CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 641:

  A technician is analyzing output from a popular network mapping tool for a PCI audit:

  

  Which of the following best describes the output?

  A. The host is not up or responding.
  B. The host is running excessive cipher suites.
  C. The host is allowing insecure cipher suites.
  D. The Secure Shell port on this host is closed.
  C. The host is allowing insecure cipher suites.

  ---

  Explanation

  The output shows the result of running the ssl-enum-ciphers script with Nmap, which is a tool that can scan web servers for supported SSL/TLS cipher suites. Cipher suites are combinations of cryptographic algorithms that are used to establish secure communication between a client and a server. The output shows the cipher suites that are supported by the server, along with a letter grade (A through F) indicating the strength of the connection. The output also shows the least strength, which is the strength of the weakest cipher offered by the server. In this case, the least strength is F, which means that the server is allowing insecure cipher suites that are vulnerable to attacks or have been deprecated. For example, the output shows that the server supports SSLv3, which is an outdated and insecure protocol that is susceptible to the POODLE attack. The output also shows that the server supports RC4, which is a weak and broken stream cipher that should not be used. Therefore, the best description of the output is that the host is allowing insecure cipher suites. The other descriptions are not accurate, as they do not reflect what the output shows. The host is not up or responding is incorrect, as the output clearly shows that the host is up and responding to the scan. The host is running excessive cipher suites is incorrect, as the output does not indicate how many cipher suites the host is running, only which ones it supports. The Secure Shell port on this host is closed is incorrect, as the output does not show anything about port 22, which is the default port for Secure Shell (SSH). The output only shows information about port 443, which is the default port for HTTPS.

• Question 642:

  A security administrator has found indications of dictionary attacks against the company's external-facing portal.

  Which of the following should be implemented to best mitigate the password attacks?

  A. Multifactor authentication
  B. Password complexity
  C. Web application firewall
  D. Lockout policy
  D. Lockout policy

  ---

  Explanation

  Dictionary attacks involve an attacker attempting to guess passwords by using a list of common passwords. Implementing a lockout policy is effective because it limits the number of login attempts, thereby hindering the attacker's ability to repeatedly attempt different passwords. Lockout policies are standard in cybersecurity practices to prevent brute-force and dictionary attacks by temporarily disabling an account after a certain number of failed login attempts. According to CompTIA Security+ standards, password complexity (option B) and multifactor authentication (option A) are helpful but are not as immediately effective in directly preventing repeated attempts as a lockout policy.

• Question 643:

  A vulnerability analyst is writing a report documenting the newest, most critical vulnerabilities identified in the past month.

  Which of the following public MITRE repositories would be best to review?

  A. Cyber Threat Intelligence
  B. Common Vulnerabilities and Exposures
  C. Cyber Analytics Repository
  D. ATT&CK
  B. Common Vulnerabilities and Exposures

  ---

  Explanation

  The Common Vulnerabilities and Exposures (CVE) is a public repository of standardized identifiers and descriptions for common cybersecurity vulnerabilities. It helps security analysts to identify, prioritize, and report on the most critical vulnerabilities in their systems and applications. The other options are not relevant for this purpose: Cyber Threat Intelligence (CTI) is a collection of information and analysis on current and emerging cyber threats; Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the ATT&CK adversary model; ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

  References:

  1. Specifically, it explains the meaning and function of each framework and standard, such as CVE, which provides a common language for describing and sharing information about vulnerabilities1, page

  28. Therefore, this is a reliable source to verify the answer to the question.

• Question 644:

  A SOC analyst identifies the following content while examining the output of a debugger command over a client-server application:

  getConnection(database01,"alpha" ,"AxTv.127GdCx94GTd");

  Which of the following is the most likely vulnerability in this system?

  A. Lack of input validation
  B. SQL injection
  C. Hard-coded credential
  D. Buffer overflow
  C. Hard-coded credential

  ---

  Explanation

  The most likely vulnerability in this system is hard-coded credential. Hard-coded credential is a practice of embedding or storing a username, password, or other sensitive information in the source code or configuration file of a system or application. Hard-coded credential can pose a serious security risk, as it can expose the system or application to unauthorized access, data theft, or compromise if the credential is discovered or leaked by an attacker. Hard-coded credential can also make it difficult to change or update the credential if needed, as it may require modifying the code or file and redeploying the system or application.

• Question 645:

  A SOC analyst wants to improve the proactive detection of malicious emails before they are delivered to the destination inbox.

  Which of the following is the best approach the SOC analyst can recommend?

  A. Install UEBA software on the network.
  B. Validate and quarantine emails with invalid DKIM and SPF headers.
  C. Implement an EDR system on each endpoint.
  D. Deploy a DLP platform to block unauthorized and suspicious content.
  B. Validate and quarantine emails with invalid DKIM and SPF headers.

• Question 646:

  An organization utilizes multiple vendors, each with its own portal that a security analyst must sign in to daily.

  Which of the following is the best solution for the organization to use to eliminate the need for multiple authentication credentials?

  A. API
  B. MFA
  C. SSO
  D. VPN
  C. SSO

  ---

  Explanation

  Single Sign-On (SSO) allows users to authenticate once and gain access to multiple applications without needing to re-enter credentials for each one. It reduces password fatigue, improves security, and streamlines authentication across vendor portals.

  Why Not Other Options?

  A (API) APIs facilitate data exchange but do not solve authentication problems. B (MFA) Enhances security but still requires multiple logins. D (VPN) Secures connections but does not eliminate multiple logins.

  References:

  CompTIA CySA+ CS0-003, Chapter 8: "Identity and Access Management," Section: "SSO and Access Control Methods."

• Question 647:

  After several tabletop exercises, the cybersecurity team is underperforming against MTTR and MTTD.

  Which of the following would help the team achieve improved performance?

  A. Alert volume
  B. Impact analysis
  C. Lessons learned
  D. Compensating controls
  C. Lessons learned

• Question 648:

  Which of the following is best suited for determining the methods of an adversary?

  A. WASP
  B. Cyber Kill Chain
  C. MITRE ATT&CK
  D. Diamond Model of Intrusion Analysis
  C. MITRE ATT&CK

• Question 649:

  Which of the following features is a key component of Zero Trust architecture?

  A. Single strong source of user identity
  B. Implementation of IT governance
  C. Business continuity plan
  D. Quality assurance
  E. Internal auditing process
  A. Single strong source of user identity

• Question 650:

  A security analyst discovers the following firewall log entries during an incident:

  

  Which of the following is MOST likely occurring?

  A. Banner grabbing
  B. Port scanning
  C. Beaconing
  D. Data exfiltration
  B. Port scanning