CS0-003 practice questions 341–350

1. Question 341 · 527 in bank

   An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?

   • ATo satisfy regulatory requirements for incident reporting
   • BTo hold other departments accountable
   • CTo identify areas of improvement in the incident response process
   • DTo highlight the notable practices of the organization's incident response team

   Show answer

   Answer: C

   Explanation

   The most likely reason to include lessons learned in an after-action report following a significant security incident is: C. To identify areas of improvement in the incident response process. Explanation: Lessons learned are a critical component of the incident response process. They serve the purpose of reflecting on what went well and what could have been done better during the incident response.

   Source: Adapted from community discussion — nmap_king_22

   Next question

2. Question 342 · 527 in bank

   A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:

   

   Which of the following scripting languages was used in the script?

   • APowerShell
   • BRuby
   • CPython
   • DShell script

   Show answer

   Answer: A

   Explanation

   the syntax in the given script, such as cmdlet names starting with "Get-", "Add-", "Set-", and the use of the pipeline "|", is characteristic of PowerShell scripting. Moreover, the use of Active Directory cmdlets like "Get-ADUser," "Add-ADGroupMember," and "Set-ADUser" indicates that this script is designed to interact with Active Directory, which aligns with PowerShell's primary use case in managing Windows environments and Active Directory services.

   Source: Adapted from community discussion — kmordalv

   Next question

3. Question 343 · 527 in bank

   A network security analyst for a large company noticed unusual network activity on a critical system. Which of the following tools should the analyst use to analyze network traffic to search for malicious activity?

   • AWAF
   • BWireshark
   • CEDR
   • DNmap

   Show answer

   Answer: B

   Next question

4. Question 344 · 527 in bank

   A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities: c

   

   Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system?

   • AInLoud: Cobain: Yes - Grohl: No - Novo: Yes - Smear: Yes - Channing: No
   • BTSpirit: Cobain: Yes - Grohl: Yes - Novo: Yes - Smear: No - Channing: No
   • CENameless: Cobain: Yes - Grohl: No - Novo: Yes - Smear: No - Channing: No
   • DPBleach: Cobain: Yes - Grohl: No - Novo: No - Smear: No - Channing: Yes

   Show answer

   Answer: B

   Explanation

   I believe you're wrong. External facing are the worst ones to have, assuming that means accessible over the internet. Public PoCs are also bad because that means its either a github search away or a module already loaded into msfconsole. It's definitely B.

   Source: Adapted from community discussion — [Removed]

   Next question

5. Question 345 · 527 in bank

   A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become?

   • AHacktivist
   • BAdvanced persistent threat
   • CInsider threat
   • DScript kiddie

   Show answer

   Answer: C

   Explanation

   C) Insider threat. Insider threats can be on purpose or accidentally. Regardless, it originated as a result someone inside the organization (employee) did.

   Source: Adapted from community discussion — [Removed]

   Next question

6. Question 346 · 527 in bank

   An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

   • ATake a snapshot of the compromised server and verify its integrity
   • BRestore the affected server to remove any malware
   • CContact the appropriate government agency to investigate
   • DResearch the malware strain to perform attribution

   Show answer

   Answer: A

   Explanation

   When a security analyst believes a single virtual server has been compromised and has isolated it from the network, the next steps for the CSIRT (Computer Security Incident Response Team) should focus on investigating and containing the incident. In this context, the most appropriate action would be: A. Take a snapshot of the compromised server and verify its integrity Explanation: Take a snapshot: Creating a snapshot involves capturing the current state of the virtual server, including its configuration and data. This snapshot can serve as a forensic image for later analysis. Verify its integrity: The CSIRT should analyze the snapshot to identify signs of compromise, understand the extent of the incident, and determine the nature of the compromise. Verifying the integrity involves checking for any unauthorized changes, unusual activities, or indicators of compromise.

   Source: Adapted from community discussion — RobV

   Next question

7. Question 347 · 527 in bank

   During a training exercise, a security analyst must determine the vulnerabilities to prioritize. The analyst reviews the following vulnerability scan output:

   

   Which of the following issues should the analyst address first?

   • AAllows anonymous read access to /etc/passwd
   • BAllows anonymous read access via any FTP connection
   • CMicrosoft Defender security definition updates disabled
   • Dless command allows for escape exploit via terminal

   Show answer

   Answer: A

   Next question

8. Question 348 · 527 in bank

   During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level?

   • ADisk contents
   • BBackup data
   • CTemporary files
   • DRunning processes

   Show answer

   Answer: D

   Explanation

   Running processes (D): This includes currently executing programs and services and is highly volatile as it can change rapidly. Temporary files (C): Temporary files may contain information relevant to the incident and are relatively more volatile than disk contents and backup data. Disk contents (A): Disk contents are less volatile than running processes and temporary files, as they represent the stored data on the disk. Backup data (B): Backup data is typically the least volatile as it represents a snapshot of the system at a previous point in time.

   Source: Adapted from community discussion — RobV

   Next question

9. Question 349 · 527 in bank

   Select 2

   An analyst is trying to capture anomalous traffic from a compromised host. Which of the following are the best tools for achieving this objective? (Choose two.)

   • Atcpdump
   • BSIEM
   • CVulnerability scanner
   • DWireshark
   • ENmap
   • FSOAR

   Show answer

   Answer: AD

   Next question

10. Question 350 · 527 in bank

    A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script functions could help achieve the goal?

    • Afunction w() { a=$(ping -c 1 $1 | awk-F ”/” ’END{print $1}’) && echo “$1 | $a” }
    • Bfunction x() { b=traceroute -m 40 $1 | awk ’END{print $1}’) && echo “$1 | $b” }
    • Cfunction y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ”.in-addr” ’{print $1}’).origin.asn.cymru.com TXT +short }
    • Dfunction z() { c=$(geoiplookup$1) && echo “$1 | $c” }

    Show answer

    Answer: C

    Explanation

    This function takes an IP address as an argument and performs two DNS lookups using the dig command. The first lookup uses the -x option to perform a reverse DNS lookup and get the hostname associated with the IP address. The second lookup uses the origin.asn.cymru.com domain to get the autonomous system number (ASN) and other information related to the IP address, such as the country code, registry, or allocation date. The function then prints the IP address and the ASN information, which can help identify any network addresses that belong to the same ASN or region

    Source: Adapted from community discussion — kmordalv

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 341. 527 questions available.