CS0-003 practice questions 451–460

1. Question 451 · 527 in bank

   Which of the following is best suited for determining the methods of an adversary?

   • AОWASP
   • BCyber Kill Chain
   • CMITRE ATT&CK
   • DDiamond Model of Intrusion Analysis

   Show answer

   Answer: C

   Next question

2. Question 452 · 527 in bank

   An organization adds an MSSP to supplement its security monitoring operations during weekends and holidays. Which of the following would best demonstrate procurement value to the Chief Information Security Officer?

   • AStakeholder validation metrics
   • BMean time to respond
   • CAlert volume
   • DNumber of escalations per week

   Show answer

   Answer: B

   Next question

3. Question 453 · 527 in bank

   Which of the following explains the reason a security analyst would map an attack route?

   • ATo find critical paths that can be used to stop an adversary from advancing
   • BTo create an inventory of all IT assets to import into a database
   • CTo operationalize intelligence gathered from a previous step in the investigation
   • DTo categorize the tactics according to the MITRE ATT&CK framework

   Show answer

   Answer: A

   Next question

4. Question 454 · 527 in bank

   The most recent vulnerability scan results show the following:

   

   The vulnerability team learned the following from the asset owners: • Server HQFIN01 is a financial transaction database server used in the company's largest business unit. • Server HQADMIN02 is utilized by an end user with administrator privileges to several critical applications. • No compensating controls exist for either issue. Which of the following would the vulnerability team most likely do to determine remediation prioritization?

   • AReview the BCP and prioritize the remediation of the asset that would take more time to bring online for operational use.
   • BContact the network and desktop engineering teams to discuss prioritizing the asset that is faster to remediate.
   • CReference the BIA to determine the value designation and prioritize vulnerability remediation of the more critical asset.
   • DIdentify the network placement and configuration of each asset, then prioritize the asset with the least recent backups.

   Show answer

   Answer: C

   Next question

5. Question 455 · 527 in bank

   A company’s policy is to follow NIST standards and use strong encryption to avoid disclosure of sensitive information in transit between any systems. An analyst reviews a lab web server and receives the following outputs:

   

   Which of the following should the analyst identify as the most concerning?

   • ATLS 1.0 is enabled.
   • BThe certificate is self-signed.
   • CSSLv3 is disabled.
   • DTLS 1.3 is not widely supported.
   • ETLS compression is disabled.

   Show answer

   Answer: A

   Next question

6. Question 456 · 527 in bank

   The Chief Information Security Officer wants the same level of security to be present whether a remote worker logs in at home or at a coffee shop. Which of the following should be recommended as a starting point?

   • ANon-persistent virtual desktop infrastructures
   • BPasswordless authentication
   • CStandard-issue laptops
   • DServerless workloads

   Show answer

   Answer: A

   Next question

7. Question 457 · 527 in bank

   A report contains IoC and TTP information for a zero-day exploit that leverages vulnerabilities in a specific version of a web application. Which of the following actions should a SOC analyst take first after receiving the report?

   • AImplement a vulnerability scan to determine whether the environment is at risk.
   • BBlock the IP addresses and domains from the report in the web proxy and firewalls.
   • CVerify whether the information is relevant to the organization.
   • DAnalyze the web application logs to identify any suspicious or malicious activity.

   Show answer

   Answer: C

   Next question

8. Question 458 · 527 in bank

   After updating the email client to the latest patch, only about 15% of the workforce is able to use email. Windows 10 users do not experience issues, but Windows 11 users have constant issues. Which of the following did the change management team fail to do?

   • AImplementation
   • BTesting
   • CRollback
   • DValidation

   Show answer

   Answer: B

   Next question

9. Question 459 · 527 in bank

   Which of the following does a security policy do?

   • AEstablishes a cost model for security activity
   • BIdentifies and clarifies security goals and objectives
   • CEnables management to define system access rules
   • DAllows management to define system recovery requirements

   Show answer

   Answer: B

   Next question

10. Question 460 · 527 in bank

    A vulnerability scan shows the following vulnerabilities in the environment:

    

    At the same time, the following security advisory was released: "A zero-day vulnerability with a CVSS score of 10 may be affecting your web server. The vendor is working on a patch or workaround." Which of the following actions should the security analyst take first?

    • AContact the web systems administrator and request that they shut down the asset.
    • BMonitor the patch releases for all items and escalate patching to the appropriate team.
    • CRun the vulnerability scan again to verify the presence of the critical finding and the zero-day vulnerability in the environment.
    • DForward the advisory to the web security team and initiate the prioritization strategy for the other vulnerabilities.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 451. 527 questions available.