various security tools and systems to help orchestrate responses to security incidents, automate repetitive tasks, and improve overall efficiency, thereby reducing the need for manual intervention and minimizing human engagement in security operations.

   Source: Adapted from community discussion — kmordalv

   Next question

7. Question 327 · 527 in bank

   After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select?

   • AAvoid
   • BTransfer
   • CAccept
   • DMitigate

   Show answer

   Answer: A

   Explanation

   This decision aligns with the risk management principle of "avoidance," which means choosing not to proceed with an activity or decision that carries unacceptable risks.

   Source: Adapted from community discussion — kmordalv

   Next question

8. Question 328 · 527 in bank

   Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

   • AIdentify any improvements or changes in the incident response plan or procedures
   • BDetermine if an internal mistake was made and who did it so they do not repeat the error
   • CPresent all legal evidence collected and turn it over to iaw enforcement
   • DDiscuss the financial impact of the incident to determine if security controls are well spent

   Show answer

   Answer: A

   Explanation

   It seems the most logical answer This helps in strengthening the organization's security posture and ensuring a more effective response in the future.

   Source: Adapted from community discussion — kmordalv

   Next question

9. Question 329 · 527 in bank

   An analyst has discovered the following suspicious command: "; $xyz = ($_REQUEST['xyz']); system($xyz); echo ""; die; }?> Which of the following would best describe the outcome of the command?

   • ACross-site scripting
   • BReverse shell
   • CBackdoor attempt
   • DLogic bomb

   Show answer

   Answer: C

   Next question

10. Question 330 · 527 in bank

    The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?

    • AA mean time to remediate of 30 days
    • BA mean time to detect of 45 days
    • CA mean time to respond of 15 days
    • DThird-party application testing

    Show answer

    Answer: A

    Explanation

    I think they trying to trick you... I am looking at the key words Response vs Remediation. Response - Incident response activities include detection, analysis, containment, eradication, recovery, communication, and documentation. Remediation - Remediation activities include applying patches, fixing misconfigurations, updating security policies, improving access controls, and implementing other corrective measures.

    Source: Adapted from community discussion — ha33yp0tt3r69

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 321. 527 questions available.