A systems administrator notices unfamiliar directory names on a production server. The administrator reviews the directory listings and files, and then concludes the server has beencompromised. Which of the following steps should the administrator take next?

Follow the company's incident response plan.

Inform the internal incident response team.

Follow the company's incident response plan.

Review the lessons learned for the best approach.

Determine when the access started.

A software developer has been deploying web applications with common security risks to include insufficient logging capabilities. Which of the following actions would be most effective to reduce risks associated with the application development?

Conduct regular code reviews using OWASP best practices.

Perform static analyses using an integrated development environment.

Deploy compensating controls into the environment.

Implement server-side logging and automatic updates.

Conduct regular code reviews using OWASP best practices.

After completing a review of network activity. the threat hunting team discovers a device on the network that sends an outbound email via a mail client to a non-company email address daily at 10:00 p.m. Which of the following is potentially occurring?

Irregular peer-to-peer communication

Security analysts review logs on multiple servers on a daily basis. Which of the following implementations will give the best central visibility into the events occurring throughout the corporate environment without logging in to the servers individually?

Configure the servers to forward logs to a SIEM-

Deploy a database to aggregate the logging.

Configure the servers to forward logs to a SIEM-

Share the log directory on each server to allow local access,

Automate the emailing of logs to the analysts.

Which of the following threat-modeling procedures is in the OWASP Web Security Testing Guide?

Review Of security requirements

Which of the following is a reason why proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response?

TO ensure the report is legally acceptable in case it needs to be presented in court

To present a lessons-learned analysis for the incident response team

To ensure the evidence can be used in a postmortem analysis

To prevent the possible loss of a data source for further root cause analysis

While performing a dynamic analysis of a malicious file, a security analyst notices the memory address changes every time the process runs. Which of the following controls is most likely preventing the analyst from finding the proper memory address of the piece of malicious code?

Address space layout randomization

Which of the following best describes the goal of a disaster recovery exercise as preparation for possible incidents?

TO provide metrics and test continuity controls

To verify the roles of the incident response team

To provide recommendations for handling vulnerabilities

To perform tests against implemented security controls

A security analyst is reviewing the findings of the latest vulnerability report for a company's web application. The web application accepts files for a Bash script to be processed if the files match a given hash. The analyst is able to submit files to the system due to a hash collision. Which of the following should the analyst suggest to mitigate the vulnerability with the fewest changes to the current script and infrastructure?

Replace the current MD5 with SHA-256.

Deploy a WAF to the front of the application.

Replace the current MD5 with SHA-256.

Deploy an antivirus application on the hosting system.

Replace the MD5 with digital signatures.

A Chief Information Security Officer wants to map all the attack vectors that the company faces each day. Which of the following recommendations should the company align their security controls around?

Diamond Model Of Intrusion Analysis

Which of the following best describes the key elements of a successful information security program?

Security policy implementation, assignment of roles and responsibilities, and information asset classification

Business impact analysis, asset and change management, and security communication plan

Security policy implementation, assignment of roles and responsibilities, and information asset classification

Disaster recovery and business continuity planning, and the definition of access control requirements and human resource policies

Senior management organizational structure, message distribution standards, and procedures for the operation of security management systems

An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed: Which of the following tuning recommendations should the security analyst share?

Configure an Access-Control-Allow-Origin header to authorized domains.

Set an Http Only flag to force communication by HTTPS.

Block requests without an X-Frame-Options header.

Configure an Access-Control-Allow-Origin header to authorized domains.

Disable the cross-origin resource sharing header.

A company brings in a consultant to make improvements to its website. After the consultant leaves a web developer notices unusual activity on the website and submits a suspicious file containing the following code to the security team: Which of the following did the consultant do?

Implemented privilege escalation

Which of the following best describes the importance of implementing TAXII as part of a threat intelligence program?

It proactively facilitates real-time information sharing between the public and private sectors.

It provides a structured way to gain information about insider threats.

It proactively facilitates real-time information sharing between the public and private sectors.

It exchanges messages in the most cost-effective way and requires little maintenance once implemented.

It is a semi-automated solution to gather threat intellbgence about competitors in the same sector.

During a recent site survey. an analyst discovered a rogue wireless access point on the network.Which of the following actions should be taken first to protect the network while preserving evidence?

Disconnect the access point from the network

Run a packet sniffer to monitor traffic to and from the access point.

Connect to the access point and examine its log files.

Identify who is connected to the access point and attempt to find the attacker.

Disconnect the access point from the network

While a security analyst for an organization was reviewing logs from web servers. the analyst found several successful attempts to downgrade HTTPS sessions to use cipher modes of operation susceptible to padding oracle attacks. Which of the following combinations of configuration changes should the organization make to remediate this issue? (Select two).

Configure the server to prefer TLS 1.3.

Remove cipher suites that use CBC.

Configure the server to prefer TLS 1.3.

Remove cipher suites that use CBC.

Configure the server to prefer ephemeral modes for key exchange.

Require client browsers to present a user certificate for mutual authentication.

Configure the server to require HSTS.

Remove cipher suites that use GCM.

The Chief Executive Officer (CEO) has notified that a confidential trade secret has been compromised.Which of the following communication plans should the CEO initiate?

Alert department managers to speak privately with affected staff.

Schedule a press release to inform other service provider customers of the compromise.

Disclose to all affected parties in the Chief Operating Officer for discussion and resolution.

Verify legal notification requirements of PII and SPII in the legal and human resource departments.

CompTIA CS0-003 Practice Test 4 - Free Online Exam Questions 121-160

Which of the following best describes the process of requiring remediation of a known threat within a given time frame?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CS0-003 Practice Test 4

Question

CompTIA CS0-003 Practice Tests

Practice Tests