CS0-003 practice questions 361–370

1. Question 361 · 527 in bank

   A cybersecurity team lead is developing metrics to present in the weekly executive briefs. Executives are interested in knowing how long it takes to stop the spread of malware that enters the network. Which of the following metrics should the team lead include in the briefs?

   • AMean time between failures
   • BMean time to detect
   • CMean time to remediate
   • DMean time to contain

   Show answer

   Answer: C

   Explanation

   You must be new here lol Ive seen many things not in the exam objectives on their exams... They asked for D So i gave them D D is the answer

   Source: Adapted from community discussion — throughthefray

   Next question

2. Question 362 · 527 in bank

   An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has: • created the initial evidence log. • disabled the wireless adapter on the device. • interviewed the employee, who was unable to identify the website that was accessed. • reviewed the web proxy traffic logs. Which of the following should the analyst do to remediate the infected device?

   • AUpdate the system firmware and reimage the hardware.
   • BInstall an additional malware scanner that will send email alerts to the analyst.
   • CConfigure the system to use a proxy server for Internet access.
   • DDelete the user profile and restore data from backup.

   Show answer

   Answer: A

   Explanation

   A. Update the system firmware and reimage the hardware. Reimaging the hardware involves wiping the device and restoring it to a known-good state. This is a common and effective remediation technique for malware infections. Updating the system firmware is also a good practice to ensure that known vulnerabilities are patched. It's important to perform these actions to eliminate the malware and any potential persistence mechanisms that may exist.

   Source: Adapted from community discussion — RobV

   Next question

3. Question 363 · 527 in bank

   An analyst is reviewing a dashboard from the company’s SIEM and finds that an IP address known to be malicious can be tracked to numerous high-priority events in the last two hours. The dashboard indicates that these events relate to TTPs. Which of the following is the analyst most likely using?

   • AMITRE ATT&CK
   • BOSSTMM
   • CDiamond Model of Intrusion Analysis
   • DOWASP

   Show answer

   Answer: A

   Next question

4. Question 364 · 527 in bank

   A cloud team received an alert that unauthorized resources were being auto-provisioned. After investigating, the team suspects that cryptomining is occurring. Which of the following indicators would most likely lead the team to this conclusion?

   • AHigh GPU utilization
   • BBandwidth consumption
   • CUnauthorized changes
   • DUnusual traffic spikes

   Show answer

   Answer: A

   Explanation

   The indicator that would most likely lead the cloud team to the conclusion that cryptomining is occurring is: A. High GPU utilization Explanation: Cryptomining, especially when performed on cloud resources without authorization, is a resource-intensive activity

   Source: Adapted from community discussion — nmap_king_22

   Next question

5. Question 365 · 527 in bank

   A company’s security team is updating a section of the reporting policy that pertains to inappropriate use of resources (e.g., an employee who installs cryptominers on workstations in the office). Besides the security team, which of the following groups should the issue be escalated to first in order to comply with industry best practices?

   • AHelp desk
   • BLaw enforcement
   • CLegal department
   • DBoard member

   Show answer

   Answer: C

   Explanation

   When updating a reporting policy related to the inappropriate use of resources, such as an employee installing cryptominers on workstations in the office, the issue should be escalated first to: C. Legal department Explanation: Legal Implications: Inappropriate use of resources often involves legal and compliance issues. Cryptomining on workstations without authorization can potentially lead to legal consequences, such as violations of company policies, data breaches, and possibly even legal implications related to unauthorized use of computing resources.

   Source: Adapted from community discussion — nmap_king_22

   Next question

6. Question 366 · 527 in bank

   Given the following CVSS string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Which of the following attributes correctly describes this vulnerability?

   • AA user is required to exploit this vulnerability.
   • BThe vulnerability is network based.
   • CThe vulnerability does not affect confidentiality.
   • DThe complexity to exploit the vulnerability is high.

   Show answer

   Answer: B

   Explanation

   Analyzing string, observe: AV:N: vulnerability is network-based AC:L: attack complexity is low PR:N: privileges are not required to exploit the vulnerability UI:N: no user interaction required S:U: scope of the impact is unchanged (unchanged scope). C:H: confidentiality impact is high. I:H: integrity impact is high. A:H: availability impact is high.

   Source: Adapted from community discussion — kmordalv

   Next question

7. Question 367 · 527 in bank

   A cryptocurrency service company is primarily concerned with ensuring the accuracy of the data on one of its systems. A security analyst has been tasked with prioritizing vulnerabilities for remediation for the system. The analyst will use the following CVSSv3.1 impact metrics for prioritization:

   

   Which of the following vulnerabilities should be prioritized for remediation?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: D

   Explanation

   D) 4 Question states the "company is primarily concerned with ensuring the accuracy of the data", or integrity in other words. Preserving the integrity of the data is important. So we will prioritize vulnerabilities that affect integrity (I in the CVSS 3.1 metrics) 1 - I:L, means integrity risk is low 2 - I:L, means integrity risk is low 3 - I:N, means integrity risk is none 4 - I:H means integrity risk is high

   Source: Adapted from community discussion — [Removed]

   Next question

8. Question 368 · 527 in bank

   Patches for two highly exploited vulnerabilities were released on the same Friday afternoon. Information about the systems and vulnerabilities is shown in the tables below:

   

   

   Which of the following should the security analyst prioritize for remediation?

   • Arogers
   • Bbrady
   • Cbrees
   • Dmanning

   Show answer

   Answer: B

   Explanation

   This one caught me for a second. I was thinking the network segment that was internal would be higher prioritized. However an external facing server (meaning a server that is accessible to the public like a webserver) would be more easily accessible to an attacker than a server that an attacker would have to get into the internal network first.

   Source: Adapted from community discussion — throughthefray

   Next question

9. Question 369 · 527 in bank

   A WAF weekly report shows that a daily spike occurs from the same subnet. An open-source review indicates the IP addresses belong to a legitimate internet service provider but have been flagged for DDoS attacks and reconnaissance scanning in the past year. Which of the following actions should a SOC analyst take first in response to these traffic uptick activities?

   • ARecommend a firewall rule implementation to deny all traffic from the IP subnet.
   • BContinue monitoring because the traffic spike did not cause any security notifications or concerns.
   • CReview the network logs to identify the context of traffic and what action was taken.
   • DCheck the resource consumption levels to determine whether the uptick is due to a device performance issue.

   Show answer

   Answer: C

   Next question

10. Question 370 · 527 in bank

    A security analyst must preserve a system hard drive that was involved in a litigation request. Which of the following is the best method to ensure the data on the device is not modified?

    • AGenerate a hash value and make a backup image.
    • BEncrypt the device to ensure confidentiality of the data.
    • CProtect the device with a complex password.
    • DPerform a memory scan dump to collect residual data

    Show answer

    Answer: A

    Explanation

    A) Generate a hash Better option than B since a hash will help preserve integrity by determining if any changes have been made. Additionally, a backup image provides availability in the event the drive fails or needs to be restored.

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 361. 527 questions available.