CS0-003 practice questions 51–60

1. Question 51 · 527 in bank

   A recent audit of the vulnerability management program outlined the finding for increased awareness of secure coding practices. Which of the following would be best to address the finding?

   • AEstablish quarterly SDLC training on the top vulnerabilities for developers
   • BConduct a yearly inspection of the code repositories and provide the report to management.
   • CHire an external penetration test of the network
   • DDeploy more vulnerability scanners for increased coverage

   Show answer

   Answer: A

   Explanation

   A) quarterly SDLC training SDLC = software development lifecycle. The devs don't have the best coding practices to avoid vulnerabilities because they are not trained enough, nor aware of it. Regular training can mitigate this risk.

   Source: Adapted from community discussion — [Removed]

   Next question

2. Question 52 · 527 in bank

   Select 2

   An organization has deployed a cloud-based storage system for shared data that is in phase two of the data life cycle. Which of the following controls should the security team ensure are addressed? (Choose two.)

   • AData classification
   • BData destruction
   • CData loss prevention
   • DEncryption
   • EBackups
   • FAccess controls

   Show answer

   Answer: DF

   Explanation

   I believe this is D and F. Data Life Cycle: 1. Create 2. Storage 3. Usage 4. Sharing 5. Archive 6 Destruction Data Classification -- Create (1) Data Destruct -- Destruction (6) Data Loss Prevention -- Usage (3), Share (4) Encryption -- Storage (2), Usage (3) Backups -- Archive (5) Access Controls -- Storage (2)

   Source: Adapted from community discussion — indyrckstar

   Next question

3. Question 53 · 527 in bank

   An analyst is conducting routine vulnerability assessments on the company infrastructure. When performing these scans, a business-critical server crashes, and the cause is traced back to the vulnerability scanner. Which of the following is the cause of this issue?

   • AThe scanner is running without an agent installed.
   • BThe scanner is running in active mode.
   • CThe scanner is segmented improperly
   • DThe scanner is configured with a scanning window

   Show answer

   Answer: B

   Explanation

   Correct These scans can sometimes overload or disrupt target systems, especially if they are not configured or managed properly. In some cases, active scans can trigger vulnerabilities or cause service disruptions, leading to unexpected issues like a server crash.

   Source: Adapted from community discussion — kmordalv

   Next question

4. Question 54 · 527 in bank

   An organization's threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native Windows tools to bypass system controls and execute commands with privileged credentials. Which of the following controls would be most effective to reduce the rate of success of such attempts?

   • ASet user account control protection to the most restrictive level on all devices
   • BImplement MFA requirements for all internal resources
   • CHarden systems by disabling or removing unnecessary services
   • DImplement controls to block execution of untrusted applications

   Show answer

   Answer: C

   Explanation

   Sadly there's a character limit so I can't knowledge dump, but the answer is indeed C. When you disable unnecessary services, they can't privilege escalate. Toaster and the ones below me are thinking you privesc on the machine, that's rarely the case on initial entry, you'll get creds, scan the internal network for services like SMB, WinRM, SSH, SQL, internal web hosts, etc. And blast found creds at those. There's linux apps like crackmapexec that will spray at every open SMB connection and let you know if they're local admin on that machine, evilwinRM will basically give you a command prompt, and you use your initial creds to find more creds. Someone maybe left some powershell history, has an insecure custom app or path, tons of ways. This happens every day and by hardening the system you can prevent or at least contain the threat.

   Source: Adapted from community discussion — [Removed]

   Next question

5. Question 55 · 527 in bank

   A new zero-day vulnerability was released. A security analyst is prioritizing which systems should receive deployment of compensating controls deployment first. The systems have been grouped into the categories shown below:

   

   Which of the following groups should be prioritized for compensating controls?

   • AGroup A
   • BGroup B
   • CGroup C
   • DGroup D

   Show answer

   Answer: C

   Explanation

   Vulnerability MUST be present, so BCD, highest priority first but D has mitigating controls so now BC, C has no mitigating controls and both medium so it is the choice for prioritization

   Source: Adapted from community discussion — ms123451

   Next question

6. Question 56 · 527 in bank

   A Chief Information Security Officer wants to map all the attack vectors that the company faces each day. Which of the following recommendations should the company align their security controls around?

   • AOSSTMM
   • BDiamond Model of Intrusion Analysis
   • COWASP
   • DMITRE ATT&CK

   Show answer

   Answer: D

   Explanation

   D. MITRE ATT&CK. The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a comprehensive knowledge base that provides detailed information about various attack techniques and tactics employed by adversaries. It categorizes and describes different attack vectors, tactics, and techniques used in real-world cyberattacks. Organizations can use the MITRE ATT&CK framework to understand the threats they face, map security controls to specific attack techniques, and develop effective defensive strategies. While options A (OSSTMM), B (Diamond Model of Intrusion Analysis), and C (OWASP) are valuable resources for specific aspects of cybersecurity and threat analysis, they do not provide the same level of detailed attack vector mapping and coverage as the MITRE ATT&CK framework, which is specifically designed for this purpose.

   Source: Adapted from community discussion — FoeMarc

   Next question

7. Question 57 · 527 in bank

   During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

   • AConduct regular red team exercises over the application in production
   • BEnsure that all implemented coding libraries are regularly checked
   • CUse application security scanning as part of the pipeline for the CI/CD flow
   • DImplement proper input validation for any data entry form

   Show answer

   Answer: C

   Explanation

   C. Use application security scanning as part of the pipeline for the CI/CD flow. Explanation: Continuous Integration/Continuous Deployment (CI/CD) pipelines are an integral part of modern software development practices. By incorporating application security scanning into the CI/CD pipeline, vulnerabilities can be identified and addressed at various stages of development, including during the build and deployment processes.

   Source: Adapted from community discussion — nmap_king_22

   Next question

8. Question 58 · 527 in bank

   Which of the following actions would an analyst most likely perform after an incident has been investigated?

   • ARisk assessment
   • BRoot cause analysis
   • CIncident response plan
   • DTabletop exercise

   Show answer

   Answer: B

   Explanation

   After an incident has been investigated, one of the most important actions is to perform a root cause analysis. Root cause analysis helps in identifying the underlying reasons or factors that led to the incident in the first place. By understanding the root causes, organizations can implement corrective actions to prevent similar incidents from occurring in the future. This analysis is crucial for improving the overall security posture and resilience of the organization. The options A, C and D are typically done before an incident occurs

   Source: Adapted from community discussion — kmordalv

   Next question

9. Question 59 · 527 in bank

   After completing a review of network activity, the threat hunting team discovers a device on the network that sends an outbound email via a mail client to a non-company email address daily at 10:00 p.m. Which of the following is potentially occurring?

   • AIrregular peer-to-peer communication
   • BRogue device on the network
   • CAbnormal OS process behavior
   • DData exfiltration

   Show answer

   Answer: D

   Explanation

   I would say D. Data Exfiltration because it is unexpected outbound communication. Especially because it's been happening daily and the analyst is just now discovering it. You can find rogue devices with scans or sweeps according to Certmaster but I think they would've gave us more information if they wanted us to choose rogue devices.

   Source: Adapted from community discussion — Kmelaun

   Next question

10. Question 60 · 527 in bank

    A vulnerability scanner generates the following output:

    

    The company has an SLA for patching that requires time frames to be met for high-risk vulnerabilities. Which of the following should the analyst prioritize first for remediation?

    • AOracle JDK
    • BCisco Webex
    • CRedis Server
    • DSSL Self-signed Certificate

    Show answer

    Answer: A

    Explanation

    According to CVSS, vulnerabilities are classified as follows: none (0.0), low (0.1-3.9), medium (4.0-6.9), high (7.0-8.9), critical (9.0-10.0) If The company has an SLA for patching that requires time frames to be met for high-risk vulnerabilities, means that the Redis vulnerability will be covered so it would not be a vulnerability that the analyst should be concerned about. It seems that the SLA does not cover Extremely High Risk (critical) vulnerabilities. Yes I know, it is a little hard to believe but you have to think about what CompTia wants us to think with the question. Since this is a resurfaced vulnerability and the number of days, the analyst should analyze whether this is a patched vulnerability or, on the contrary, a new vulnerability that has been found.

    Source: Adapted from community discussion — kmordalv

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 51. 527 questions available.