CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 11:

  The Chief Information Security Officer (CISO) of a large management firm has selected a cybersecurity framework that will help the organization demonstrate its investment in tools and systems to protect its data.

  Which of the following did the CISO most likely select?

  A. PCI DSS
  B. COBIT
  C. ISO 27001
  D. ITIL
  C. ISO 27001

  ---

  Explanation

  ISO 27001 is an international standard that establishes a framework for implementing, maintaining, and improving an information security management system (ISMS). It helps organizations demonstrate their commitment to protecting their data and complying with various regulations and best practices. The other options are not relevant for this purpose: PCI DSS is a standard that focuses on protecting payment card data; COBIT is a framework that provides guidance on governance and management of enterprise IT; ITIL is a framework that provides guidance on service management and delivery.

  References:

  According to the CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition1, one of the objectives for the exam is to "use appropriate tools and methods to manage, prioritize and respond to attacks and vulnerabilities". The book also covers the usage and syntax of various cybersecurity frameworks and standards, such as ISO 27001, PCI

  DSS, COBIT, and ITIL, in chapter 1. Specifically, it explains the meaning and function of each framework and standard, such as ISO 27001, which provides a comprehensive approach to information security management1, page 29.

  Therefore, this is a reliable source to verify the answer to the question.

• Question 12:

  An attacker recently gained unauthorized access to a financial institution's database, which contains confidential information. The attacker exfiltrated a large amount of data before being detected and blocked. A security analyst needs to complete a root cause analysis to determine how the attacker was able to gain access.

  Which of the following should the analyst perform first?

  A. Document the incident and any findings related to the attack for future reference.
  B. Interview employees responsible for managing the affected systems.
  C. Review the log files that record all events related to client applications and user access.
  D. Identify the immediate actions that need to be taken to contain the incident and minimize damage.
  C. Review the log files that record all events related to client applications and user access.

  ---

  Explanation

  In a root cause analysis following unauthorized access, the initial step is usually to review relevant log files. These logs can provide critical information about how and when the attacker gained access. The first step in a root cause analysis after a data breach is typically to review the logs. This helps the analyst understand how the attacker gained access by providing a detailed record of all events, including unauthorized or abnormal activities. Documenting the incident, interviewing employees, and identifying immediate containment actions are important steps, but they usually follow the initial log review.

• Question 13:

  The management team requests monthly KPI reports on the company's cybersecurity program.

  Which of the following KPIs would identify how long a security threat goes unnoticed in the environment?

  A. Employee turnover
  B. Intrusion attempts
  C. Mean time to detect
  D. Level of preparedness
  C. Mean time to detect

  ---

  Explanation

  Mean time to detect (MTTD) is a metric that measures the average time it takes for an organization to discover or detect an incident. It is a key performance indicator in incident management and a measure of incident response capabilities. A low MTTD indicates that the organization can quickly identify security threats and minimize their impact 12.

  References:

  What Is MTTD (Mean Time to Detect)? A Detailed Explanation, Introduction to MTTD: Mean Time to Detect

• Question 14:

  Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:

  Which of the following choices should the analyst look at first?

  

  A. wh4dc-748gy.lan (192.168.86.152)
  B. lan (192.168.86.22)
  C. imaging.lan (192.168.86.150)
  D. xlaptop.lan (192.168.86.249)
  E. p4wnp1_aloa.lan (192.168.86.56)
  E. p4wnp1_aloa.lan (192.168.86.56)

  ---

  Explanation

  The analyst should look at p4wnp1_aloa.lan (192.168.86.56) first, as this is the most suspicious device on the network. P4wnP1 ALOA is a tool that can be used to create a malicious USB device that can perform various attacks, such as keystroke injection, network sniffing, man-in-the-middle, or backdoor creation. The presence of a device with this name on the network could indicate that an attacker has plugged in a malicious USB device to a system and gained access to the network. Official

  https://github.com/mame82/P4wnP1_aloa

• Question 15:

  A large company wants to address frequent outages on critical systems with a secure configurations program. The Chief Information Security Officer (CISO) has asked the analysts to conduct research and make recommendations for a cost-effective solution with the least amount of disruption to the business.

  Which of the following would be the best way to achieve these goals?

  A. Adopt the CIS security controls as a framework, apply configurations to all assets, and then notify asset owners of the change.
  B. Coordinate with asset owners to assess the impact of the CIS critical security controls, perform testing, and then implement across the enterprise.
  C. Recommend multiple security controls depending on business unit needs, and then apply configurations according to the organization's risk tolerance.
  D. Ask asset owners which configurations they would like, compile the responses, and then present all options to the CISO for approval to implement.
  B. Coordinate with asset owners to assess the impact of the CIS critical security controls, perform testing, and then implement across the enterprise.

• Question 16:

  The analyst reviews the following endpoint log entry:

  

  Which of the following has occurred?

  A. Registry change
  B. Rename computer
  C. New account introduced
  D. Privilege escalation
  C. New account introduced

  ---

  Explanation

  The endpoint log entry shows that a new account named "admin" has been created on a Windows system with a local group membership of "Administrators". This indicates that a new account has been introduced on the system with administrative privileges. This could be a sign of malicious activity, such as privilege escalation or backdoor creation, by an attacker who has compromised the system.

• Question 17:

  A security analyst recently implemented a new vulnerability scanning platform. The initial scan of 438 hosts found the following vulnerabilities:

  210 critical

  1,854 high

  1,786 medium

  48 low

  The analyst is unsure how to handle such a large-scale remediation effort.

  Which of the following would be the next logical step?

  A. Identify the assets with a high value and remediate all vulnerabilities on those hosts.
  B. Perform remediation activities for all critical and high vulnerabilities first.
  C. Perform a risk calculation to determine the probability and magnitude of exposure.
  D. Identify the vulnerabilities that affect the most systems and remediate them first.
  B. Perform remediation activities for all critical and high vulnerabilities first.

• Question 18:

  A security team needs to demonstrate how prepared the team is in the event of a cyberattack.

  Which of the following would best demonstrate a real-world incident without impacting operations?

  A. Review lessons-learned documentation and create a playbook.
  B. Gather all internal incident response party members and perform a simulation.
  C. Deploy known malware and document the remediation process.
  D. Schedule a system recovery to the DR site for a few applications.
  B. Gather all internal incident response party members and perform a simulation.

  ---

  Explanation

  A simulation (such as a tabletop exercise or full-scale IR drill) is the best way to demonstrate real-world readiness without affecting operations. Option A (Reviewing lessons-learned and playbooks) is valuable but does not actively test readiness.

  Option C (Deploying malware) is highly risky and unethical in a production environment.

  Option D (Disaster recovery site testing) focuses on DR, not security incident readiness.

  Thus, B is the best choice, as simulations effectively test incident response capabilities without operational disruption.

• Question 19:

  An organization's threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native Windows tools to bypass system controls and execute commands with privileged credentials.

  Which of the following controls would be most effective to reduce the rate of success of such attempts?

  A. Set user account control protection to the most restrictive level on all devices
  B. Implement MFA requirements for all internal resources
  C. Harden systems by disabling or removing unnecessary services
  D. Implement controls to block execution of untrusted applications
  C. Harden systems by disabling or removing unnecessary services

• Question 20:

  An analyst is evaluating a vulnerability management dashboard. The analyst sees that a previously remediated vulnerability has reappeared on a database server.

  Which of the following is the most likely cause?

  A. The finding is a false positive and should be ignored.
  B. A rollback had been executed on the instance.
  C. The vulnerability scanner was configured without credentials.
  D. The vulnerability management software needs to be updated.
  B. A rollback had been executed on the instance.

  ---

  Explanation

  A rollback had been executed on the instance. If a database server is restored to a previous state, it may reintroduce a vulnerability that was previously fixed. This can happen due to backup and recovery operations, configuration changes, or software updates. A rollback can undo the patching or mitigation actions that were applied to remediate the vulnerability.

  References:

  Vulnerability Remediation: It's Not Just Patching, Section: The Remediation Process

  Vulnerability

  assessment for SQL Server, Section: Remediation