CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 601:

  During a cybersecurity incident, one of the web servers at the perimeter network was affected by ransomware.

  Which of the following actions should be performed immediately?

  A. Shut down the server.
  B. Reimage the server.
  C. Quarantine the server.
  D. Update the OS to latest version.
  C. Quarantine the server.

  ---

  Explanation

  Quarantining the server is the best action to perform immediately, as it isolates the affected server from the rest of the network and prevents the ransomware from spreading to other systems or data. Quarantining the server also preserves the evidence of the ransomware attack, which can be useful for forensic analysis and law enforcement investigation. The other actions are not as urgent as quarantining the server, as they may not stop the ransomware infection, or they may destroy valuable evidence. Shutting down the server may not remove the ransomware, and it may trigger a data deletion mechanism by the ransomware. Reimaging the server may restore its functionality, but it will also erase any traces of the ransomware and make recovery of encrypted data impossible. Updating the OS to the latest version may fix some vulnerabilities, but it will not remove the ransomware or decrypt the data.

  https://www.cisa.gov/stopransomware/ransomware-guide

  https://www.cisa.gov/stopransomware/ive-been-hit-ransomware

• Question 602:

  An organization was compromised, and the usernames and passwords of all employees were leaked online.

  Which of the following best describes the remediation that could reduce the impact of this situation?

  A. Multifactor authentication
  B. Password changes
  C. System hardening
  D. Password encryption
  B. Password changes

• Question 603:

  Which of the following is the best reason why organizations need operational security controls?

  A. To supplement areas that other controls cannot address
  B. To limit physical access to areas that contain sensitive data
  C. To assess compliance automatically against a secure baseline
  D. To prevent disclosure by potential insider threats
  A. To supplement areas that other controls cannot address

  ---

  Explanation

  Operational security controls are security measures that are implemented and executed by people rather than by systems. Operational security controls are needed to supplement areas that other controls, such as technical or physical controls, cannot address. For example, operational security controls can include policies, procedures, training, awareness, audits, reviews, testing, etc. These controls can help ensure that employees follow best practices, comply with regulations, detect and report incidents, and respond to emergencies. The other options are not specific to operational security controls or are too narrow in scope. CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0- 002), page 14;

  https://www.isaca.org/resources/isacajournal/issues6/volume-3/operational-security-controls

• Question 604:

  A SOC analyst is analyzing traffic on a network and notices an unauthorized scan.

  Which of the following types of activities is being observed?

  A. Potential precursor to an attack
  B. Unauthorized peer-to-peer communication
  C. Rogue device on the network
  D. System updates
  A. Potential precursor to an attack

• Question 605:

  An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM.

  Which of the following is the best option for the security analyst to configure to improve the efficiency of security operations?

  A. Configure a new SIEM specific to the management of the hosted environment.
  B. Subscribe to a threat feed related to the vendor's application.
  C. Use a vendor-provided API to automate pulling the logs in real time.
  D. Download and manually import the logs outside of business hours.
  C. Use a vendor-provided API to automate pulling the logs in real time.

  ---

  Explanation

  Using a vendor-provided API to automate pulling logs in real-time is the best option for improving the efficiency of security operations when the financial application does not allow event logging to send to the corporate SIEM. This approach ensures that logs are consistently and promptly integrated into the security monitoring process without manual intervention, enhancing the overall effectiveness of security operations.

• Question 606:

  Which type of scan uses installed software on target systems to collect security data directly?

  A. Credentialed scans
  B. Individual scans
  C. Security baseline scans
  D. Agent-based scans
  D. Agent-based scans

• Question 607:

  An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically.

  Which of the following is the best option to help the analyst implement this recommendation?

  A. SOAR
  B. SIEM
  C. SLA
  D. IoC
  A. SOAR

  ---

  Explanation

  SOAR (Security Orchestration, Automation, and Response) is the best option to help the analyst implement the recommendation, as it reflects the software solution that enables security teams to integrate and coordinate separate tools into streamlined threat response workflows and automate repetitive tasks. SOAR is a term coined by Gartner in 2015 to describe a technology that combines the functions of security incident response platforms, security orchestration and automation platforms, and threat intelligence platforms in one offering. SOAR solutions help security teams to collect inputs from various sources, such as EDR agents, firewalls, or SIEM systems, and perform analysis and triage using a combination of human and machine power. SOAR solutions also allow security teams to define and execute incident response procedures in a digital workflow format, using automation to perform low-level tasks or actions, such as blocking an IP address or quarantining a device. SOAR solutions can help security teams to improve efficiency, consistency, and scalability of their operations, as well as reduce mean time to detect (MTTD) and mean time to respond (MTTR) to threats. The other options are not as suitable as SOAR, as they do not match the description or purpose of the recommendation. SIEM (Security Information and Event Management) is a software solution that collects and analyzes data from various sources, such as logs, events, or alerts, and provides security monitoring, threat detection, and incident response capabilities. SIEM solutions can help security teams to gain visibility, correlation, and context of their security data, but they do not provide automation or orchestration features like SOAR solutions. SLA (Service Level Agreement) is a document that defines the expectations and responsibilities between a service provider and a customer, such as the quality, availability, or performance of the service. SLAs can help to manage customer expectations, formalize communication, and improve productivity and relationships, but they do not help to implement technical recommendations like SOAR solutions. IoC (Indicator of Compromise) is a piece of data or evidence that suggests a system or network has been compromised by a threat actor, such as an IP address, a file hash, or a registry key. IoCs can help to identify and analyze malicious activities or incidents, but they do not help to implement response actions like SOAR solutions.

• Question 608:

  Which of the following tools would work best to prevent the exposure of PII outside of an organization?

  A. PAM
  B. IDS
  C. PKI
  D. DLP
  D. DLP

  ---

  Explanation

  Data loss prevention (DLP) is a tool that can prevent the exposure of PII outside of an organization by monitoring, detecting, and blocking sensitive data in motion, in use, or at rest.

• Question 609:

  A company was able to reduce triage time by focusing on historical trend analysis. The business partnered with the security team to achieve a 50% reduction in phishing attempts year over year.

  Which of the following action plans led to this reduced triage time?

  A. Patching
  B. Configuration management
  C. Awareness, education, and training
  D. Threat modeling
  C. Awareness, education, and training

  ---

  Explanation

  Phishing attacks are best mitigated through user education and training. The 50% reduction in phishing attempts suggests a strong awareness program that improved employee vigilance.

  Option A (Patching) helps prevent exploits but does not directly reduce phishing attempts.

  Option B (Configuration management) ensures proper system setup but does not address phishing prevention.

  Option D (Threat modeling) is useful for security planning but does not actively reduce phishing attempts.

  Thus, C is the correct answer, as awareness training significantly decreases phishing success rates by educating employees on email-based threats.

• Question 610:

  Which of the following is the first step that should be performed when establishing a disaster recovery plan?

  A. Agree on the goals and objectives of the plan
  B. Determine the site to be used during a disaster
  C. Demonstrate adherence to a standard disaster recovery process
  D. Identity applications to be run during a disaster
  A. Agree on the goals and objectives of the plan

  ---

  Explanation

  The first step that should be performed when establishing a disaster recovery plan is to agree on the goals and objectives of the plan. The goals and objectives of the plan should define what the plan aims to achieve, such as minimizing downtime, restoring critical functions, ensuring data integrity, or meeting compliance requirements. The goals and objectives of the plan should also be aligned with the business needs and priorities of the organization and be measurable and achievable.