CS0-003 practice questions 351–360

1. Question 351 · 527 in bank

   A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?

   • Afunction w() { info=$(ping -c 1 $1 | awk -F “/” ‘END{print $1}’) && echo “$1 | $info” }
   • Bfunction x() { info=$(geoiplookup $1) && echo “$1 | $info” }
   • Cfunction y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo “$1 | $info” }
   • Dfunction z() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }

   Show answer

   Answer: B

   Explanation

   This function takes an IP address as an argument and uses the geoiplookup command to get the geographic location information associated with the IP address, such as the country name, country code, region, city, or latitude and longitude. The function then prints the IP address and the geographic location information, which can help identify any IP addresses that belong to the same country.

   Source: Adapted from community discussion — kmordalv

   Next question

2. Question 352 · 527 in bank

   Executives want to compare certain metrics from the most recent and last reporting periods to determine whether the metrics are increasing or decreasing. Which of the following would provide the necessary information to satisfy this request?

   • ACount level
   • BTrending analysis
   • CImpact assessment
   • DSeverity score

   Show answer

   Answer: B

   Next question

3. Question 353 · 527 in bank

   A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment:

   

   Which of the following should be completed first to remediate the findings?

   • AAsk the web development team to update the page contents
   • BAdd the IP address allow listing for control panel access
   • CPurchase an appropriate certificate from a trusted root CA
   • DPerform proper sanitization on all fields

   Show answer

   Answer: D

   Explanation

   Agree with option D because user input has High impact and Low complexity. Not sure whether field sanitization will resolve error message handling as well, but it should be third, next to SSL certificate.

   Source: Adapted from community discussion — deeden

   Next question

4. Question 354 · 527 in bank

   While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next?

   • AShut the network down immediately and call the next person in the chain of command.
   • BDetermine what attack the odd characters are indicative of.
   • CUtilize the correct attack framework and determine what the incident response will consist of.
   • DNotify the local law enforcement for incident response.

   Show answer

   Answer: B

   Explanation

   Do we know what the odd characters are indicative of yet? Is this an attack? We need to investigate and determine if this is an incident first before we consult an attack framework.

   Source: Adapted from community discussion — LiveLaughToasterBath

   Next question

5. Question 355 · 527 in bank

   A SOC manager reviews metrics from the last four weeks to investigate a recurring availability issue. The manager finds similar events correlating to the times of the reported issues. Which of the following methods would the manager most likely use to resolve the issue?

   • AVulnerability assessment
   • BRoot cause analysis
   • CRecurrence reports
   • DLessons learned

   Show answer

   Answer: B

   Next question

6. Question 356 · 527 in bank

   A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue?

   • AService-level agreement
   • BChange management plan
   • CIncident response plan
   • DMemorandum of understanding

   Show answer

   Answer: C

   Explanation

   C) incident response plan Let's go through the process of elimination A and D are both related to vendor contracts. SLA and MOU. B doesn't apply since we don't anything stating the incident was caused as a result of faulty change management. C is the only logical choice. With a clearly defined incident response plan, there won't be any finger pointing or asking who is in charge of what. Everyone will have clearly defined roles

   Source: Adapted from community discussion — [Removed]

   Next question

7. Question 357 · 527 in bank

   A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with. Which of the following is the best mitigation technique?

   • AGeoblock the offending source country.
   • BBlock the IP range of the scans at the network firewall.
   • CPerform a historical trend analysis and look for similar scanning activity.
   • DBlock the specific IP address of the scans at the network firewall.

   Show answer

   Answer: A

   Explanation

   A is correct! Based on my work experience as an information security analyst. Re-read the question carefully. There's a reason it states the business does NOT conduct business with them. So the reasoning about it blocking legitimate traffic from users there or the CEO going on vacation there go out the window. Why would you allow incoming connections from a country you do no business with? Additionally, blocking just the range of IPs isn't a good option since the attacker can just use an IP outside of that range and they are in. Blocking by geolocation is a common practice. China, Russia, Moldova, etc.

   Source: Adapted from community discussion — [Removed]

   Next question

8. Question 358 · 527 in bank

   A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?

   • AThere is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access
   • BAn on-path attack is being performed by someone with internal access that forces users into port 80
   • CThe web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80
   • DAn error was caused by BGP due to new rules applied over the company's internal routers

   Show answer

   Answer: B

   Explanation

   The fact that the company's internal portal is sometimes accessible through HTTP (port 80) and other times through HTTPS (port 443) suggests that someone with internal access is actively manipulating the network traffic. An on-path attack is a type of man-in-the-middle attack where an attacker intercepts and modifies communication between two parties. By forcing users into using HTTP instead of HTTPS, the attacker can potentially capture sensitive information transmitted over the network, such as login credentials or session data. An issue with the SSL certificate (Option A) would generally result in HTTPS not working at all, rather than it being intermittently accessible. A web server unable to handle an increasing amount of HTTPS requests (Option C) would likely result in performance issues or server errors, but it wouldn't selectively redirect users to HTTP. BGP (Border Gateway Protocol) is used for routing between autonomous systems on the internet, and it generally would not cause the internal portal to switch between HTTP and HTTPS. It is more relevant to external internet routing.

   Source: Adapted from community discussion — kmordalv

   Next question

9. Question 359 · 527 in bank

   An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet: /wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administrator Which of the following controls would work best to mitigate the attack represented by this snippet?

   • ALimit user creation to administrators only.
   • BLimit layout creation to administrators only.
   • CSet the directory trx_addons to read only for all users.
   • DSet the directory V2 to read only for all users.

   Show answer

   Answer: A

   Explanation

   o mitigate the attack represented by this snippet, you would typically implement controls at the web server level or within the web application itself. Here's the analysis of the options: A. Limit user creation to administrators only: This control would help restrict user creation privileges, but it may not directly address the specific URL path or vulnerability being targeted in the snippet (/wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administrator). It's important to address the vulnerability at the application level.

   Source: Adapted from community discussion — nmap_king_22

   Next question

10. Question 360 · 527 in bank

    A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?

    • AImplementing multifactor authentication on the server OS
    • BHashing user passwords on the web application
    • CPerforming input validation before allowing submission
    • DSegmenting the network between the users and the web server

    Show answer

    Answer: C

    Explanation

    To remediate the vulnerability where a penetration tester was able to retrieve user credentials by submitting data to a form in a web application, the recommended action is: C. Performing input validation before allowing submission Explanation: Input validation is a critical security measure to prevent various types of web application attacks, including SQL injection, cross-site scripting (XSS), and data manipulation. It helps ensure that user inputs are sanitized and do not contain malicious or unexpected data.

    Source: Adapted from community discussion — nmap_king_22

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 351. 527 questions available.