CS0-003 practice questions 331–340

1. Question 331 · 527 in bank

   The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results?

   • ASingle pane of glass
   • BSingle sign-on
   • CData enrichment
   • DDeduplication

   Show answer

   Answer: A

   Explanation

   A single pane of glass refers to a unified interface that provides a comprehensive view of multiple sources of information or data feeds. By integrating various threat intelligence feeds into a single platform or dashboard, the security operations team can streamline their workflows, reduce complexity, and improve visibility into potential threats. This approach allows analysts to access and correlate information from different sources more efficiently, enabling them to make better-informed decisions and respond more effectively to security incidents. Deduplication (D) is essential for eliminating redundant or duplicate information within threat intelligence feeds, but it is a component of the consolidation process rather than the overarching solution for integrating multiple feeds into a single platform.

   Source: Adapted from community discussion — Geronemo

   Next question

2. Question 332 · 527 in bank

   Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

   • AMITRE ATT&CK
   • BCyber Kill Cham
   • COWASP
   • DSTIX/TAXII

   Show answer

   Answer: A

   Explanation

   A security analyst would most likely use: A. MITRE ATT&CK MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a widely used framework that provides a comprehensive matrix of known Tactics, Techniques, and Procedures (TTPs) used by various adversaries. It allows security analysts to compare and map the TTPs observed in their environment to those associated with known threat actors and groups. By using ATT&CK, analysts can gain insights into which adversaries may be responsible for specific incidents based on their TTPs, aiding in threat intelligence analysis and incident response

   Source: Adapted from community discussion — nmap_king_22

   Next question

3. Question 333 · 527 in bank

   An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?

   • AEradication
   • BRecovery
   • CContainment
   • DPreparation

   Show answer

   Answer: A

   Explanation

   The description provided corresponds to the following step in the incident response process: A. Eradication Eradication involves the process of identifying and removing the root cause or vulnerability that led to the incident. In this case, the analyst has isolated the vulnerability and is actively removing it from the system. This step is crucial to prevent further exploitation of the same vulnerability and to ensure the incident does not recur

   Source: Adapted from community discussion — nmap_king_22

   Next question

4. Question 334 · 527 in bank

   Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?

   • AIsolate Joe's PC from the network
   • BReimage the PC based on standard operating procedures
   • CInitiate a remote wipe of Joe's PC using mobile device management
   • DPerform no action until HR or legal counsel advises on next steps

   Show answer

   Answer: D

   Explanation

   D. Perform no action until HR or legal counsel advises on next steps Before any technical actions are taken, it is crucial to involve HR and legal counsel to assess the situation, understand the legal implications of Joe's actions, and determine the appropriate course of action. This ensures that any response is in compliance with employment laws and company policies.

   Source: Adapted from community discussion — RobV

   Next question

5. Question 335 · 527 in bank

   The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks?

   • AReduce the administrator and privileged access accounts
   • BEmploy a network-based IDS
   • CConduct thorough incident response
   • DEnable SSO to enterprise applications

   Show answer

   Answer: A

   Explanation

   When implementing a program to reduce attack surface risks and threats as part of a zero trust approach, the best priority, based on common attack frameworks and the principles of zero trust, is: A. Reduce the administrator and privileged access accounts Zero trust is a security framework that assumes that threats exist both inside and outside the network. It emphasizes the principle of "least privilege," which means that users and systems should only have the minimum level of access necessary to perform their tasks.

   Source: Adapted from community discussion — nmap_king_22

   Next question

6. Question 336 · 527 in bank

   During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first?

   • AClone the virtual server for forensic analysis
   • BLog m to the affected server and begin analysis of the logs
   • CRestore from the last known-good backup to confirm there was no loss of connectivity
   • DShut down the affected server immediately

   Show answer

   Answer: A

   Explanation

   A. Clone the virtual server for forensic analysis Cloning the virtual server allows the analyst to capture a snapshot of the system as it is, including all current data, configurations, and state. This cloned version can be analyzed in detail without affecting the integrity of the original server, which is crucial for any potential legal proceedings and for understanding the scope and details of the attack.

   Source: Adapted from community discussion — Gway

   Next question

7. Question 337 · 527 in bank

   A security analyst is improving an organization’s vulnerability management program. The analyst cross-checks the current reports with the system’s infrastructure teams, but the reports do not accurately reflect the current patching levels. Which of the following will most likely correct the report errors?

   • AUpdating the engine of the vulnerability scanning tool
   • BInstalling patches through a centralized system
   • CConfiguring vulnerability scans to be credentialed
   • DResetting the scanning tool’s plug-ins to default

   Show answer

   Answer: C

   Next question

8. Question 338 · 527 in bank

   A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation?

   • AC2 beaconing activity
   • BData exfiltration
   • CAnomalous activity on unexpected ports
   • DNetwork host IP address scanning
   • EA rogue network device

   Show answer

   Answer: A

   Explanation

   Be careful its easy to pick answer B - data exfiltration but this is incorrect, the scenario doesn't explicitly mention the nature of the outgoing traffic or whether sensitive data is involved. It simply states that there are regular outgoing HTTPS connections to a public IP address, both during and after work hours.

   Source: Adapted from community discussion — captaintoadyo

   Next question

9. Question 339 · 527 in bank

   New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?

   • AHuman resources must email a copy of a user agreement to all new employees
   • BSupervisors must get verbal confirmation from new employees indicating they have read the user agreement
   • CAll new employees must take a test about the company security policy during the onboardmg process
   • DAll new employees must sign a user agreement to acknowledge the company security policy

   Show answer

   Answer: D

   Explanation

   To ensure new employees are accountable for following the company policy, especially when it comes to prohibiting the use of personal devices like webcams, the SOC (Security Operations Center) manager is likely to recommend: D. All new employees must sign a user agreement to acknowledge the company security policy. Explanation: Requiring new employees to sign a user agreement is a common and effective practice in organizations. It ensures that employees have acknowledged and agreed to adhere to the company's security policies, including the prohibition of personal devices.

   Source: Adapted from community discussion — nmap_king_22

   Next question

10. Question 340 · 527 in bank

    An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign?

    • AInformation sharing organization
    • BBlogs/forums
    • CCybersecurity incident response team
    • DDeep/dark web

    Show answer

    Answer: A

    Explanation

    A. Information Sharing Organization Information Sharing and Analysis Centers (ISACs) or other similar organizations are dedicated to sharing information about threats and vulnerabilities in specific sectors, including critical infrastructure and defense. Given the company's role in the supply chain for a fighter jet, it would likely be a part of an industry-specific ISAC focused on defense or critical infrastructure. These organizations often have access to high-quality, vetted intelligence, including classified or sensitive information that may not be available through other channels. They also enable timely and relevant information sharing among members.

    Source: Adapted from community discussion — Gway

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 331. 527 questions available.