CS0-003 practice questions 401–410

1. Question 401 · 527 in bank

   Which of the following best explains the importance of utilizing an incident response playbook?

   • AIt prioritizes the business-critical assets for data recovery.
   • BIt establishes actions to execute when inputs trigger an event.
   • CIt documents the organization asset management and configuration.
   • DIt defines how many disaster recovery sites should be staged.

   Show answer

   Answer: B

   Next question

2. Question 402 · 527 in bank

   Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

   • ARouting table, registers, physical memory, archival media, hard disk, physical configuration
   • BRouting table, registers, physical memory, temporary partition, hard disk, physical configuration
   • CCache, routing table, physical memory, network topology, temporary partition, hard disk
   • DCache, routing table, physical memory, temporary partition, hard disk, physical configuration

   Show answer

   Answer: D

   Next question

3. Question 403 · 527 in bank

   A security analyst needs to support an organization’s legal case against a threat actor. Which of the following processes provides the best way to assist in the prosecution of the case?

   • AChain of custody
   • BEvidence gathering
   • CSecuring the scene
   • DForensic analysis

   Show answer

   Answer: A

   Next question

4. Question 404 · 527 in bank

   A security analyst runs tcpdump on the 10.203.10.22 machine and observes thousands of packets as shown below:

   

   Which of the following activities explains the tcpdump output?

   • AIncoming nmap -sA scan
   • Bhping3 --udp scan over the network
   • CC2 communications leaving the network
   • DMalware beaconing

   Show answer

   Answer: A

   Next question

5. Question 405 · 527 in bank

   Which of the following is the best metric to use when reviewing and addressing findings that caused an incident?

   • AMean time to restore
   • BMean time to respond
   • CMean time to remediate
   • DMean time to detect

   Show answer

   Answer: C

   Next question

6. Question 406 · 527 in bank

   A security analyst working for an airline is prioritizing vulnerabilities found on a system. The system has the following requirements: • Can store periodically audited documents required for takeoffs and landings • Can keep critical records regarding the company’s operations • Data can be made public upon request and authorization Which of the following vulnerabilities should be remediated first?

   • AA broken access control vulnerability impacting data integrity
   • BA heap overflow vulnerability impacting the system’s usability
   • CA DoS vulnerability impacting the system’s availability
   • DA zero-day vulnerability impacting the system’s confidentiality

   Show answer

   Answer: A

   Next question

7. Question 407 · 527 in bank

   An organization wants to establish a disaster recovery plan for critical applications that are hosted on premises. Which of the following is the first step to prepare for supporting this new requirement?

   • AChoose a vendor to utilize for the disaster recovery location.
   • BEstablish prioritization of continuity from data and business owners.
   • CNegotiate vendor agreements to support disaster recovery capabilities.
   • DAdvise the leadership team that a geographical area for recovery must be defined.

   Show answer

   Answer: B

   Next question

8. Question 408 · 527 in bank

   A junior security analyst opened ports on the company’s firewall, and the company experienced a data breach. Which of the following most likely caused the data breach?

   • AEnvironmental hacktivist
   • BAccidental insider threat
   • CNation-state
   • DOrganized crime group

   Show answer

   Answer: B

   Next question

9. Question 409 · 527 in bank

   A user is suspected of violating policy by logging in to a Linux VM during non-business hours. Which of the following system files is the best way to track the user’s activities?

   • A/var/log/secure
   • B/etc/motd
   • C/var/log/messages
   • D/etc/passwd

   Show answer

   Answer: A

   Next question

10. Question 410 · 527 in bank

    Which of the following risk management decisions should be considered after evaluating all other options?

    • ATransfer
    • BAcceptance
    • CMitigation
    • DAvoidance

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 401. 527 questions available.