CompTIA CS0-003 Online Practice Questions and Exam Preparation

CompTIA CS0-003 Online Questions & Answers

• Question 671:

  An organization supports a large number of remote users.

  Which of the following is the best option to protect the data on the remote users' laptops?

  A. Require the use of VPNs.
  B. Require employees to sign an NDA.
  C. Implement a DLP solution.
  D. Use whole disk encryption.
  D. Use whole disk encryption.

  ---

  Explanation

  Using whole disk encryption is the best option to protect the d" Whole disk encryption is a technique that encrypts all data on a hard disk drive, including the operating system, applications and files. Whole disk encryption can prevent unauthorized access to the data if the laptop is lost, stolen or compromised. Whole disk encryption can also protect the data from physical attacks, such as removing the hard disk and connecting it to another device .

  https://www.techopedia.com/definition39/memory-dump

• Question 672:

  A security technician is testing a solution that will prevent outside entities from spoofing the company's email domain, which is compatia.org. The testing is successful, and the security technician is prepared to fully implement the solution.

  Which of the following actions should the technician take to accomplish this task?

  A. Add TXT @ "v=spfl mx include:_spf.comptia. org -all" to the DNS record.
  B. Add : XT @ "v=spfl mx include:_sp?comptia.org -al"; to the email server.
  C. Add TXT @ "v=spfl mx include:_sp?comptia.org +al"; to the domain controller.
  D. AddTXT @ "v=apfl mx lnclude:_spf .comptia.org +a 11" to the web server.
  A. Add TXT @ "v=spfl mx include:_spf.comptia. org -all" to the DNS record.

  ---

  Explanation

  " to the DNS record can help to prevent outside entities from spoofing t"ich is comptia.org. This is an example of a Sender Policy Framework (SPF) record, which is a type of DNS record that specifies which mail servers are authorized to send email on behalf of a domain. SPF records can help to prevent spoofing by allowing the recipient mail servers to check the validity of" " at the end of the SPF record indicates that any mail server that is not listed in the SPF record is not authorized to send email for comptia.org .

  https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/

• Question 673:

  The email system administrator for an organization configured DKIM signing for all email legitimately sent by the organization.

  Which of the following would most likely indicate an email is malicious if the company's domain name is used as both the sender and the recipient?

  A. The message fails a DMARC check
  B. The sending IP address is the hosting provider
  C. The signature does not meet corporate standards
  D. The sender and reply address are different
  A. The message fails a DMARC check

  ---

  Explanation

  References:

  https://easydmarc.com/tools/dmarc-lookup

• Question 674:

  During an internal code review, software called "ACE" was discovered to have a vulnerability that allows the execution of arbitrary code. The vulnerability is in a legacy, third-party vendor resource that is used by the ACE software. ACE is used worldwide and is essential for many businesses in this industry. Developers informed the Chief Information Security Officer that removal of the vulnerability will take time.

  Which of the following is the first action to take?

  A. Look for potential loCs in the company.
  B. Inform customers of the vulnerability.
  C. Remove the affected vendor resource from the ACE software.
  D. Develop a compensating control until the issue can be fixed permanently.
  D. Develop a compensating control until the issue can be fixed permanently.

  ---

  Explanation

  A compensating control is an alternative measure that provides a similar level of protection as the original control, but is used when the original control is not feasible or cost-effective. In this case, the CISO should develop a compensating control to mitigate the risk of the vulnerability in the ACE software, such as implementing additional monitoring, firewall rules, or encryption, until the issue can be fixed permanently by the developers.

  References:

  CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 5, page 197

  CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 5, page 205.

• Question 675:

  Members of the sales team are using email to send sensitive client lists with contact information to their personal accounts.

  The company's AUP and code of conduct prohibits this practice.

  Which of the following configuration changes would improve security and help prevent this from occurring?

  A. Configure the DLP transport rules to provide deep content analysis.
  B. Put employees' personal email accounts on the mail server on a blocklist.
  C. Set up IPS to scan for outbound emails containing names and contact information.
  D. Use Group Policy to prevent users from copying and pasting information into emails.
  E. Move outbound emails containing names and contact information to a sandbox for further examination.
  A. Configure the DLP transport rules to provide deep content analysis.

  ---

  Explanation

  Data loss prevention (DLP) is a set of policies and tools that aim to prevent unauthorized disclosure of sensitive data. DLP transport rules are rules that apply to email messages that are sent or received ". These rules can provide deep content analysis, which means they can scan the content of email messages and attachments for sensitive data patterns, such as client lists or contact information. If a rule detects a violation of the DLP policy, it can take actions such as blocking, quarantining, or notifying the sender or recipient. This would improve security and help prevent sales team members from sending sensitive client lists to their personal accounts. CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 14;

  https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/data-lossprevention

• Question 676:

  An organization discovered a data breach that resulted in Pll being released to the public. During the lessons learned review, the panel identified discrepancies regarding who was responsible for external reporting, as well as the timing requirements.

  Which of the following actions would best address the reporting issue?

  A. Creating a playbook denoting specific SLAs and containment actions per incident type
  B. Researching federal laws, regulatory compliance requirements, and organizational policies to document specific reporting SLAs
  C. Defining which security incidents require external notifications and incident reporting in addition to internal stakeholders
  D. Designating specific roles and responsibilities within the security team and stakeholders to streamline tasks
  B. Researching federal laws, regulatory compliance requirements, and organizational policies to document specific reporting SLAs

  ---

  Explanation

  This option ensures that the organization is aligned with legal, regulatory, and policy requirements for incident reporting, including who is responsible for external reporting and the timing requirements. Documenting specific Service Level Agreements (SLAs) will provide clear guidance and help prevent discrepancies in future incidents.

• Question 677:

  A cloud team received an alert that unauthorized resources were being auto-provisioned. After investigating, the team suspects that cryptomining is occurring.

  Which of the following indicators would most likely lead the team to this conclusion?

  A. High GPU utilization
  B. Bandwidth consumption
  C. Unauthorized changes
  D. Unusual traffic spikes
  A. High GPU utilization

  ---

  Explanation

  High GPU utilization is the most likely indicator that cryptomining is occurring, as it reflects the intensive computational work that is required to solve the complex mathematical problems involved in mining cryptocurrencies. Cryptomining is the process of generating new units of a cryptocurrency by using computing power to verify transactions and create new blocks on the blockchain. Cryptomining can be done legitimately by individuals or groups who participate in a mining pool and share the rewards, or illegitimately by threat actors who use malware or scripts to hijack the computing resources of unsuspecting victims and use them for their own benefit. This practice is called cryptojacking, and it can cause performance degradation, increased power consumption, and security risks for the affected systems. Cryptomining typically relies on the GPU (graphics processing unit) rather than the CPU (central processing unit), as the GPU is better suited for parallel processing and can handle more calculations per second. Therefore, a high GPU utilization rate can be a sign that cryptomining is taking place on a system, especially if there is no other explanation for the increased workload. The other options are not as indicative of cryptomining as high GPU utilization, as they can have other causes or explanations. Bandwidth consumption can be affected by many factors, such as network traffic, streaming services, downloads, or updates. It is not directly related to cryptomining, which does not require a lot of bandwidth to communicate with the mining pool or the blockchain network. Unauthorized changes can be a result of many types of malware or cyberattacks, such as ransomware, spyware, or trojans. They are not specific to cryptomining, which does not necessarily alter any files or settings on the system, but rather uses its processing power. Unusual traffic spikes can also be caused by various factors, such as legitimate surges in demand, distributed denial-of-service attacks, or botnets. They are not indicative of cryptomining, which does not generate a lot of traffic or requests to or from the system.

• Question 678:

  A Chief Information Security Officer (CISO) wants to disable a functionality on a business-critical web application that is vulnerable to RCE in order to maintain the minimum risk level with minimal increased cost.

  Which of the following risk treatments best describes what the CISO is looking for?

  A. Transfer
  B. Mitigate
  C. Accept
  D. Avoid
  B. Mitigate

  ---

  Explanation

  Risk avoidance involves taking actions to eliminate the risk entirely, which in this case means disabling the vulnerable functionality to prevent the risk of Remote Code Execution (RCE). This approach ensures that the risk is not present, aligning with the CISO's objective of maintaining minimal risk.

• Question 679:

  The security analyst received the monthly vulnerability report. The following findings were included in the report:

  1. Five of the systems only required a reboot to finalize the patch application

  2. Two of the servers are running outdated operating systems and cannot be patched

  The analyst determines that the only way to ensure these servers cannot be compromised is to isolate them.

  Which of the following approaches will best minimize the risk of the outdated servers being compromised?

  A. Compensating controls
  B. Due diligence
  C. Maintenance windows
  D. Passive discovery
  A. Compensating controls

  ---

  Explanation

  Compensating controls are the best approach to minimize the risk of the outdated servers being compromised, as they can provide an alternative or additional layer of security when the primary control is not feasible or effective.

  Compensating controls are security measures that are implemented to mitigate the risk of a vulnerability or an attack when the primary control is not feasible or effective. For example, if the servers are running outdated operating systems and cannot be patched, a compensating control could be to isolate them from the rest of the network, or to implement a firewall or an intrusion prevention system to monitor and block any malicious traffic to or from the servers. Compensating controls can help reduce the likelihood or impact of an exploit, but they do not eliminate the risk completely. Therefore, the security analyst should also consider upgrading or replacing the outdated servers as soon as possible.

• Question 680:

  During a scan of a web server in the perimeter network, a vulnerability was identified that could be exploited over port 3389. The web server is protected by a WAF.

  Which of the following best represents the change to overall risk associated with this vulnerability?

  A. The risk would not change because network firewalls are in use.
  B. The risk would decrease because RDP is blocked by the firewall.
  C. The risk would decrease because a web application firewall is in place.
  D. The risk would increase because the host is external facing.
  D. The risk would increase because the host is external facing.