CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 31:

  A threat hunter seeks to identify new persistence mechanisms installed in an organization's environment. In collecting scheduled tasks from all enterprise workstations, the following host details are aggregated:

  

  Which of the following actions should the hunter perform first based on the details above?

  A. Acquire a copy of taskhw.exe from the impacted host
  B. Scan the enterprise to identify other systems with taskhw.exe present
  C. Perform a public search for malware reports on taskhw.exe.
  D. Change the account that runs the -caskhw. exe scheduled task
  B. Scan the enterprise to identify other systems with taskhw.exe present

• Question 32:

  A security analyst notices multiple attempts of the same exploit being made on the perimeter network. The behavioral patterns indicate that a TCP SYN flood attack has been initiated, followed by a port scan of the company's public IP range.

  No other attacks are being performed from the actor's source IP address. All of the SYN flood attempts were thwarted by the firewall's stateful packet inspection engine.

  Which of the following is the most likely type of threat actor in this scenario?

  A. Nation-state
  B. Script kiddie
  C. Advanced persistent threat
  D. Organized crime
  B. Script kiddie

• Question 33:

  A company wants to implement protection mechanisms after an incident in which customer information was sent to a third party.

  Which of the following tools should the company implement?

  A. SIEM
  B. EDR
  C. CASB
  D. DLP
  D. DLP

  ---

  Explanation

  Most Voted: B

• Question 34:

  A user reports a malware alert to the help desk. A technician verities the alert, determines the workstation is classified as a low-severity device, and uses network controls to block access. The technician then assigns the ticket to a security analyst who will complete the eradication and recovery processes.

  Which of the following should the security analyst do next?

  A. Document the procedures and walk through the incident training guide.
  B. Reverse engineer the malware to determine its purpose and risk to the organization.
  C. Sanitize the workstation and verify countermeasures are restored.
  D. Isolate the workstation and issue a new computer to the user.
  C. Sanitize the workstation and verify countermeasures are restored.

  ---

  Explanation

  Sanitizing the workstation and verifying countermeasures are restored are part of the eradication and recovery processes that the security analyst should perform next. Eradication is the process of removing malware or other threats from the affected systems, while recovery is the process of restoring normal operations and functionality to the affected systems. Sanitizing the workstation can involve deleting or wiping any malicious files or programs, while verifying countermeasures are restored can involve checking and updating any security controls or settings that may have been compromised .

  https://www.cynet.com/incident-response/incident-response-sans-the-6-steps-in-depth/

• Question 35:

  An analyst finds that duplicate entries may exist in the asset inventory, which is skewing vulnerability scan data.

  Which of the following is the best way for the analyst to improve the effectiveness of the vulnerability scan?

  A. Device fingerprinting
  B. Network mapping
  C. Uncredentialed reports
  D. Dynamic scans
  A. Device fingerprinting

• Question 36:

  While reviewing a vulnerability assessment, an analyst notices the following issue is identified in the report:

  

  To address this finding, which of the following would be most appropriate for the analyst to recommend to the network engineer?

  A. Reconfigure the device to support only connections leveraging TLSv1.2.
  B. Obtain a new self-signed certificate and select AES as the hashing algorithm.
  C. Replace the existing certificate with a certificate that uses only MDS for signing.
  D. Use only signed certificates with cryptographically secure certificate sources.
  D. Use only signed certificates with cryptographically secure certificate sources.

• Question 37:

  A vulnerability management team found four major vulnerabilities during an assessment and needs to provide a report for the proper prioritization for further mitigation.

  Which of the following vulnerabilities should have the highest priority for the mitigation process?

  A. A vulnerability that has related threats and loCs, targeting a different industry
  B. A vulnerability that is related to a specific adversary campaign, with loCs found in the SIEM
  C. A vulnerability that has no adversaries using it or associated loCs
  D. A vulnerability that is related to an isolated system, with no loCs
  B. A vulnerability that is related to a specific adversary campaign, with loCs found in the SIEM

  ---

  Explanation

  A vulnerability that is related to a specific adversary campaign, with IoCs found in the SIEM, should have the highest priority for the mitigation process. This is because it indicates that the vulnerability is actively being exploited by a known threat actor, and that the organization's security monitoring system has detected signs of compromise. This poses a high risk of data breach, service disruption, or other adverse impacts.

  References:

  How to Prioritize Vulnerabilities Effectively: Vulnerability Prioritization Explained, Section:

  How to prioritize vulnerabilities step by step to avoid drowning in sea of problems

  CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 4: Security Operations and Monitoring, page 156.

• Question 38:

  A security analyst runs tcpdump on the 10.203.10.22 machine and observes thousands of packets as shown below:

  

  Which of the following activities explains the tcpdump output?

  A. Incoming nmap -sA scan
  B. hping3 --udp scan over the network
  C. C2 communications leaving the network
  D. Malware beaconing
  A. Incoming nmap -sA scan

• Question 39:

  Which of the following is the best metric to use when reviewing and addressing findings that caused an incident?

  A. Mean time to restore
  B. Mean time to respond
  C. Mean time to remediate
  D. Mean time to detect
  C. Mean time to remediate

• Question 40:

  A company recently removed administrator rights from all of its end user workstations. An analyst uses CVSSv3.1 exploitability metrics to prioritize the vulnerabilities for the workstations and produces the following information:

  

  Which of the following vulnerabilities should be prioritized for remediation?

  A. nessie.explosion
  B. vote.4p
  C. sweet.bike
  D. great.skills
  D. great.skills

  ---

  Explanation

  Lower complexity (AC:L) and does not require special privileges (PR:N) or user interaction (UI:N), making it more likely to be exploited.