CS0-003 practice questions 81–90

1. Question 81 · 527 in bank

   A manufacturer has hired a third-party consultant to assess the security of an OT network that includes both fragile and legacy equipment. Which of the following must be considered to ensure the consultant does no harm to operations?

   • AEmploying Nmap Scripting Engine scanning techniques
   • BPreserving the state of PLC ladder logic prior to scanning
   • CUsing passive instead of active vulnerability scans
   • DRunning scans during off-peak manufacturing hours

   Show answer

   Answer: C

   Explanation

   Passive scanning involves monitoring the network traffic without sending any packets to the target systems. This approach can identify potential vulnerabilities based on the traffic that is observed, without the risk of interfering with sensitive equipment or network operations.

   Source: Adapted from community discussion — section8santa

   Next question

2. Question 82 · 527 in bank

   A team of analysts is developing a new internal system that correlates information from a variety of sources, analyzes that information, and then triggers notifications according to company policy. Which of the following technologies was deployed?

   • ASIEM
   • BSOAR
   • CIPS
   • DCERT

   Show answer

   Answer: A

   Explanation

   Triggering a notification would be a SIEM. If it was changing a firewall rule or other changes then that could be a SOAR.

   Source: Adapted from community discussion — HL2020

   Next question

3. Question 83 · 527 in bank

   Which of following would best mitigate the effects of a new ransomware attack that was not properly stopped by the company antivirus?

   • AInstall a firewall.
   • BImplement vulnerability management.
   • CDeploy sandboxing.
   • DUpdate the application blocklist.

   Show answer

   Answer: C

   Explanation

   I would go with C too as sandboxing is the only 'mitigating control' from the given options. The rest look to me as 'preventive controls'.

   Source: Adapted from community discussion — FT000

   Next question

4. Question 84 · 527 in bank

   A Chief Information Security Officer wants to implement security by design, starting with the implementation of a security scanning method to identify vulnerabilities, including SQL injection, RFI, XSS, etc. Which of the following would most likely meet the requirement?

   • AReverse engineering
   • BKnown environment testing
   • CDynamic application security testing
   • DCode debugging

   Show answer

   Answer: C

   Explanation

   Dynamic Application Security Testing (DAST) is a method used to detect vulnerabilities in running web applications. It works by analyzing the application in its operational state, simulating attacks to identify common vulnerabilities such as SQL injection, Remote File Inclusion (RFI), Cross-Site Scripting (XSS), and others.

   Source: Adapted from community discussion — tbbanz26

   Next question

5. Question 85 · 527 in bank

   A security analyst scans a host and generates the following output:

   

   Which of the following best describes the output?

   • AThe host is unresponsive to the ICMP request.
   • BThe host is running a vulnerable mail server.
   • CThe host is allowing unsecured FTP connections.
   • DThe host is vulnerable to web-based exploits.

   Show answer

   Answer: D

   Explanation

   This is an older version of Apache and the default page works There is not enough information to determine if ICMP responses would work The information shows no SMTP ports open The information show no FTP ports open

   Source: Adapted from community discussion — ScottT

   Next question

6. Question 86 · 527 in bank

   The security team at a company, which was a recent target of ransomware, compiled a list of hosts that were identified as impacted and in scope for this incident. Based on the following host list:

   

   Which of the following systems was most pivotal to the threat actor in its distribution of the encryption binary via Group Policy?

   • ASQL01
   • BWK10-Sales07
   • CWK7-Plant01
   • DDCEast01
   • EHQAdmin9

   Show answer

   Answer: D

   Explanation

   D: DCEast01 is listed as a Domain Controller running Windows Server 2016. Domain Controllers are critical in a Windows environment as they manage the network's security, including user authentication and Group Policy management. Group Policy is a feature in Active Directory (which is managed by Domain Controllers) that allows administrators to push configurations, including software installation and scripts, to multiple computers in the domain. If a threat actor compromised the Domain Controller, they could use Group Policy to distribute ransomware or other malicious binaries to all systems within the domain.

   Source: Adapted from community discussion — gomet2000

   Next question

7. Question 87 · 527 in bank

   After a security assessment was done by a third-party consulting firm, the cybersecurity program recommended integrating DLP and CASE to reduce analyst alert fatigue. Which of the following is the best possible outcome that this effort hopes to achieve?

   • ASIEM ingestion logs are reduced by 20%.
   • BPhishing alerts drop by 20%.
   • CFalse positive rates drop to 20%.
   • DThe MTTR decreases by 20%.

   Show answer

   Answer: C

   Explanation

   Reducing the rate of false positives is directly tied to reducing alert fatigue. Analysts spend a significant amount of time dealing with false positives, which can lead to burnout and missed genuine threats. By lowering the false positive rate, the quality of alerts improves, making the analysts work more efficient.

   Source: Adapted from community discussion — gomet2000

   Next question

8. Question 88 · 527 in bank

   Which of the following threat actors is most likely to target a company due to its questionable environmental policies?

   • AHacktivist
   • BOrganized crime
   • CNation-state
   • DLone wolf

   Show answer

   Answer: A

   Next question

9. Question 89 · 527 in bank

   A cybersecurity analyst is recording the following details: • ID • Name • Description • Classification of information • Responsible party In which of the following documents is the analyst recording this information?

   • ARisk register
   • BChange control documentation
   • CIncident response playbook
   • DIncident response plan

   Show answer

   Answer: A

   Explanation

   A risk register is a document used to record information about identified risks within an organization. It typically includes details such as the risk ID, risk name, description of the risk, classification of the risk (e.g., impact and likelihood), and the responsible party for managing or mitigating the risk. Recording this information in a risk register helps organizations systematically manage and prioritize risks to their assets and operations. chatgpt

   Source: Adapted from community discussion — section8santa

   Next question

10. Question 90 · 527 in bank

    Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

    • ADevelop a call tree to inform impacted users
    • BSchedule a review with all teams to discuss what occurred
    • CCreate an executive summary to update company leadership
    • DReview regulatory compliance with public relations for official notification

    Show answer

    Answer: B

    Explanation

    Scheduling a review with all teams to discuss what occurred allows for a comprehensive post-incident analysis and facilitates a collective understanding of the incident's causes, impact, and response effectiveness. This review involves key stakeholders from various teams involved in incident response, including technical teams, management, legal, and communication teams. By gathering input from all relevant parties, the organization can identify strengths, weaknesses, and areas for improvement in its incident response process.

    Source: Adapted from community discussion — BanesTech

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CS0-003 practice, question 81. 527 questions available.