CS0-003 practice questions 391–400

1. Question 391 · 527 in bank

   A systems analyst is limiting user access to system configuration keys and values in a Windows environment. Which of the following describes where the analyst can find these configuration items?

   • Aconfig.ini
   • Bntds.dit
   • CMaster boot record
   • DRegistry

   Show answer

   Answer: D

   Explanation

   D. Registry In a Windows environment, system configuration keys and values are typically stored in the Windows Registry. The Windows Registry is a hierarchical database that stores configuration settings and options for both the operating system and installed applications. It contains a wide range of information related to system configuration, user profiles, hardware settings, and more. System administrators and analysts can access and modify these configuration items within the Windows Registry to manage and customize various aspects of the system.

   Source: Adapted from community discussion — chaddman

   Next question

2. Question 392 · 527 in bank

   While reviewing web server logs, a security analyst found the following line: < IMG SRC='vbscript:msgbox("test")' > Which of the following malicious activities was attempted?

   • ACommand injection
   • BXML injection
   • CServer-side request forgery
   • DCross-site scripting

   Show answer

   Answer: D

   Explanation

   Correct The provided line is an example of a cross-site scripting (XSS) attack. In an XSS attack, malicious code is injected into a web application, and when other users view the page containing this code, the injected code is executed in their browsers. In this case, the code attempts to execute a VBScript message box with the text "test".

   Source: Adapted from community discussion — kmordalv

   Next question

3. Question 393 · 527 in bank

   A security analyst at a company called ACME Commercial notices there is outbound traffic to a host IP that resolves to https://office365password.acme.co. The site’s standard VPN logon page is www.acme.com/logon. Which of the following is most likely true?

   • AThis is a normal password change URL.
   • BThe security operations center is performing a routine password audit.
   • CA new VPN gateway has been deployed.
   • DA social engineering attack is underway.

   Show answer

   Answer: D

   Explanation

   How interesting that after stressing the importance of gathering intelligence before making a decision on what is occuring, CompTIA then asks us to make an assumption about what is happening based on vague and limited information and with no intelligence gathering first. Which of the following is likely true? Well... do we know what the URL is for resetting a password? No. Do we know which user, or what the user did before making the request to this website? Also no. Next time you forget your password and a link is sent to your email to reset it look at the URL that you go to. It wont be the same as the login pages URL. It could be either A or D but, again, CompTIA refuses to give us enough information.

   Source: Adapted from community discussion — throughthefray

   Next question

4. Question 394 · 527 in bank

   A user clicks on a malicious adware link, and the malware successfully downloads to the machine. The malware has a script that invokes command-and-control activity. Which of the following actions is the best way to contain the incident without any additional impact?

   • ADisable the user account until the malware investigation is complete.
   • BReview EDR information to determine whether the file was detected and quarantined locally.
   • CBlock the server on the proxy and firewall.
   • DSubmit a recategorization update to the vendor.

   Show answer

   Answer: C

   Next question

5. Question 395 · 527 in bank

   A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

   • AOperating system version
   • BRegistry key values
   • COpen ports
   • DIP address

   Show answer

   Answer: B

   Explanation

   Correct. Registry key values are specific to Windows operating systems and are not typically scanned directly as part of vulnerability assessments. Registry key values might contain configuration settings, but vulnerability scans usually focus on the broader picture of identifying weaknesses in software, services, and configurations rather than specific values within the Windows registry.

   Source: Adapted from community discussion — kmordalv

   Next question

6. Question 396 · 527 in bank

   A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

   • A/etc/shadow
   • Bcurl localhost
   • C; printenv
   • Dcat /proc/self/

   Show answer

   Answer: A

   Explanation

   I don't understand why everyone is saying C to check printenv. Any hacker that finds an LFI is first going to check if they can read some globally readable files, typically this is going to be /etc/passwd on linux or C:/Windows/System32/drivers/etc/hosts. Depending So in the request form you're going to see something like this (or the B64 equivalent) `../../../../../etc/passwd`) If I was red teaming and got a hit on this, you best believe the next thing I'm typing in is ../../../../etc/shadow to see if I can read it, because if I can you can copy/paste both of those to a txt file and use unshadow in kali to get the creds of the user you want and own the box. If those aren't there, then the next thing I'm going to look for is ssh keys in one of the 5ish places that they normally are, or browse around for any plaintext credentials. checking for printenv during an LFI doesn't make sense because this assumes you already have command execution, and there's plenty other commands that would give you similar info to work off of, they may never execute that command.

   Source: Adapted from community discussion — [Removed]

   Next question

7. Question 397 · 527 in bank

   A security manager is looking at a third-party vulnerability metric (SMITTEN) to improve upon the company’s current method that relies on CVSSv3. Given the following:

   

   Which of the following vulnerabilities should be prioritized?

   • AVulnerability 1
   • BVulnerability 2
   • CVulnerability 3
   • DVulnerability 4

   Show answer

   Answer: B

   Next question

8. Question 398 · 527 in bank

   A company is in the process of implementing a vulnerability management program. Which of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

   • ANon-credentialed scanning
   • BPassive scanning
   • CAgent-based scanning
   • DCredentialed scanning

   Show answer

   Answer: B

   Explanation

   OT/ICS (Operational Technology and Industrial Control Systems) are probably really important, so taking it down due to scanning is a bad idea. Passive scanning is the least invasive and is just collecting the packets, but not performing additional analysis on it, which reduces the work capacity on the systems. I referenced the Sybex 003 study guide by Mike Chapple and Reidl. Page 82 Passive monitoring relies on capturing information about the network as traffic passes a location on a network link.... Unlike active and router-based monitoring, passive monitoring does not add additional traffic to the network. It also performs after-the- fact analysis, since packets must be captured and analyzed, rather than being recorded in real time as they are sent.

   Source: Adapted from community discussion — [Removed]

   Next question

9. Question 399 · 527 in bank

   Which of the following should be performed first when creating a BCP to ensure that all critical functions and financial implications have been considered?

   • AFailover test
   • BTabletop exercise
   • CSecurity policies
   • DBusiness impact analysis

   Show answer

   Answer: D

   Next question

10. Question 400 · 527 in bank

    Which of the following best describes root cause analysis?

    • AIt describes the tactics, techniques, and procedures used in an incident.
    • BIt provides a detailed path outlining the origin of an issue and how to eliminate it permanently.
    • CIt outlines the who-what-when-where-why, which is often used in conjunction with legal proceedings.
    • DIt generates a report of ongoing activities, including what was done, what is being done, and what will be done next.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 391. 527 questions available.