CompTIA CS0-003 Practice Test - Questions Answers, Page 43

An analyst is reviewing system logs while threat hunting:

Which of the following hosts should be investigated first?

The SOC receives a number of complaints regarding a recent uptick in desktop error messages that are associated with workstation access to an internal web application. An analyst, identifying a recently modified XML file on the web server, retrieves a copy of this file for review, which contains the following code:

Which of The following XML schema constraints would stop these desktop error messages from appearing?

A security analyst is improving an organization's vulnerability management program. The analyst cross-checks the current reports with the system's infrastructure teams, but the reports do not accurately reflect the current patching levels. Which of the following will most likely correct the report errors?

A security analyst has identified outgoing network traffic leaving the enterprise at odd times. The traffic appears to pivot across network segments and target domain servers. The traffic is then routed to a geographic location to which the company has no association. Which of the following best describes this type of threat?

An analyst receives alerts that state the following traffic was identified on the perimeter network firewall:

Which of the following best describes the indicator of compromise that triggered the alerts?

Which of the following is the most likely reason for an organization to assign different internal departmental groups during the post-incident analysis and improvement process?

An analyst has discovered the following suspicious command:

Which of the following would best describe the outcome of the command?

A company classifies security groups by risk level. Any group with a high-risk classification requires multiple levels of approval for member or owner changes. Which of the following inhibitors to remediation is the company utilizing?

A security team needs to demonstrate how prepared the team is in the event of a cyberattack. Which of the following would best demonstrate a real-world incident without impacting operations?