A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts. The analyst is working with the respective system owners to help determine the best methodology that seeks to promote confidentiality, availability, and integrity of the data being hosted. Which of the following should the security analyst perform first to categorize and prioritize the respective systems?

Determine the asset value of each system.

Interview the users who access these systems,

Scan the systems to see which vulnerabilities currently exist.

Configure alerts for vendor-specific zero-day exploits.

Determine the asset value of each system.

A security analyst reviews the latest vulnerability scans and observes there are vulnerabilities with similar CVSSv3 scores but different base score metrics. Which of the following attack vectors should the analyst remediate first?

CVSS 3.0/AV:N/AC:L/PR:L/UI:N/S;U/C:H/I:H/A:H

CVSS 3.0/AVP/AC:L/PR:L/UI:N/S U/C:H/I:H/A:H

CVSS 3.0/AV:A/AC .L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 3.0/AV:N/AC:L/PR:L/UI:N/S;U/C:H/I:H/A:H

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?

Search for other mail users who have received the same file.

Wipe the computer and reinstall software

Shut down the email server and quarantine it from the network.

Acquire a bit-level image of the affected workstation.

Search for other mail users who have received the same file.

An organization recently changed its BC and DR plans. Which of the following would best allow for the incident response team to test the changes without any impact to the business?

Perform a tabletop drill based on previously identified incident scenarios.

Simulate an incident by shutting down power to the primary data center.

Migrate active workloads from the primary data center to the secondary location.

Compare the current plan to lessons learned from previous incidents.

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of- life date. Which of the following best describes a security analyst's concern?

Any discovered vulnerabilities will not be remediated.

An outage of machinery would cost the organization money.

Support will not be available for the critical machinery

There are no compensating controls in place for the OS.

A security analyst receives an alert for suspicious activity on a company laptop An excerpt of the log is shown below: Which of the following has most likely occurred?

An Office document with a malicious macro was opened.

A credential-stealing website was visited.

A phishing link in an email was clicked

A web browser vulnerability was exploited.

During an incident, a security analyst discovers a large amount of Pll has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee's personal email. Which of the following should the analyst recommend be done first?

Place a legal hold on the employee's mailbox.

Enable filtering on the web proxy.

Disable the public email access with CASB.

Configure a deny rule on the firewall.

Which of the following describes the best reason for conducting a root cause analysis?

The root cause analysis identifies the contributing items that facilitated the event

The root cause analysis ensures that proper timelines were documented.

The root cause analysis allows the incident to be properly documented for reporting.

The root cause analysis develops recommendations to improve the process.

The root cause analysis identifies the contributing items that facilitated the event

After a security assessment was done by a third-party consulting firm, the cybersecurity program recommended integrating DLP and CASB to reduce analyst alert fatigue. Which of the following is the best possible outcome that this effort hopes to achieve?

SIEM ingestion logs are reduced by 20%.

False positive rates drop to 20%.

An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has:* created the initial evidence log.* disabled the wireless adapter on the device.* interviewed the employee, who was unable to identify the website that was accessed* reviewed the web proxy traffic logs.Which of the following should the analyst do to remediate the infected device?

Update the system firmware and reimage the hardware.

Install an additional malware scanner that will send email alerts to the analyst.

Configure the system to use a proxy server for Internet access.

Delete the user profile and restore data from backup.

A security analyst must preserve a system hard drive that was involved in a litigation request Which of the following is the best method to ensure the data on the device is not modified?

Generate a hash value and make a backup image.

Encrypt the device to ensure confidentiality of the data.

Protect the device with a complex password.

Perform a memory scan dump to collect residual data.

A virtual web server in a server pool was infected with malware after an analyst used the internet to research a system issue. After the server was rebuilt and added back into the server pool, users reported issues with the website, indicating the site could not be trusted. Which of the following is the most likely cause of the server issue?

The digital certificate on the web server was self-signed

The server was configured to use SSI- to securely transmit data

The server was supporting weak TLS protocols for client connections.

The malware infected all the web servers in the pool.

The digital certificate on the web server was self-signed

A security analyst is reviewing the following alert that was triggered by FIM on a critical system: Which of the following best describes the suspicious activity that is occurring?

A new program has been set to execute on system start

A fake antivirus program was installed by the user.

A network drive was added to allow exfiltration of data

A new program has been set to execute on system start

The host firewall on 192.168.1.10 was disabled.

A security analyst is trying to detect connections to a suspicious IP address by collecting the packet captures from the gateway. Which of the following commands should the security analyst consider running?

tcpdump -n -r packets.pcap host [IP address]

strings packets.pcap | grep [IP Address]

cat packets.pcap | grep [IP Address]

Given the following CVSS string-CVSS:3.0/AV:N/AC:L/PR:N/UI:N/3:U/C:K/I:K/A:HWhich of the following attributes correctly describes this vulnerability?

The vulnerability is network based.

A user is required to exploit this vulnerability.

The vulnerability is network based.

The vulnerability does not affect confidentiality.

The complexity to exploit the vulnerability is high.

An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls for a period of time. The web service must be accessible from the internet via the reverse proxy and must connect to a database server. Which of the following compensating controls will help contain the adversary while meeting the other requirements? (Select two).

Deploy EDR on the web server and the database server to reduce the adversaries capabilities.

use micro segmentation to restrict connectivity to/from the web and database servers.

Drop the tables on the database server to prevent data exfiltration.

Deploy EDR on the web server and the database server to reduce the adversaries capabilities.

Stop the httpd service on the web server so that the adversary can not use web exploits

use micro segmentation to restrict connectivity to/from the web and database servers.

Comment out the HTTP account in the / etc/passwd file of the web server

Move the database from the database server to the web server.

A recent penetration test discovered that several employees were enticed to assist attackers by visiting specific websites and running downloaded files when prompted by phone calls. Which of the following would best address this issue?

Increasing training and awareness for all staff

Ensuring that malicious websites cannot be visited

Blocking all scripts downloaded from the internet

Disabling all staff members' ability to run downloaded applications

While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next?

Determine what attack the odd characters are indicative of

Shut the network down immediately and call the next person in the chain of command.

Determine what attack the odd characters are indicative of

Utilize the correct attack framework and determine what the incident response will consist of.

Notify the local law enforcement for incident response

A security analyst at a company called ACME Commercial notices there is outbound traffic to a host IP that resolves to https://offce365password.acme.co. The site's standard VPN logon page is www.acme.com/logon. Which of the following is most likely true?

A social engineering attack is underway

This is a normal password change URL.

The security operations center is performing a routine password audit.

A new VPN gateway has been deployed

A social engineering attack is underway

Which of the following best describes the goal of a tabletop exercise?

To test possible incident scenarios and how to react properly

To perform attack exercises to check response effectiveness

To understand existing threat actors and how to replicate their techniques

To check the effectiveness of the business continuity plan

Which of the following would help an analyst to quickly find out whether the IP address in a SIEM alert is a known-malicious IP address?

Add data enrichment for IPS in the ingestion pipleline.

Join an information sharing and analysis center specific to the company's industry.

Upload threat intelligence to the IPS in STIX/TAXII format.

Add data enrichment for IPS in the ingestion pipleline.

Review threat feeds after viewing the SIEM alert.

CompTIA CS0-003 Practice Test 3 - Free Online Exam Prep & Questions

Question 1 / 40

A systems analyst is limiting user access to system configuration keys and values in a Windows environment. Which of the following describes where the analyst can find these configuration items?

config. ini

ntds.dit

Master boot record

Registry

Comment (0)

CompTIA CS0-003 Practice Test 3

Question

CompTIA CS0-003 Practice Tests

Practice Tests