Which of the following can be used to learn more about TTPs used by cybercriminals?

National Institute of Standards and Technology

When investigating a potentially compromised host, an analyst observes that the process BGInfo.exe (PID 1024), a Sysinternals tool used to create desktop backgrounds containing host details, has bee running for over two days. Which of the following activities will provide the best insight into this potentially malicious process, based on the anomalous behavior?

Changes to system environment variables

SMB network traffic related to the system process

Recent browser history of the primary user

Which of the following is a nation-state actor least likely to be concerned with?

Forensic analysis for legal action of the actions taken

Detection by MITRE ATT&CK framework.

Detection or prevention of reconnaissance activities.

Examination of its actions and objectives.

Forensic analysis for legal action of the actions taken

Which of the following most accurately describes the Cyber Kill Chain methodology?

It provides a clear model of how an attacker generally operates during an intrusion and the actions to take at each stage

It is used to correlate events to ascertain the TTPs of an attacker.

It is used to ascertain lateral movements of an attacker, enabling the process to be stopped.

It provides a clear model of how an attacker generally operates during an intrusion and the actions to take at each stage

It outlines a clear path for determining the relationships between the attacker, the technology used, and the target

Which of the following is a benefit of the Diamond Model of Intrusion Analysis?

It provides analytical pivoting and identifies knowledge gaps.

It guarantees that the discovered vulnerability will not be exploited again in the future.

It provides concise evidence that can be used in court

It allows for proactive detection and analysis of attack events

Which of the following does 'federation' most likely refer to within the context of identity and access management?

An authentication mechanism that allows a user to utilize one set of credentials to access multiple domains

Facilitating groups of users in a similar function or profile to system access that requires elevated or conditional access

An authentication mechanism that allows a user to utilize one set of credentials to access multiple domains

Utilizing a combination of what you know, who you are, and what you have to grant authentication to a user

Correlating one's identity with the attributes and associated applications the user has access to

A SOC analyst is analyzing traffic on a network and notices an unauthorized scan. Which of the following types of activities is being observed?

Potential precursor to an attack

Unauthorized peer-to-peer communication

An analyst is evaluating a vulnerability management dashboard. The analyst sees that a previously remediated vulnerability has reappeared on a database server. Which of the following is the most likely cause?

A rollback had been executed on the instance.

The finding is a false positive and should be ignored.

A rollback had been executed on the instance.

The vulnerability scanner was configured without credentials.

The vulnerability management software needs to be updated.

Which of the following statements best describes the MITRE ATT&CK framework?

It tracks and understands threats and is an open-source project that evolves.

It provides a comprehensive method to test the security of applications.

It provides threat intelligence sharing and development of action and mitigation strategies.

It helps identify and stop enemy activity by highlighting the areas where an attacker functions.

It tracks and understands threats and is an open-source project that evolves.

It breaks down intrusions into a clearly defined sequence of phases.

Several critical bugs were identified during a vulnerability scan. The SLA risk requirement is that all critical vulnerabilities should be patched within 24 hours. After sending a notification to the asset owners, the patch cannot be deployed due to planned, routine system upgrades Which of the following is the best method to remediate the bugs?

Update the risk register and request a change to the SLA

Reschedule the upgrade and deploy the patch

Request an exception to exclude the patch from installation

Update the risk register and request a change to the SLA

Notify the incident response team and rerun the vulnerability scan

Two employees in the finance department installed a freeware application that contained embedded malware. The network is robustly segmented based on areas of responsibility. These computers had critical sensitive information stored locally that needs to be recovered. The department manager advised all department employees to turn off their computers until the security team could be contacted about the issue. Which of the following is the first step the incident response staff members should take when they arrive?

Segment the entire department from the network and review each computer offline.

Turn on all systems, scan for infection, and back up data to a USB storage device.

Identify and remove the software installed on the impacted systems in the department.

Explain that malware cannot truly be removed and then reimage the devices.

Log on to the impacted systems with an administrator account that has privileges to perform backups.

Segment the entire department from the network and review each computer offline.

An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet:/wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administratorWhich of the following controls would work best to mitigate the attack represented by this snippet?

Limit user creation to administrators only.

Limit layout creation to administrators only.

Set the directory trx_addons to read only for all users.

Set the directory v2 to read only for all users.

A manufacturer has hired a third-party consultant to assess the security of an OT network that includes both fragile and legacy equipment Which of the following must be considered to ensure the consultant does no harm to operations?

Using passive instead of active vulnerability scans

Employing Nmap Scripting Engine scanning techniques

Preserving the state of PLC ladder logic prior to scanning

Using passive instead of active vulnerability scans

Running scans during off-peak manufacturing hours

A threat hunter seeks to identify new persistence mechanisms installed in an organization's environment. In collecting scheduled tasks from all enterprise workstations, the following host details are aggregated: Which of the following actions should the hunter perform first based on the details above?

Perform a public search for malware reports on taskhw.exe.

Acquire a copy of taskhw.exe from the impacted host

Scan the enterprise to identify other systems with taskhw.exe present

Perform a public search for malware reports on taskhw.exe.

Change the account that runs the -caskhw. exe scheduled task

A recent vulnerability scan resulted in an abnormally large number of critical and high findings that require patching. The SLA requires that the findings be remediated within a specific amount of time. Which of the following is the best approach to ensure all vulnerabilities are patched in accordance with the SLA?

Integrate an IT service delivery ticketing system to track remediation and closure.

Create a compensating control item until the system can be fully patched.

Accept the risk and decommission current assets as end of life.

Request an exception and manually patch each system.

A security analyst received an alert regarding multiple successful MFA log-ins for a particular user When reviewing the authentication logs the analyst sees the following: Which of the following are most likely occurring, based on the MFA logs? (Select two).

Subscriber identity module swapping

An attacker recently gained unauthorized access to a financial institution's database, which contains confidential information. The attacker exfiltrated a large amount of data before being detected and blocked. A security analyst needs to complete a root cause analysis to determine how the attacker was able to gain access. Which of the following should the analyst perform first?

Review the log files that record all events related to client applications and user access.

Document the incident and any findings related to the attack for future reference.

Interview employees responsible for managing the affected systems.

Review the log files that record all events related to client applications and user access.

Identify the immediate actions that need to be taken to contain the incident and minimize damage.

A security analyst is responding to an indent that involves a malicious attack on a network. Data closet. Which of the following best explains how are analyst should properly document the incident?

Take photos of the impacted items

Back up the configuration file for alt network devices

Record and validate each connection

Create a full diagram of the network infrastructure

Take photos of the impacted items

A security analyst observed the following activity from a privileged account:. Accessing emails and sensitive information. Audit logs being modified. Abnormal log-in timesWhich of the following best describes the observed activity?

Irregular peer-to-peer communication

A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?

Performing input validation before allowing submission

Implementing multifactor authentication on the server OS

Hashing user passwords on the web application

Performing input validation before allowing submission

Segmenting the network between the users and the web server

CompTIA CS0-003 Practice Test 6 - Free Online Exam Prep & Questions

Following an incident, a security analyst needs to create a script for downloading the configuration of all assets from the cloud tenancy. Which of the following authentication methods should the analyst use?

MFA

User and password

PAM

Key pair

Comment (0)

CompTIA CS0-003 Practice Test 6

Question

CompTIA CS0-003 Practice Tests

Practice Tests