During a scan of a web server in the perimeter network, a vulnerability was identified that could be exploited over port 3389. The web server is protected by a WAF. Which of the following best represents the change to overall risk associated with this vulnerability?

The risk would decrease because RDP is blocked by the firewall.

The risk would not change because network firewalls are in use.

The risk would decrease because RDP is blocked by the firewall.

The risk would decrease because a web application firewall is in place.

The risk would increase because the host is external facing.

Several vulnerability scan reports have indicated runtime errors as the code is executing. The dashboard that lists the errors has a command-line interface for developers to check for vulnerabilities. Which of the following will enable a developer to correct this issue? (Select two).

Performing dynamic application security testing

An organization has established a formal change management process after experiencing several critical system failures over the past year. Which of the following are key factors that the change management process will include in order to reduce the impact of system failures? (Select two).

Identify assets with dependence that could be impacted by the change.

Ensure that all assets are properly listed in the inventory management system.

Ensure users the document system recovery plan prior to deployment.

Perform a full system-level backup following the change.

Leverage an audit tool to identify changes that are being made.

Identify assets with dependence that could be impacted by the change.

Require diagrams to be completed for all critical systems.

Ensure that all assets are properly listed in the inventory management system.

An organization's threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native Windows tools to bypass system controls and execute commands with privileged credentials. Which of the following controls would be most effective to reduce the rate of success of such attempts?

Implement controls to block execution of untrusted applications.

Disable administrative accounts for any operations.

Implement MFA requirements for all internal resources.

Harden systems by disabling or removing unnecessary services.

Implement controls to block execution of untrusted applications.

Which of the following is a commonly used four-component framework to communicate threat actor behavior?

Diamond Model of Intrusion Analysis

An incident response analyst is taking over an investigation from another analyst. The investigation has been going on for the past few days. Which of the following steps is most important during the transition between the two analysts?

Review the steps that the previous analyst followed.

Identify and discuss the lessons learned with the prior analyst.

Accept all findings and continue to investigate the next item target.

Review the steps that the previous analyst followed.

Validate the root cause from the prior analyst.

A security analyst has received an incident case regarding malware spreading out of control on a customer's network. The analyst is unsure how to respond. The configured EDR has automatically obtained a sample of the malware and its signature. Which of the following should the analyst perform next to determine the type of malware, based on its telemetry?

Cross-reference the signature with open-source threat intelligence.

Configure the EDR to perform a full scan.

Transfer the malware to a sandbox environment.

Log in to the affected systems and run necstat.

A security analyst has prepared a vulnerability scan that contains all of the company's functional subnets. During the initial scan, users reported that network printers began to print pages that contained unreadable text and icons.Which of the following should the analyst do to ensure this behavior does not oocur during subsequent vulnerability scans?

Create a tailored scan for the printer subnet.

Perform non-credentialed scans.

Ignore embedded web server ports.

Create a tailored scan for the printer subnet.

Increase the threshold length of the scan timeout.

A vulnerability analyst is writing a report documenting the newest, most critical vulnerabilities identified in the past month. Which of the following public MITRE repositories would be best to review?

Common Vulnerabilities and Exposures

Cyber Analytics Repository ATT&CK

The SOC received a threat intelligence notification indicating that an employee's credentials were found on the dark web. The user's web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled. Which of the following should be done first to mitigate impact to the business networks and assets?

Perform a forced password reset.

Communicate the compromised credentials to the user.

Perform an ad hoc AV scan on the user's laptop.

Review and ensure privileges assigned to the user's account reflect least privilege.

Lower the thresholds for SOC alerting of suspected malicious activity.

A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?

Upload the binary to an air-gapped sandbox for analysis.

Send the binaries to the antivirus vendor.

Execute the binaries on an environment with internet connectivity.

Query the file hashes using VirusTotal.

Which of the following is the most appropriate action a security analyst to take to effectively identify the most security risks associated with a locally hosted server?

Execute a vulnerability scan against the target host.

Run the operating system update tool to apply patches that are missing.

Contract an external penetration tester to attempt a brute-force attack.

Download a vendor support agent to validate drivers that are installed.

Execute a vulnerability scan against the target host.

Which of the following best explains the importance of communicating with staff regarding the official public communication plan related to incidents impacting the organization?

To establish what information is allowed to be released by designated employees

To designate an external public relations firm to represent the organization

To ensure that all news media outlets are informed at the same time

To define how each employee will be contacted after an event occurs

A security analyst scans a host and generates the following output: Which of the following best describes the output?

The host is vulnerable to web-based exploits.

The host is unresponsive to the ICMP request.

The host Is running a vulnerable mall server.

The host Is allowlng unsecured FTP connectlons.

The host is vulnerable to web-based exploits.

A list of loCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost. exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?

This indicator would fire on the majority of Windows devices.

Malicious files with a matching hash would be detected.

Security teams would detect rogue svchost. exe processes in their environment.

Security teams would detect event entries detailing execution of known-malicious svchost. exe processes.

A high volume of failed RDP authentication attempts was logged on a critical server within a one-hour period. All of the attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following would be the most effective mitigating control to reduce the rate of success of this brute-force attack?

Enabling a user account lockout after a limited number of failed attempts

Installing a third-party remote access tool and disabling RDP on all devices

Implementing a firewall block for the remote system's IP address

Increasing the verbosity of log-on event auditing on all devices

An analyst is investigating a phishing incident and has retrieved the following as part of the investigation:cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -EncodedCommand <VERY LONG STRING>Which of the following should the analyst use to gather more information about the purpose of this command?

Echo the command payload content into 'base64 -d'.

Execute the command from a Windows VM.

Use a command console with administrator privileges to execute the code.

Run the command as an unprivileged user from the analyst workstation.

Several reports with sensitive information are being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?

Improve employee training and awareness.

Implement step-up authentication for administrators.

Improve employee training and awareness.

Increase password complexity standards.

Deploy mobile device management.

Which of the following best describes the key goal of the containment stage of an incident response process?

To limit further damage from occurring

To get services back up and running

To communicate goals and objectives of the incident response plan

To prevent data follow-on actions by adversary exfiltration

A healthcare organization must develop an action plan based on the findings from a risk assessment. The action plan must consist of:* Risk categorization* Risk prioritization. Implementation of controlsINSTRUCTIONSClick on the audit report, risk matrix, and SLA expectations documents to review their contents.On the Risk categorization tab, determine the order in which the findings must be prioritized for remediation according to the risk rating score. Then, assign a categorization to each risk.On the Controls tab, select the appropriate control(s) to implement for each risk finding.Findings may have more than one control implemented. Some controls may be used more than once or not at all.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

See the solution below in Explanation

CompTIA CS0-003 Practice Test 8 - Free Online Exam Prep & Questions

An organization's email account was compromised by a bad actor. Given the following Information:

CompTIA CS0-003 image Question 281 94902 10022024175105000000

Which of the following is the length of time the team took to detect the threat?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CS0-003 Practice Test 8

Question

CompTIA CS0-003 Practice Tests

Practice Tests