CS0-003 practice questions 471–480

1. Question 471 · 527 in bank

   An after-action review of a ransomware attack on a company identified deficiencies in responsiveness and consistency. Which of the following choices would best facilitate improvement of these deficiencies?

   • ALeverage a SIEM.
   • BUtilize threat intelligence sharing.
   • CSource multiple threat feeds.
   • DImplement SOAR.

   Show answer

   Answer: D

   Next question

2. Question 472 · 527 in bank

   A security analyst is performing a malware analysis on a device and receives the following instructions: • Reduce the blast radius of the potential threat. • Preserve forensic data for post-incident analysis. • If securely possible, preserve connectivity for live analysis. Which of the following will best help the analyst during the investigation?

   • AConfigure an EDR agent to isolate the network with authorized exceptions to the NOC VLAN.
   • BExecute a SOAR playbook to trigger a malware scan on the company's assets.
   • CUse file integrity monitoring to determine if the suspicious file was modified.
   • DCollect the suspicious file using SFTP and reimage the device.

   Show answer

   Answer: A

   Next question

3. Question 473 · 527 in bank

   Which of the following is the practice of controlling how evidence is handled to ensure its integrity during an investigation?

   • AChain of custody
   • BRoot cause analysis
   • CIncident response
   • DEvidence collection

   Show answer

   Answer: A

   Next question

4. Question 474 · 527 in bank

   A security manager reviews the permissions for the approved users of a shared folder and finds accounts that are not on the approved access list. While investigating an incident, a user discovers data discrepancies in the file. Which of the following best describes this activity?

   • AFilesystem anomaly
   • BIllegal software
   • CUnauthorized changes
   • DData exfiltration

   Show answer

   Answer: C

   Next question

5. Question 475 · 527 in bank

   A SOC analyst is reviewing the weekly EDR report. The report shows that the same application was blocked once every 24 hours. Which of the following tools should the analyst use to further investigate the incident?

   • ARegistry Editor
   • Bservices.msc
   • CTask Scheduler
   • DMSConfig

   Show answer

   Answer: C

   Next question

6. Question 476 · 527 in bank

   A finance department employee opens an unsolicited email that contains a malicious payload. The payload quickly spreads through the finance department, but does not affect other departments. Which of the following best explains why the payload does not affect all departments?

   • AOS version
   • BOffline computers
   • CFirewall configuration
   • DNetwork segmentation

   Show answer

   Answer: D

   Next question

7. Question 477 · 527 in bank

   A security analyst is responding to an incident that is related to an unauthorized communication between systems. While triaging the event, the analyst obtains the following outputs:

   

   Which of the following commands should the analyst use to terminate the malicious session?

   • Akill -9 4347
   • Bkill -9 6015
   • Ckill -9 701
   • Dkill -9 5996

   Show answer

   Answer: D

   Next question

8. Question 478 · 527 in bank

   Which of the following explains why a company would consider enriching data before sending it to the SIEM?

   • ATo prevent injection attacks against the log management system
   • BTo reduce the amount and cost of data storage for security incidents
   • CTo provide more information to SOC analysts when analyzing events
   • DTo normalize the data before saving it to the database tables

   Show answer

   Answer: C

   Next question

9. Question 479 · 527 in bank

   A company suspects a coordinated effort to attack their platform. Web server logs show malicious activity from many different source IP addresses located in different countries. Which of the following will best help a security analyst identify the requests connected to this campaign?

   • AModify the web server logs to include the X-Forwarded-For header.
   • BCreate a custom SIEM query to integrate threat intel IoCs associated with the threat actor.
   • CEnrich the web server request logs with full WHOIS data on all available sources.
   • DAdd GeoIP location for the source IP addresses to the log entries.

   Show answer

   Answer: A

   Next question

10. Question 480 · 527 in bank

    The DevSecOps team is remediating an SSRF issue on the company's public-facing website. Which of the following is the best mitigation technique to address this issue?

    • APlace a WAF in front of the web server.
    • BInstall a CASB in front of the web server
    • CPut a forward proxy in front of the web server.
    • DImplement MFA in front of the web server

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 471. 527 questions available.