Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output: Which of the following choices should the analyst look at first?

p4wnp1_aloa.lan (192.168.86.56)

wh4dc-748gy.lan (192.168.86.152)

p4wnp1_aloa.lan (192.168.86.56)

Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

The lead should review what is documented in the incident response policy or plan

Management level members of the CSIRT should make that decision

The lead has the authority to decide who to communicate with at any t me

Subject matter experts on the team should communicate with others within the specified area of expertise

A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?

Change the display filter to f cp-daca and follow the TCP streams

Change the display filter to f cp. accive. pore

Change the display filter to tcg.port=20

Change the display filter to f cp-daca and follow the TCP streams

Navigate to the File menu and select FTP from the Export objects option

A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?

function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F '.in-addr' '{print $1} ').origin.asn.cymru.com TXT +short) && echo '$1 | $info' }

function x() { info=$(geoiplookup $1) && echo '$1 | $info' }

function x() { info=$(ping -c 1 $1 | awk -F '/' 'END{print $5}') && echo '$1 | $info' }

function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F '.in-addr' '{print $1} ').origin.asn.cymru.com TXT +short) && echo '$1 | $info' }

function x() { info=$(traceroute -m 40 $1 | awk 'END{print $1}') && echo '$1 | $info' }

There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?

Improve employee training and awareness

Implement step-up authentication for administrators

Improve employee training and awareness

Increase password complexity standards

Deploy mobile device management

Which of the following is the best way to begin preparation for a report titled 'What We Learned' regarding a recent incident involving a cybersecurity breach?

Determine the sophistication of the audience that the report is meant for

Include references and sources of information on the first page

Include a table of contents outlining the entire report

Decide on the color scheme that will effectively communicate the metrics

A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?

Upload the binary to an air gapped sandbox for analysis

Send the binaries to the antivirus vendor

Execute the binaries on an environment with internet connectivity

Query the file hashes using VirusTotal

Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

Identify any improvements or changes in the incident response plan or procedures

Determine if an internal mistake was made and who did it so they do not repeat the error

Present all legal evidence collected and turn it over to iaw enforcement

Discuss the financial impact of the incident to determine if security controls are well spent

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

Take a snapshot of the compromised server and verify its integrity

Restore the affected server to remove any malware

Contact the appropriate government agency to investigate

Research the malware strain to perform attribution

Which of the following is the most important factor to ensure accurate incident response reporting?

A well-defined timeline of the events

A guideline for regulatory reporting

A well-developed executive summary

A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with. Which of the following is the best mitigation technique?

Geoblock the offending source country

Block the IP range of the scans at the network firewall.

Perform a historical trend analysis and look for similar scanning activity.

Block the specific IP address of the scans at the network firewall

An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

Make a forensic image of the device and create a SRA-I hash.

Disable the user's network account and access to web resources

Make a copy of the files as a backup on the server.

Place a legal hold on the device and the user's network share.

Make a forensic image of the device and create a SRA-I hash.

During a cybersecurity incident, one of the web servers at the perimeter network was affected by ransomware. Which of the following actions should be performed immediately?

Update the OS to latest version.

A technician is analyzing output from a popular network mapping tool for a PCI audit: Which of the following best describes the output?

The host is allowing insecure cipher suites.

The host is not up or responding.

The host is running excessive cipher suites.

The host is allowing insecure cipher suites.

The Secure Shell port on this host is closed

CompTIA CS0-003 Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

Which of the following is the first step that should be performed when establishing a disaster recovery plan?

Agree on the goals and objectives of the plan

Determine the site to be used during a disaster C Demonstrate adherence to a standard disaster recovery process

Identity applications to be run during a disaster

Comment (0)

CompTIA CS0-003 Practice Test 2

Question

CompTIA CS0-003 Practice Tests

Practice Tests