CompTIA CS0-003 Practice Test - Questions Answers, Page 10

Which of the following describes the best reason for conducting a root cause analysis?

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

An attacker has just gained access to the syslog server on a LAN. Reviewing the syslog entries has allowed the attacker to prioritize possible next targets. Which of the following is this an example of?

Which of the following concepts is using an API to insert bulk access requests from a file into an identity management system an example of?

After a security assessment was done by a third-party consulting firm, the cybersecurity program recommended integrating DLP and CASB to reduce analyst alert fatigue. Which of the following is the best possible outcome that this effort hopes to achieve?

An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has:

* created the initial evidence log.

* disabled the wireless adapter on the device.

* interviewed the employee, who was unable to identify the website that was accessed

* reviewed the web proxy traffic logs.

Which of the following should the analyst do to remediate the infected device?

A SOC analyst recommends adding a layer of defense for all endpoints that will better protect against external threats regardless of the device's operating system. Which of the following best meets this requirement?

A security analyst has found the following suspicious DNS traffic while analyzing a packet capture:

* DNS traffic while a tunneling session is active.

* The mean time between queries is less than one second.

* The average query length exceeds 100 characters.

Which of the following attacks most likely occurred?

A managed security service provider is having difficulty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network. Which of the following would best aid in decreasing the workload without increasing staff?