CS0-003 practice questions 61–70

1. Question 61 · 527 in bank

   A web application team notifies a SOC analyst that there are thousands of HTTP/404 events on the public-facing web server. Which of the following is the next step for the analyst to take?

   • AInstruct the firewall engineer that a rule needs to be added to block this external server
   • BEscalate the event to an incident and notify the SOC manager of the activity
   • CNotify the incident response team that there is a DDoS attack occurring
   • DIdentify the IP/hostname for the requests and look at the related activity

   Show answer

   Answer: D

   Explanation

   Identifying the IP/hostname for the requests and looking at the related activity is the first step in understanding the nature of the issue. This step is crucial for making informed decisions about how to respond to the situation. Once the analyst has gathered more information, they can then decide whether further escalation or actions are necessary, such as alerting the incident response team or notifying higher management.

   Source: Adapted from community discussion — kmordalv

   Next question

2. Question 62 · 527 in bank

   Which of the following best describes the reporting metric that should be utilized when measuring the degree to which a system application, or user base is affected by an uptime availability outage?

   • ATimeline
   • BEvidence
   • CImpact
   • DScope

   Show answer

   Answer: C

   Next question

3. Question 63 · 527 in bank

   A security analyst needs to provide evidence of regular vulnerability scanning on the company's network for an auditing process. Which of the following is an example of a tool that can produce such evidence?

   • AOpenVAS
   • BBurp Suite
   • CNmap
   • DWireshark

   Show answer

   Answer: A

   Explanation

   Agree with the answer A. OpenVAS is the only vulnerability scanner out of the 4. It is an open source vulnerability scanner.

   Source: Adapted from community discussion — mightybluepen

   Next question

4. Question 64 · 527 in bank

   A security analyst performs a vulnerability scan. Based on the metrics from the scan results, the analyst must prioritize which hosts to patch. The analyst runs the tool and receives the following output:

   

   Which of the following hosts should be patched first, based on the metrics?

   • Ahost01
   • Bhost02
   • Chost03
   • Dhost04

   Show answer

   Answer: C

   Explanation

   host 3 needs to be patched first based on the fact that it's actively being exploited, it's a high value target, and the vulnerability gives the attacker remote code execution on the system. However, it is just 4 hosts - just patch them all.

   Source: Adapted from community discussion — jspecht

   Next question

5. Question 65 · 527 in bank

   An organization receives a legal hold request from an attorney. The request pertains to emails related to a disputed vendor contract. Which of the following is the best step for the security team to take to ensure compliance with the request?

   • APublicly disclose the request to other vendors
   • BNotify the departments involved to preserve potentially relevant information
   • CEstablish a chain of custody starting with the attorney's request
   • DBack up the mailboxes on the server and provide the attorney with a copy

   Show answer

   Answer: B

   Explanation

   Upon receiving a legal hold notice, the first step is typically to ensure that all potentially relevant information is preserved. This usually involves notifying all custodians of the information, such as relevant departments and employees, to halt any data deletion or alteration processes that might normally occur. It's essential that they are aware of the need to preserve information related to the specific matter.

   Source: Adapted from community discussion — section8santa

   Next question

6. Question 66 · 527 in bank

   A company has the following security requirements: • No public IPs • All data secured at rest • No insecure ports/protocols After a cloud scan is completed a security analyst receives reports that several misconfigurations are putting the company at risk. Given the following cloud scanner output:

   

   Which of the following should the analyst recommend be updated first to meet the security requirements and reduce risks?

   • AVM_PRD_DB
   • BVM_DEV_DB
   • CVM_DEV_Web02
   • DVM_PRD_Web01

   Show answer

   Answer: A

   Explanation

   Picking A. Basically has everything opposite to the question outlined: • No public IPs • All data secured at rest • No insecure ports/protocols But VM_PRD_DB has: • public • no encryption • port 80 (http), which is non-secure version

   Source: Adapted from community discussion — mightybluepen

   Next question

7. Question 67 · 527 in bank

   Which of the following best describes the actions taken by an organization after the resolution of an incident that addresses issues and reflects on the growth opportunities for future incidents?

   • ALessons learned
   • BScrum review
   • CRoot cause analysis
   • DRegulatory compliance

   Show answer

   Answer: A

   Next question

8. Question 68 · 527 in bank

   An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

   • AProprietary systems
   • BLegacy systems
   • CUnsupported operating systems
   • DLack of maintenance windows

   Show answer

   Answer: A

   Explanation

   I agreed with the comments of other colleagues below who selected answer A, had chosen B and spent a good amount of time reviewing it. After in-depth analysis, I realized and came to the conclusion that option A, “Proprietary Systems”, is the most appropriate. Proprietary systems are those controlled and managed by a specific vendor, and the company does not have the ability to make changes or updates without the vendor's assistance. This is evident in the situation described, where two critical systems cannot be updated due to a vendor device that the company does not have access to. On the other hand, legacy systems, which are older systems that are still in use, can be accessed and potentially updated by the company. However, in this scenario, the problem arises from systems that the company does not have access to, which is a characteristic of proprietary systems.

   Source: Adapted from community discussion — Jhonys

   Next question

9. Question 69 · 527 in bank

   An analyst is becoming overwhelmed with the number of events that need to be investigated for a timeline. Which of the following should the analyst focus on in order to move the incident forward?

   • AImpact
   • BVulnerability score
   • CMean time to detect
   • DIsolation

   Show answer

   Answer: A

   Explanation

   But, if you're overwhelmed by tickets surely acting on the tickets that have the most impact is more worthwhile? Ideally, you would reduce MTTD but I think given the question states the analyst is overwhelmed that you should prioritise the high impact tickets.

   Source: Adapted from community discussion — stolleryp

   Next question

10. Question 70 · 527 in bank

    To minimize the impact of a security incident, a cybersecurity analyst has configured audit settings in the organization’s cloud services. Which of the following security controls has the analyst configured?

    • APreventive
    • BCorrective
    • CDirective
    • DDetective

    Show answer

    Answer: D

    Explanation

    The security control that the cybersecurity analyst has configured by setting up audit settings in the organization's cloud services is: D. Detective Detective controls are implemented to detect or discover security incidents or events. In this case, configuring audit settings allows the analyst to monitor and detect any unusual or unauthorized activities within the cloud services. These controls help in identifying potential security incidents so that appropriate actions can be taken to mitigate the impact.

    Source: Adapted from community discussion — naija4life

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 61. 527 questions available.