CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 621:

  A security analyst needs to support an organization's legal case against a threat actor.

  Which of the following processes provides the best way to assist in the prosecution of the case?

  A. Chain of custody
  B. Evidence gathering
  C. Securing the scene
  D. Forensic analysis
  A. Chain of custody

• Question 622:

  SIMULATION

  You are a cybersecurity analyst tasked with interpreting scan data from Company As servers You must verify the requirements are being met for all of the servers and recommend changes if you find they are not

  The company's hardening guidelines indicate the following:

  1. TLS 1 2 is the only version of TLS running.

  2. Apache 2.4.18 or greater should be used.

  3. Only default ports should be used.

  INSTRUCTIONS

  using the supplied data. record the status of compliance With the company's guidelines for each server.

  The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for Issues based ONLY on the hardening guidelines provided.

  Part 1:

  AppServ1:

  

  AppServ2:

  

  AppServ3:

  

  AppServ4:

  

  Part 2:

  

  

  A. See the solution below in Explanation.
  B. PlaceHoder
  C. PlaceHoder
  D. PlaceHoder
  A. See the solution below in Explanation.

  ---

  Explanation

  Part 1:

  

  Part 2:

  Based on the compliance report, I recommend the following changes for each server:

  AppServ1: No changes are needed for this server.

  AppServ2: Disable or upgrade TLS 1.0 and TLS 1.1 to TLS 1.2 on this server to ensure secure encryption and communication between clients and the server. Update Apache from version 2.4.17 to version 2.4.18 or greater on this server to fix any potential vulnerabilities or bugs.

  AppServ3: Downgrade Apache from version 2.4.19 to version 2.4.18 or lower on this server to ensure compatibility and stability with the company's applications and policies. Change the port number from 8080 to either port 80 (for HTTP) or port 443 (for HTTPS) on this server to follow the default port convention and avoid any confusion or conflicts with other services.

  AppServ4: Update Apache from version 2.4.16 to version 2.4.18 or greater on this server to fix any potential vulnerabilities or bugs. Change the port number from 8443 to either port 80 (for HTTP) or port 443 (for HTTPS) on this server to follow the default port convention and avoid any confusion or conflicts with other services.

• Question 623:

  Which of the following characteristics ensures the security of an automated information system is the most effective and economical?

  A. Originally designed to provide necessary security
  B. Subjected to intense security testing
  C. Customized to meet specific security threats
  D. Optimized prior to the addition of security
  A. Originally designed to provide necessary security

  ---

  Explanation

  Comprehensive Detailed Explanation:The most effective and economical way to ensure the security of an automated information system is to design it with security in mind from the outset. This is often referred to as "security by design."

  Here's a breakdown of each option and why option A is correct:

  A. Originally designed to provide necessary security

  B. Subjected to intense security testing

  C. Customized to meet specific security threats

  D. Optimized prior to the addition of security References: NIST SP 800-160: Systems Security Engineering, which emphasizes designing systems with security integrated from the beginning. OWASP Security by Design Principles: Explores how security considerations are most effective when included early in development.

• Question 624:

  Which of the following weaknesses associated with common SCADA systems are the MOST critical for organizations to address architecturally within their networks? (Choose two.)

  A. Boot processes that are neither measured nor attested
  B. Legacy and unpatchable systems software
  C. Unnecessary open ports and protocols
  D. No OS kernel mandatory access controls
  E. Unauthenticated commands
  F. Insecure filesystem permissions
  B. Legacy and unpatchable systems software
  E. Unauthenticated commands

• Question 625:

  Which of the following can be used to learn more about TTPs used by cybercriminals?

  A. ZenMAP
  B. MITRE ATT&CK
  C. National Institute of Standards and Technology
  D. theHarvester
  B. MITRE ATT&CK

  ---

  Explanation

  MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. It can help security professionals understand, detect, and mitigate cyber threats by providing a comprehensive framework of TTPs.

  References:

  MITRE ATT&CK, Getting Started with ATT&CK, MITRE ATT&CK | MITRE

• Question 626:

  An organization wants to reduce the complexity of extending identity and access management to cloud-based assets during SaaS application migration.

  Which service model is most appropriate?

  A. OpenID
  B. SASE
  C. ZTNA
  D. SWG
  A. OpenID

• Question 627:

  A security analyst is responding to an incident that is related to an unauthorized communication between systems. While triaging the event, the analyst obtains the following outputs:

  

  Which of the following commands should the analyst use to terminate the malicious session?

  A. kill -9 4347
  B. kill -9 6015
  C. kill -9 701
  D. kill -9 5996
  D. kill -9 5996

• Question 628:

  A web developer reports the following error that appeared on a development server when testing a new application:

  

  Which of the following tools can be used to identify the application's point of failure?

  A. OpenVAS
  B. Angry IP scanner
  C. Immunity debugger
  D. Burp Suite
  C. Immunity debugger

• Question 629:

  A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities:

  

  Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority.

  Which of the following vulnerabilities should be patched first, given the above third-party scoring system?

  A. InLoud: Cobain: Yes Grohl: No Novo: Yes Smear: Yes Channing: No
  B. TSpirit: Cobain: Yes Grohl: Yes Novo: Yes Smear: No Channing: No
  C. ENameless: Cobain: Yes Grohl: No Novo: Yes Smear: No Channing: No
  D. PBleach: Cobain: Yes Grohl: No Novo: No Smear: No Channing: Yes
  B. TSpirit: Cobain: Yes Grohl: Yes Novo: Yes Smear: No Channing: No

  ---

  Explanation

  The vulnerability that should be patched first, given the above third-party scoring system, is:

  TSpirit:

  Cobain:

  Yes Grohl:

  Yes Novo:

  Yes Smear:

  No Channing: No This vulnerability has three out of five metrics marked as Yes, which indicates a high severity level. The metrics Cobain, Grohl, and Novo are more important than Smear and Channing, according to the vulnerability management team. Therefore, this vulnerability poses a greater risk than the other vulnerabilities and should be patched first.

• Question 630:

  A high volume of failed RDP authentication attempts from a single remote IP using a valid domain account is logged.

  Which mitigating controls are most effective?

  A. Increase log-on event auditing granularity
  B. Enable host firewall rules to block outbound 3389 traffic
  C. Configure user account lockout after limited failed attempts
  D. Disable RDP on all devices and use a third-party remote tool
  C. Configure user account lockout after limited failed attempts