CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 41:

  Given the following CVSS string:

  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  Which of the following attributes correctly describes this vulnerability?

  A. A user is required to exploit this vulnerability.
  B. The vulnerability is network based.
  C. The vulnerability does not affect confidentiality.
  D. The complexity to exploit the vulnerability is high.
  B. The vulnerability is network based.

  ---

  Explanation

  AV:N: vulnerability is network-based AC:L: attack complexity is low PR:N: privileges are not required to exploit the vulnerability UI:N: no user interaction required

  S:U: scope of the impact is unchanged (unchanged scope).

  C:H: confidentiality impact is high.

  I:H: integrity impact is high.

  A:H: availability impact is high.

  The vulnerability is network based is the correct attribute that describes this vulnerability, as it can be inferred from the CVSS string. CVSS stands for Common Vulnerability Scoring System, which is a framework that assigns numerical scores and ratings to vulnerabilities based on their characteristics and severity. The CVSS string consists of several metrics that define different aspects of the vulnerability, such as the attack vector, the attack complexity, the privileges required, the user interaction, the scope, and the impact on confidentiality, integrity and availability. The first metric in the CVSS string is the attack vector (AV), which indicates how the vulnerability can be exploited. The value of AV in this case is N, which stands for network. This means that the vulnerability can be exploited remotely over a network connection, without physical or logical access to the target system. Therefore, the vulnerability is network based.

  https://partners.comptia.org/docs/default-source/resources/comptia-cysa-cs0-002-exam-objectives

  https://www.comptia.org/certifications/cybersecurity-analyst

  https://packitforwarding.com/index.php/2019/01/10/comptia-cysa-common-vulnerability-scoring-system

• Question 42:

  A vulnerability scan of a web server that is exposed to the internet was recently completed. A security analyst is reviewing the resulting vector strings:

  Vulnerability 1: CVSS: 3.0/AV:N/AC: L/PR: N/UI : N/S: U/C: H/I : L/A:L Vulnerability 2: CVSS: 3.0/AV: L/AC: H/PR:N/UI : N/S: U/C: L/I : L/A: H Vulnerability 3: CVSS: 3.0/AV:A/AC: H/PR: L/UI : R/S: U/C: L/I : H/A:L Vulnerability 4: CVSS: 3.0/AV: P/AC: L/PR: H/UI : N/S: U/C: H/I:N/A:L

  Which of the following vulnerabilities should be patched first?

  A. Vulnerability 1
  B. Vulnerability 2
  C. Vulnerability 3
  D. Vulnerability 4
  A. Vulnerability 1

• Question 43:

  A company's legacy web application has had multiple incidents with little development work.

  What is the most likely cause?

  A. Misconfigured web application firewall
  B. Data integrity failure
  C. Outdated libraries
  D. Insufficient logging
  C. Outdated libraries

• Question 44:

  A security analyst needs to mitigate a known, exploited vulnerability related to an attack vector that embeds software through the USB interface.

  Which of the following should the analyst do first?

  A. Conduct security awareness training on the risks of using unknown and unencrypted USBs.
  B. Write a removable media policy that explains that USBs cannot be connected to a company asset.
  C. Check configurations to determine whether USB ports are enabled on company assets.
  D. Review logs to see whether this exploitable vulnerability has already impacted the company.
  C. Check configurations to determine whether USB ports are enabled on company assets.

  ---

  Explanation

  When dealing with a known and exploited vulnerability related to an attack vector that involves embedding software through the USB interface, the primary concern is to immediately stop the active exploitation and prevent further attacks.

  Given the options provided, the answeer is the best

  Check configurations for USB ports (Option C): This is the most immediate action to take. Disabling or securing USB ports on company assets will prevent the attacker from further exploiting the vulnerability through this attack vector. It's a quick and effective way to mitigate ongoing attacks.

• Question 45:

  An analyst receives alerts that state the following traffic was identified on the perimeter network firewall:

  

  Which of the following best describes the indicator of compromise that triggered the alerts?

  A. Anomalous activity
  B. Bandwidth saturation
  C. Cryptomining
  D. Denial of service
  C. Cryptomining

  ---

  Explanation

  The given firewall logs indicate high outbound traffic with low IP reputation, sustained over time, which is a strong indicator of cryptomining activity. Option A (Anomalous activity) is a general term but does not specify why the activity is suspicious.

  Option B (Bandwidth saturation) occurs when network traffic is overwhelming, but cryptomining typically uses CPU/GPU power rather than overwhelming bandwidth.

  Option D (Denial of service - DoS) would result in continuous large requests, but cryptomining generates consistent, high-bandwidth outbound traffic rather than bursts of large requests.

  Thus, C is the correct answer, as cryptomining generates unusual outbound network activity from internal hosts to mining pools.

• Question 46:

  A security analyst is testing a web application for vulnerabilities using Burp Suite. During the assessment, a capture of the following HTTP request and response is shown in the command-line interface: After inspecting the request, the security analyst notices that it does not include any additional protections or validation mechanisms.

  

  Which of the following vulnerabilities is most likely present in the web application?

  A. IDOR
  B. CSRF
  C. SQLi
  D. XSS
  B. CSRF

  ---

  Explanation

  Most Voted: A

• Question 47:

  A cybersecurity analyst has recovered a recently compromised server to its previous state.

  Which of the following should the analyst perform next?

  A. Eradication
  B. Isolation
  C. Reporting
  D. Forensic analysis
  D. Forensic analysis

  ---

  Explanation

  After recovering a compromised server to its previous state, the analyst should perform forensic analysis to determine the root cause, impact, and scope of the incident, as well as to identify any indicators of compromise, evidence, or artifacts that can be used for further investigation or prosecution.

  References:

  CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 6, page 244

  CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 6, page 253.

• Question 48:

  An analyst wants to ensure that users only leverage web-based software that has been pre-approved by the organization.

  Which of the following should be deployed?

  A. Blocklisting
  B. Allowlisting
  C. Graylisting
  D. Webhooks
  B. Allowlisting

  ---

  Explanation

  Allowlisting is a technique that allows only pre-approved web-based software to run on a unauthorized or malicious software from compromising the security of an organization. Allowlisting can be implemented using various methods, such as application control, browser extensions, firewall rules, or proxy servers 12. The other options are not the best techniques to ensure that users only leverage web-based software that has been pre-approved by the organization. Blocklisting (A) is a technique that blocks specific web-based software from running on a system or network, while allowing all other software. Blocklisting can be ineffective or inefficient, as it requires constant updates and may not catch all malicious software. Graylisting is a technique that temporarily rejects or delays incoming messages from unknown or suspicious sources, until they are verified as legitimate. Graylisting is mainly used for email filtering, not for web-based software control. Webhooks (D) are a technique that allows web-based software to send or receive data from other web-based software in real time, based on certain events or triggers. Webhooks are not related to web-based software control, but rather to web-based software integration.

• Question 49:

  Security awareness and compliance programs are most effective at reducing the likelihood and impact of attacks from:

  A. advanced persistent threats.
  B. corporate spies.
  C. hacktivists.
  D. insider threats.
  D. insider threats.

• Question 50:

  An analyst is reviewing system logs while threat hunting:

  

  Which of the following hosts should be investigated first?

  A. PC1
  B. PC2
  C. PC3
  D. PC4
  E. PC5
  C. PC3