Achieve Remarkable Results in the CompTIA CySA+ Exam with Reliable CS0-003 Study Materials

Question #1

A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation?

A. 2 beaconing activity

B. ata exfiltration

C. nomalous activity on unexpected ports

D. etwork host IP address scanning

E. rogue network device

View answer

Correct Answer: A

Question #2

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

A. usiness continuity plan

B. ulnerability management plan

C. isaster recovery plan

D. sset management plan

View answer

Correct Answer: A

Question #3

The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks?

A. educe the administrator and privileged access accounts

B. mploy a network-based IDS

C. onduct thorough incident response

D. nable SSO to enterprise applications

View answer

Correct Answer: A

Question #4

Given the following CVSS string:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWhich of the following attributes correctly describes this vulnerability?

A. user is required to exploit this vulnerability

B. he vulnerability is network based

C. he vulnerability does not affect confidentiality

D. he complexity to exploit the vulnerability is high

View answer

Correct Answer: B

Question #5

An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has:-created the initial evidence log.-disabled the wireless adapter on the device.-interviewed the employee, who was unable to identify the website that was accessed.-reviewed the web proxy traffic logs.Which of the following should the analyst do to remediate the infected device?

A. pdate the system firmware and reimage the hardware

B. nstall an additional malware scanner that will send email alerts to the analyst

C. onfigure the system to use a proxy server for Internet access

D. elete the user profile and restore data from backup

View answer

Correct Answer: A

Question #6

The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results?

A. ingle pane of glass

B. ingle sign-on

C. ata enrichment

D. eduplication

View answer

Correct Answer: A

Question #7

A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

A. eaponization

B. econnaissance

C. elivery

D. xploitation

View answer

Correct Answer: D

Question #8

Which of the following best describes the goal of a tabletop exercise?

A. o test possible incident scenarios and how to react properly

B. o perform attack exercises to check response effectiveness

C. o understand existing threat actors and how to replicate their techniques

D. o check the effectiveness of the business continuity plan

View answer

Correct Answer: A

Question #9

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

A. eploy a CASB and enable policy enforcement

B. onfigure MFA with strict access

C. eploy an API gateway

D. nable SSO to the cloud applications

View answer

Correct Answer: A

Question #10

A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?

A. Implementing multifactor authentication on the server OS

B. Hashing user passwords on the web application

C. Performing input validation before allowing submission

D. Segmenting the network between the users and the web server

View answer

Correct Answer: C

Question #11

A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?

A. VSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L

B. VSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

C. VSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

D. VSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

View answer

Correct Answer: A

Question #12

A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?

A. LA

B. OU

C. DA

D. imitation of liability

View answer

Correct Answer: A

Question #13

An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:Which of the following tuning recommendations should the security analyst share?

A. et an HttpOnly flag to force communication by HTTPS

B. lock requests without an X-Frame-Options header

C. onfigure an Access-Control-Allow-Origin header to authorized domains

D. isable the cross-origin resource sharing header

View answer

Correct Answer: B

Question #14

A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become?

A. acktivist

B. dvanced persistent threat

C. nsider threat

D. cript kiddie

View answer

Correct Answer: C

Question #15

A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:Which of the following scripting languages was used in the script?

A. owerShell

B. uby

C. ython

D. hell script

View answer

Correct Answer: A

Question #16

A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?

A. unction x() { info=$(geoiplookup $1) && echo "$1 | $info" }

B. unction x() { info=$(ping -c 1 $1 | awk -F "/" ’END{print $5}’) && echo "$1 | $info" }

C. unction x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F "

D. unction x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo "$1 | $info" }

View answer

Correct Answer: D

Question #17

While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next?

A. Shut the network down immediately and call the next person in the chain of command

B. Determine what attack the odd characters are indicative of

C. Utilize the correct attack framework and determine what the incident response will consist of

D. Notify the local law enforcement for incident response

View answer

Correct Answer: B

Question #18

A cloud team received an alert that unauthorized resources were being auto-provisioned. After investigating, the team suspects that cryptomining is occurring. Which of the following indicators would most likely lead the team to this conclusion?

A. igh GPU utilization

B. andwidth consumption

C. nauthorized changes

D. nusual traffic spikes

View answer

Correct Answer: A

Question #19

A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?

A. mplementing multifactor authentication on the server OS

B. ashing user passwords on the web application

C. erforming input validation before allowing submission

D. egmenting the network between the users and the web server

View answer

Correct Answer: C

Question #20

An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet:/wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administratorWhich of the following controls would work best to mitigate the attack represented by this snippet?

A. imit user creation to administrators only

B. imit layout creation to administrators only

C. et the directory trx_addons to read only for all users

D. et the directory V2 to read only for all users

View answer

Correct Answer: A

Question #21

A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?

A. VSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L

B. VSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

C. VSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

D. VSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

View answer

Correct Answer: A

Question #22

Which of the following is the first step that should be performed when establishing a disaster recovery plan?

A. gree on the goals and objectives of the plan

B. etermine the site to be used during a disaster

C. emonstrate adherence to a standard disaster recovery process

D. dentify applications to be run during a disaster

View answer

Correct Answer: A

Question #23

A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?

A. function w() { info=$(ping -c 1 $1 | awk -F “/” ‘END{print $1}’) && echo “$1 | $info” }

B. function x() { info=$(geoiplookup $1) && echo “$1 | $info” }

C. function y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo “$1 | $info” }

D. function z() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }

View answer

Correct Answer: B

Question #24

A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities: cAdditionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system?

A. nLoud:-Cobain: Yes-Grohl: No-Novo: Yes-Smear: Yes-Channing: No

B. Spirit:-Cobain: Yes-Grohl: Yes-Novo: Yes-Smear: No-Channing: No

C. Nameless:-Cobain: Yes-Grohl: No-Novo: Yes-Smear: No-Channing: No

D. Bleach:-Cobain: Yes-Grohl: No-Novo: No-Smear: No-Channing: Yes-

View answer

Correct Answer: B

Question #25

An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?

A. radication

B. ecovery

C. ontainment

D. reparation

View answer

Correct Answer: A

Question #26

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

A. Take a snapshot of the compromised server and verify its integrity

B. Restore the affected server to remove any malware

C. Contact the appropriate government agency to investigate

D. Research the malware strain to perform attribution

View answer

Correct Answer: A

Question #27

Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?

A. etermine the sophistication of the audience that the report is meant for

B. nclude references and sources of information on the first page

C. nclude a table of contents outlining the entire report

D. ecide on the color scheme that will effectively communicate the metrics

View answer

Correct Answer: A

Question #28

A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the briefing?

A. irewall logs

B. ndicators of compromise

C. isk assessment

D. ccess control lists

View answer

Correct Answer: C

Question #29

A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

A. reate a timeline of events detailing the date stamps, user account hostname and IP information associated with the activities

B. nsure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation

C. reate a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation

D. otify the SOC manager for awareness after confirmation that the activity was intentional

View answer

Correct Answer: B

Question #30

After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select?

A. void

B. ransfer

C. ccept

D. itigate

View answer

Correct Answer: A

Question #31

A security analyst is reviewing the following alert that was triggered by FIM on a critical system:Which of the following best describes the suspicious activity that is occurring?

A. fake antivirus program was installed by the user

B. network drive was added to allow exfiltration of data

C. new program has been set to execute on system start

D. he host firewall on 192

View answer

Correct Answer: C

Question #32

A cybersecurity team lead is developing metrics to present in the weekly executive briefs. Executives are interested in knowing how long it takes to stop the spread of malware that enters the network. Which of the following metrics should the team lead include in the briefs?

A. Mean time between failures

B. Mean time to detect

C. Mean time to remediate

D. Mean time to contain

View answer

Correct Answer: D

Question #33

A company’s security team is updating a section of the reporting policy that pertains to inappropriate use of resources (e.g., an employee who installs cryptominers on workstations in the office). Besides the security team, which of the following groups should the issue be escalated to first in order to comply with industry best practices?

A. Help desk

B. Law enforcement

C. Legal department

D. Board member

View answer

Correct Answer: C

Question #34

A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue?

A. Service-level agreement

B. Change management plan

C. Incident response plan

D. Memorandum of understanding

View answer

Correct Answer: C

Question #35

Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?

A. solate Joe's PC from the network

B. eimage the PC based on standard operating procedures

C. nitiate a remote wipe of Joe's PC using mobile device management

D. erform no action until HR or legal counsel advises on next steps

View answer

Correct Answer: D

Question #36

A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis?

A. ode analysis

B. tatic analysis

C. everse engineering

D. uzzing

View answer

Correct Answer: C

Question #37

An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign?

A. nformation sharing organization

B. logs/forums

C. ybersecurity incident response team

D. eep/dark web

View answer

Correct Answer: A

Question #38

A cryptocurrency service company is primarily concerned with ensuring the accuracy of the data on one of its systems. A security analyst has been tasked with prioritizing vulnerabilities for remediation for the system. The analyst will use the following CVSSv3.1 impact metrics for prioritization:Which of the following vulnerabilities should be prioritized for remediation?

A.

B.

C.

D.

View answer

Correct Answer: D

Question #39

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

A. ake a snapshot of the compromised server and verify its integrity

B. estore the affected server to remove any malware

C. ontact the appropriate government agency to investigate

D. esearch the malware strain to perform attribution

View answer

Correct Answer: A

Question #40

An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.)

A. onduct regular red team exercises over the application in production

B. nsure that all implemented coding libraries are regularly checked

C. se application security scanning as part of the pipeline for the CI/CD flow

D. mplement proper input validation for any data entry form

View answer

Correct Answer: CE

Question #41

During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level?

A. Disk contents

B. Backup data

C. Temporary files

D. Running processes

View answer

Correct Answer: D

Question #42

Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

A. evelop a call tree to inform impacted users

B. chedule a review with all teams to discuss what occurred

C. reate an executive summary to update company leadership

D. eview regulatory compliance with public relations for official notification

View answer

Correct Answer: B

Question #43

An analyst is reviewing a vulnerability report for a server environment with the following entries:Which of the following systems should be prioritized for patching first?

A. 0

B. 4

C. 4

D. 4

View answer

Correct Answer: D

Question #44

Which of the following items should be included in a vulnerability scan report? (Choose two.)

A. essons learned

B. ervice-level agreement

C. laybook

D. ffected hosts

E. isk score

F. ducation plan

View answer

Correct Answer: DE

Question #45

Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

A. dentify any improvements or changes in the incident response plan or procedures

B. etermine if an internal mistake was made and who did it so they do not repeat the error

C. resent all legal evidence collected and turn it over to iaw enforcement

D. iscuss the financial impact of the incident to determine if security controls are well spent

View answer

Correct Answer: A

Question #46

The analyst reviews the following endpoint log entry:Which of the following has occurred?

A. egistry change

B. ename computer

C. ew account introduced

D. rivilege escalation

View answer

Correct Answer: C

Question #47

An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?

A. xploitation

B. econnaissance

C. ommand and control

D. ctions on objectives

View answer

Correct Answer: B

Question #48

Which of the following tools would work best to prevent the exposure of PII outside of an organization?

A. AM

B. DS

C. KI

D. LP

View answer

Correct Answer: D

Question #49

There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?

A. mplement step-up authentication for administrators

B. mprove employee training and awareness

C. ncrease password complexity standards

D. eploy mobile device management

View answer

Correct Answer: B

Question #50

Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

A. he lead should review what is documented in the incident response policy or plan

B. anagement level members of the CSIRT should make that decision

C. he lead has the authority to decide who to communicate with at any t me

D. ubject matter experts on the team should communicate with others within the specified area of expertise

View answer

Correct Answer: A

Question #51

Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:Which of the following choices should the analyst look at first?

A. h4dc-748gy

B. fficerckuplayer

C. maging

D. laptop

E. 4wnp1_aloa

View answer

Correct Answer: E

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Achieve Remarkable Results in the CompTIA CySA+ Exam with Reliable CS0-003 Study Materials

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Achieve Remarkable Results in the CompTIA CySA+ Exam with Reliable CS0-003 Study Materials

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now