A security analyst is assisting a software engineer with the development of a custom log collection and alerting tool (SIEM) for a proprietary system. The analyst is concerned that the tool will not detect known attacks and behavioral IoCs. Which of the following should be configured in order to resolve this issue?

Integrate with an open-source threat intelligence feed.

Randomly generate and store all possible file hash values.

Create a default rule to alert on any change to the system.

Integrate with an open-source threat intelligence feed.

Manually add known threat signatures into the tool.

Which of the following evidence collection methods is most likely to be acceptable in court cases?

Providing a bit-level image of the hard drive

Copying all access files at the time of the incident

Creating a file-level archive of all files

Providing a full system backup inventory

Providing a bit-level image of the hard drive

Which of the following is a circumstance in which a security operations manager would most likely consider using automation?

The generation of NIDS rules based on received STIX messages

The fulfillment of privileged access requests to enterprise domain controllers

The verification of employee identities prior to initial PKI enrollment

The analysis of suspected malware binaries captured by an email gateway

A company was able to reduce triage time by focusing on historical trend analysis. The business partnered with the security team to achieve a 50% reduction in phishing attempts year over year. Which of the following action plans led to this reduced triage time?

Awareness, education, and training

During a training exercise, a security analyst must determine the vulnerabilities to prioritize. The analyst reviews the following vulnerability scan output: Which of the following issues should the analyst address first?

Allows anonymous read access to /etc/passwd

Allows anonymous read access via any FTP connection

Microsoft Defender security definition updates disabled

less command allows for escape exploit via terminal

A security analyst is conducting a vulnerability assessment of a company's online store. The analyst discovers a critical vulnerability in the payment processing system that could be exploited, allowing attackers to steal customer payment information. Which of the following should the analyst do next?

Perform a risk assessment to evaluate the potential impact of the vulnerability and determine whether additional security measures are needed.

Leave the vulnerability unpatched until the next scheduled maintenance window to avoid potential disruption to business.

Perform a risk assessment to evaluate the potential impact of the vulnerability and determine whether additional security measures are needed.

Ignore the vulnerability since the company recently passed a payment system compliance audit.

Isolate the payment processing system from production and schedule for reimaging.

A vulnerability scan shows the following vulnerabilities in the environment: At the same time, the following security advisory was released:'A zero-day vulnerability with a CVSS score of 10 may be affecting your web server. The vendor is working on a patch or workaround.'Which of the following actions should the security analyst take first?

Contact the web systems administrator and request that they shut down the asset.

Monitor the patch releases for all items and escalate patching to the appropriate team.

Run the vulnerability scan again to verify the presence of the critical finding and the zero-day vulnerability in the environment.

Forward the advisory to the web security team and initiate the prioritization strategy for the other vulnerabilities.

After an incident, a security analyst needs to perform a forensic analysis to report complete information to a company stakeholder. Which of the following is most likely the goal of the forensic analysis in this case?

Determine root cause information.

Provide a full picture of the existing risks.

Notify law enforcement of the incident.

Determine root cause information.

A security analyst is improving an organization's vulnerability management program. The analyst cross-checks the current reports with the system's infrastructure teams, but the reports do not accurately reflect the current patching levels. Which of the following will most likely correct the report errors?

Configuring vulnerability scans to be credentialed

Updating the engine of the vulnerability scanning tool

Installing patches through a centralized system

Configuring vulnerability scans to be credentialed

Resetting the scanning tool's plug-ins to default

Which of the following is the most likely reason for an organization to assign different internal departmental groups during the post-incident analysis and improvement process?

To expose flaws in the incident management process related to specific work areas

To ensure all staff members get exposure to the review process and can provide feedback

To verify that the organization playbook was properly followed throughout the incident

To allow cross-training for staff who are not involved in the incident response process

A security team needs to demonstrate how prepared the team is in the event of a cyberattack. Which of the following would best demonstrate a real-world incident without impacting operations?

Gather all internal incident response party members and perform a simulation.

Review lessons-learned documentation and create a playbook.

Gather all internal incident response party members and perform a simulation.

Deploy known malware and document the remediation process.

Schedule a system recovery to the DR site for a few applications.

A user reports a message as suspicious to the IT security team. An analyst reviews the message and notices that the following text string becomes a hyperlink in an email:%77%77%77%2e%69%63%65%2d%70%74%69%63%2e%63%6f%6dWhich of the following would most likely explain this behavior?

The text is encoded and designed to bypass spam filters.

The string contains obfuscated JavaScript shellcode

The text is encoded and designed to bypass spam filters.

The email client has a parsing error elsewhere in the message.

The sandboxed PC used for testing has non-default configurations.

CompTIA CS0-003 Practice Test 11 - Free Online Exam Questions 401-437

An analyst is imaging a hard drive that was obtained from the system of an employee who is suspected of going rogue. The analyst notes that the initial hash of the evidence drive does not match the resultant hash of the imaged copy. Which of the following best describes the reason for the conflicting investigative findings?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CS0-003 Practice Test 11

Question

CompTIA CS0-003 Practice Tests

Practice Tests