CS0-003 practice questions 511–520

1. Question 511 · 527 in bank

   A security analyst is analyzing two vulnerabilities on a critical router. The analyst must choose only one to patch during this maintenance window. Given the following information: Vulnerability 1 has not received a CVSS score. The vulnerability has the following characteristics: • Must be logged in to the router, but elevated privileges are not required • Trivial to exploit, but user interaction is needed • Low impact to availability, but high impact to confidentiality and integrity Vulnerability 2 has a CVSS score of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H Which of the following conclusions should the analyst reach?

   • APatch Vulnerability 1 because it has a higher overall impact when looking at confidentiality, integrity, and availability, and it requires lower privileges.
   • BPatch Vulnerability 1 because it is easier to exploit and has a higher impact on confidentiality.
   • CPatch Vulnerability 2 because it has a higher overall impact when looking at confidentiality, integrity, and availability, and it can be exploited by a privileged user.
   • DPatch Vulnerability 2 because it is easier to exploit, has a high impact on availability, and it is more likely to be exploited remotely.

   Show answer

   Answer: D

   Next question

2. Question 512 · 527 in bank

   Which of the following should a cybersecurity analyst utilize when a notification is inaccurate?

   • AData enrichment
   • BDashboard creation
   • CThreat hunting
   • DAlert tuning

   Show answer

   Answer: D

   Next question

3. Question 513 · 527 in bank

   Which of the following are characteristics of Zero Trust Network Access?

   • AApplication programming interface security and continuous monitoring
   • BA gateway controller and agent flows
   • CVirtualization and data protection
   • DAn attack surface and a protect surface

   Show answer

   Answer: D

   Next question

4. Question 514 · 527 in bank

   A security operations (SOC) manager develops response mechanisms as part of playbook development efforts. The SOC manager needs to accomplish the following: • Document adversarial activities. • Map adversarial activities to a linear progression of sequential phases. • Provide broad coverage of threat actions without addressing specific tactics, techniques, and procedures (TTPs). Which of the following is the most reliable source for this information?

   • AMITRE ATT&CK
   • BCyber COBRA
   • CDiamond Model of Intrusion Analysis
   • DCyber Kill Chain

   Show answer

   Answer: D

   Next question

5. Question 515 · 527 in bank

   An analyst reviews alerts that indicate a number of different users had a spike in login attempts from the same IP. Using the security information and event management (SIEM) system, the analyst finds that a number of users received the following email:

   

   Which of the following best describes this activity?

   • AURL shortening
   • BWhaling
   • CSpoofing
   • DSocial engineering

   Show answer

   Answer: D

   Next question

6. Question 516 · 527 in bank

   An analyst reviews code for a sensitive application for their company and uploads it to an AI platform. This application is critical to the company's business operations. Which of the following risks is most important for the analyst to consider?

   • AHallucinations
   • BMalicious prompts
   • CData exposure
   • DModel poisoning

   Show answer

   Answer: C

   Next question

7. Question 517 · 527 in bank

   A spillage incident results in the access of controlled information across multiple unauthorized business units. Which of the following response techniques should be implemented first?

   • AAnalysis and triage
   • BContainment and isolation
   • CEvidence and legal hold
   • DEscalation and monitoring

   Show answer

   Answer: B

   Next question

8. Question 518 · 527 in bank

   An analyst uses an AI platform to help correlate events. The AI output contains events that did not happen. This results in inaccurate correlations. Which of the following best describes what has occurred?

   • AHallucinations
   • BData exposure
   • CMalicious prompts
   • DModel poisoning

   Show answer

   Answer: A

   Next question

9. Question 519 · 527 in bank

   Which of the following best explains the importance of security orchestration, automation, and response for security operation activities?

   • AImplementing infrastructure as code in the organization
   • BSupporting the team's management of remediation tasks
   • CDeploying general scripts for automating security engineering operations
   • DCollecting threat intelligence feeds for improved threat response

   Show answer

   Answer: B

   Next question

10. Question 520 · 527 in bank

    Which of the following is the term for a predefined set of automated actions that incident responders and SOC analysts can use to enhance operations?

    • AThreat modeling
    • BDetection set
    • CCVSS
    • DPlaybooks

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 511. 527 questions available.