CS0-003 practice questions 41–50

1. Question 41 · 527 in bank

   An incident response analyst is taking over an investigation from another analyst. The investigation has been going on for the past few days. Which of the following steps is most important during the transition between the two analysts?

   • AIdentify and discuss the lessons learned with the prior analyst.
   • BAccept all findings and continue to investigate the next item target.
   • CReview the steps that the previous analyst followed.
   • DValidate the root cause from the prior analyst.

   Show answer

   Answer: C

   Explanation

   Lessons learned is a root cause analysis key phrase. This is more about hand-off, in which you want to know what's been completed in the investigatory process before you take over.

   Source: Adapted from community discussion — LiveLaughToasterBath

   Next question

2. Question 42 · 527 in bank

   A company recently removed administrator rights from all of its end user workstations. An analyst uses CVSSv3.1 exploitability metrics to prioritize the vulnerabilities for the workstations and produces the following information:

   

   Which of the following vulnerabilities should be prioritized for remediation?

   • Anessie.explosion
   • Bvote.4p
   • Csweet.bike
   • Dgreat.skills

   Show answer

   Answer: D

   Explanation

   D) Great.skills Lower complexity (AC:L) and does not require special privileges (PR:N) or user interaction (UI:N), making it more likely to be exploited.

   Source: Adapted from community discussion — [Removed]

   Next question

3. Question 43 · 527 in bank

   A recent penetration test discovered that several employees were enticed to assist attackers by visiting specific websites and running downloaded files when prompted by phone calls. Which of the following would best address this issue?

   • AIncreasing training and awareness for all staff
   • BEnsuring that malicious websites cannot be visited
   • CBlocking all scripts downloaded from the internet
   • DDisabling all staff members’ ability to run downloaded applications

   Show answer

   Answer: A

   Explanation

   While I agree that A should be the answer as a whole. I must point out a flaw in the question itself. I hate to go all "english major" on this question, but the use of the word "entice" actually implies that the employees are being attracted or tempted by an offering of "pleasure, wealth, or advantage" in order to help the attackers. (im using the dictionary definition of entice in this case) The use of the word "entice" denotes that the employee is AWARE that they are helping an attacker in that moment. Based on how the question is worded, they are NOT being tricked.

   Source: Adapted from community discussion — throughthefray

   Next question

4. Question 44 · 527 in bank

   A security analyst at a company is reviewing an alert from the file integrity monitoring indicating a mismatch in the login. html file hash. After comparing the code with the previous version of the page source code, the analyst found the following code snippet added:

   

   Which of the following best describes the activity the analyst has observed?

   • AObfuscated links
   • BExfiltration
   • CUnauthorized changes
   • DBeaconing

   Show answer

   Answer: C

   Explanation

   While the unauthorized code snippet could potentially be used for exfiltration, the primary activity observed by the analyst is the unauthorized change to the login.html file. Exfiltration refers to the actual act of data being transferred out of the system, which hasn’t been confirmed in this scenario yet. The unauthorized change could indeed lead to exfiltration if the malicious code is executed and starts sending data to an external source. However, at this point, the analyst has only observed the unauthorized change, not the actual exfiltration of data. So I think the most accurate description of the observed activity is C. Unauthorized changes.

   Source: Adapted from community discussion — biggydanny

   Next question

5. Question 45 · 527 in bank

   A security administrator has been notified by the IT operations department that some vulnerability reports contain an incomplete list of findings. Which of the following methods should be used to resolve this issue?

   • ACredentialed scar
   • BExternal scan
   • CDifferential scan
   • DNetwork scan

   Show answer

   Answer: A

   Explanation

   A. Credentialed scan Here's why a credentialed scan is the appropriate choice: Credentialed Scan: In a credentialed scan, the scanning tool is granted appropriate credentials (username and password) to access the target systems. This level of access allows for a more comprehensive and accurate assessment of the systems. Credentialed scans can gather detailed information about the system's configuration, software, and vulnerabilities that may not be accessible in an external scan.

   Source: Adapted from community discussion — FoeMarc

   Next question

6. Question 46 · 527 in bank

   Select 2

   An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.)

   • ABeaconing
   • BDomain Name System hijacking
   • CSocial engineering attack
   • DOn-path attack
   • EObfuscated links
   • FAddress Resolution Protocol poisoning

   Show answer

   Answer: CE

   Explanation

   This is not A and C. Beaconing is not happening at all in the question. Data is not leaving the network. C and E. Social engineering via emailing only admins Obfuscated links because the concealed URL

   Source: Adapted from community discussion — [Removed]

   Next question

7. Question 47 · 527 in bank

   An organization enabled a SIEM rule to send an alert to a security analyst distribution list when ten failed logins occur within one minute. However, the control was unable to detect an attack with nine failed logins. Which of the following best represents what occurred?

   • AFalse positive
   • BTrue negative
   • CFalse negative
   • DTrue positive

   Show answer

   Answer: C

   Explanation

   The questions is stating that the control was unable to DETECT AN ATTACK with nine failed logon. Breaking down this sentece: There has been an attack and it wasn't detected. So the answer is False negative

   Source: Adapted from community discussion — RiccardoBellitto

   Next question

8. Question 48 · 527 in bank

   A cybersecurity analyst is tasked with scanning a web application to understand where the scan will go and whether there are URIs that should be denied access prior to more in-depth scanning. Which of following best fits the type of scanning activity requested?

   • AUncredentialed scan
   • BDiscovery scan
   • CVulnerability scan
   • DCredentialed scan

   Show answer

   Answer: B

   Explanation

   Correct A discovery scan is typically used to identify the scope of a web application and understand where the scan will go. This type of scan is often the first step in assessing a web application's security and helps the analyst determine which areas should be further examined or tested in-depth.

   Source: Adapted from community discussion — kmordalv

   Next question

9. Question 49 · 527 in bank

   Which of the following best describes the process of requiring remediation of a known threat within a given time frame?

   • ASLA
   • BMOU
   • CBest-effort patching
   • DOrganizational governance

   Show answer

   Answer: A

   Explanation

   Correct An SLA is a formal agreement between two parties that defines the level of service, responsibilities, and expectations. It often includes specific terms related to the time frame within which certain actions or services must be performed. Requiring remediation of a known threat within a given time frame can be part of an SLA related to cybersecurity or incident response, ensuring that security issues are addressed promptly and effectively.

   Source: Adapted from community discussion — kmordalv

   Next question

10. Question 50 · 527 in bank

    Which of the following risk management principles is accomplished by purchasing cyber insurance?

    • AAccept
    • BAvoid
    • CMitigate
    • DTransfer

    Show answer

    Answer: D

    Explanation

    Correct Purchasing cyber insurance is a way to transfer the financial risk associated with cyber threats and incidents to an insurance provider. When you buy cyber insurance, you are essentially transferring a portion of the potential financial losses resulting from a cyber incident to the insurer.

    Source: Adapted from community discussion — kmordalv

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 41. 527 questions available.