CS0-003 practice questions 71–80

1. Question 71 · 527 in bank

   A web developer reports the following error that appeared on a development server when testing a new application:

   

   Which of the following tools can be used to identify the application’s point of failure?

   • AOpenVAS
   • BAngry IP scanner
   • CImmunity debugger
   • DBurp Suite

   Show answer

   Answer: C

   Explanation

   Agree with C. Immunity debugger allows you to debug a software and reverse engineer. OpenVAS is a vulnerability scanner, Angry IP Scanner is a network scanner, and Burp Suite is an interception proxy.

   Source: Adapted from community discussion — mightybluepen

   Next question

2. Question 72 · 527 in bank

   Which of the following describes a contract that is used to define the various levels of maintenance to be provided by an external business vendor in a secure environment?

   • AMOU
   • BNDA
   • CBIA
   • DSLA

   Show answer

   Answer: D

   Next question

3. Question 73 · 527 in bank

   A security team is concerned about recent Layer 4 DDoS attacks against the company website. Which of the following controls would best mitigate the attacks?

   • ABlock the attacks using firewall rules
   • BDeploy an IPS in the perimeter network
   • CRoll out a CDN
   • DImplement a load balancer

   Show answer

   Answer: C

   Explanation

   Roll out a CDN (Content Delivery Network) is usually the most effective. CDNs can help distribute network traffic across a network of distributed servers. This can effectively mitigate DDoS attacks by dispersing the traffic geographically and making it more difficult for attackers to overwhelm a single point of the network. Additionally, many CDN providers offer DDoS protection as part of their services, with the ability to absorb large amounts of traffic and to identify and block malicious traffic patterns.

   Source: Adapted from community discussion — section8santa

   Next question

4. Question 74 · 527 in bank

   An analyst is reviewing system logs while threat hunting:

   

   Which of the following hosts should be investigated first?

   • APC1
   • BPC2
   • CPC3
   • DPC4
   • EPC5

   Show answer

   Answer: C

   Explanation

   Ok so PC1 should definitely be investigated as wininit spawning lsass.exe and svchost should only be during boot sequence and it should all happen within a few seconds. This combination is always suspicious as malware like Mimikatz use these processes for privesc and cred dumping. It's hard to tell if PC1 is booting up as we don't have enough accuracy in the timestamps so we could presume that this is a normal boot sequence, but any time outside of the boot sequence this should be investigated. However, this is CompTIA and they won't expect that much thought for an answer, they're likely looking for C, the 'typo' in procdunp covering up a malicious file.

   Source: Adapted from community discussion — kinny4000

   Next question

5. Question 75 · 527 in bank

   An organization needs to bring in data collection and aggregation from various endpoints. Which of the following is the best tool to deploy to help analysts gather this data?

   • ADLP
   • BNAC
   • CEDR
   • DNIDS

   Show answer

   Answer: C

   Explanation

   I've picked 'C' based on the question wording highlighting endpoints. EDR - Endpoint Detection & Response which could be configured to send results to a central server. DLP - Data Loss Prevention will monitor external data NAC - Network Access Control will stop devices accessing the network under given circumstances NIDS - Network Intrusion Detection System would not normally be positioned anywhere but at the edge.

   Source: Adapted from community discussion — ScottT

   Next question

6. Question 76 · 527 in bank

   A regulated organization experienced a security breach that exposed a list of customer names with corresponding PII data. Which of the following is the best reason for developing the organization's communication plans?

   • AFor the organization's public relations department to have a standard notification
   • BTo ensure incidents are immediately reported to a regulatory agency
   • CTo automate the notification to customers who were impacted by the breach
   • DTo have approval from executive leadership on when communication should occur

   Show answer

   Answer: B

   Explanation

   If you're a regulated organization, it's not up to executive leadership to decide when communication occurs. You are bound by the rules of the regulatory agency of how and when the communication must occur.

   Source: Adapted from community discussion — jspecht

   Next question

7. Question 77 · 527 in bank

   Following an incident, a security analyst needs to create a script for downloading the configuration of all assets from the cloud tenancy. Which of the following authentication methods should the analyst use?

   • AMFA
   • BUser and password
   • CPAM
   • DKey pair

   Show answer

   Answer: D

   Explanation

   D. Key pair authentication. Key pair authentication involves using public-private key pairs to authenticate and establish secure connections between systems. This method is commonly used in cloud environments for secure access to resources and data. It provides a more secure and reliable authentication mechanism compared to using usernames and passwords, as it eliminates the risk of password-based attacks such as brute force or credential stuffing. In this scenario, using a key pair for authentication would ensure secure access to the cloud tenancy for downloading configurations without the need to rely on potentially less secure methods such as usernames and passwords. ChatGPT

   Source: Adapted from community discussion — section8santa

   Next question

8. Question 78 · 527 in bank

   A penetration tester is conducting a test on an organization's software development website. The penetration tester sends the following request to the web interface:

   

   Which of the following exploits is most likely being attempted?

   • ASQL injection
   • BLocal file inclusion
   • CCross-site scripting
   • DDirectory traversal

   Show answer

   Answer: A

   Explanation

   The UNION statement makes this easily an SQL injection, other identifiers could be single ', 1= 1, logs that contain null, null fields etc.

   Source: Adapted from community discussion — [Removed]

   Next question

9. Question 79 · 527 in bank

   The security team reviews a web server for XSS and runs the following Nmap scan:

   

   Which of the following most accurately describes the result of the scan?

   • AAn output of characters > and " as the parameters used m the attempt
   • BThe vulnerable parameter ID http://172.31.15.2/1.php?id-2 and unfiltered characters returned
   • CThe vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
   • DThe vulnerable parameter and characters > and " with a reflected XSS attempt

   Show answer

   Answer: D

   Explanation

   I was originally going to go with B, but the syntax of the parameter is incorrect at the end (has id-2 and not id=2) which negated this choice as a potentially valid answer. This would make D the only viable correct answer.

   Source: Adapted from community discussion — Narobi

   Next question

10. Question 80 · 527 in bank

    Two employees in the finance department installed a freeware application that contained embedded malware. The network is robustly segmented based on areas of responsibility. These computers had critical sensitive information stored locally that needs to be recovered. The department manager advised all department employees to turn off their computers until the security team could be contacted about the issue. Which of the following is the first step the incident response staff members should take when they arrive?

    • ATurn on all systems, scan for infection, and back up data to a USB storage device.
    • BIdentify and remove the software installed on the impacted systems in the department.
    • CExplain that malware cannot truly be removed and then reimage the devices.
    • DLog on to the impacted systems with an administrator account that has privileges to perform backups.
    • ESegment the entire department from the network and review each computer offline.

    Show answer

    Answer: E

    Explanation

    Im choosing E because segmenting the department from the network would prevent the potential spread of malware to other parts of the network.

    Source: Adapted from community discussion — voiddraco

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 71. 527 questions available.