CompTIA's CS0-003 An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?
#61
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level?
#62
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script functions could help achieve the goal?
#63
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?
#64
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment:Which of the following should be completed first to remediate the findings?
#65
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 While reviewing web server logs, an analyst notices several entries with the same time stamps, but all contain odd characters in the request line. Which of the following steps should be taken next?
#66
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue?
#67
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with. Which of the following is the best mitigation technique?
#68
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet:/wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administratorWhich of the following controls would work best to mitigate the attack represented by this snippet?
#69
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?
#70
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A cybersecurity team lead is developing metrics to present in the weekly executive briefs. Executives are interested in knowing how long it takes to stop the spread of malware that enters the network. Which of the following metrics should the team lead include in the briefs?
#71
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has:• created the initial evidence log.• disabled the wireless adapter on the device.• interviewed the employee, who was unable to identify the website that was accessed.• reviewed the web proxy traffic logs.Which of the following should the analyst do to remediate the infected device?
#72
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A cloud team received an alert that unauthorized resources were being auto-provisioned. After investigating, the team suspects that cryptomining is occurring. Which of the following indicators would most likely lead the team to this conclusion?
#73
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A company’s security team is updating a section of the reporting policy that pertains to inappropriate use of resources (e.g., an employee who installs cryptominers on workstations in the office). Besides the security team, which of the following groups should the issue be escalated to first in order to comply with industry best practices?
#74
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 Given the following CVSS string:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWhich of the following attributes correctly describes this vulnerability?
#75
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 A cryptocurrency service company is primarily concerned with ensuring the accuracy of the data on one of its systems. A security analyst has been tasked with prioritizing vulnerabilities for remediation for the system. The analyst will use the following CVSSv3.1 impact metrics for prioritization:Which of the following vulnerabilities should be prioritized for remediation?
#76
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 Patches for two highly exploited vulnerabilities were released on the same Friday afternoon. Information about the systems and vulnerabilities is shown in the tables below:Which of the following should the security analyst prioritize for remediation?
#77
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst must preserve a system hard drive that was involved in a litigation request. Which of the following is the best method to ensure the data on the device is not modified?
#78
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 Which of the following best describes the goal of a tabletop exercise?
#79
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A virtual web server in a server pool was infected with malware after an analyst used the internet to research a system issue. After the server was rebuilt and added back into the server pool, users reported issues with the website, indicating the site could not be trusted. Which of the following is the most likely cause of the server issue?
#80
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 A zero-day command injection vulnerability was published. A security administrator is analyzing the following logs for evidence of adversaries attempting to exploit the vulnerability:Which of the following log entries provides evidence of the attempted exploit?
#81
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts. The analyst is working with the respective system owners to help determine the best methodology that seeks to promote confidentiality, availability, and integrity of the data being hosted. Which of the following should the security analyst perform first to categorize and prioritize the respective systems?
#82
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 A security analyst is reviewing the following alert that was triggered by FIM on a critical system:Which of the following best describes the suspicious activity that is occurring?
#83
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 Which of the following best describes the document that defines the expectation to network customers that patching will only occur between 2:00 a.m. and 4:00 a.m.?
#84
Answer: A✅ Correct❌ Incorrect
CompTIA's CS0-003 A cybersecurity analyst is reviewing SIEM logs and observes consistent requests originating from an internal host to a blocklisted external server. Which of the following best describes the activity that is taking place?
#85
Answer: D✅ Correct❌ Incorrect
CompTIA's CS0-003 An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls for a period of time. The web service must be accessible from the internet via the reverse proxy and must connect to a database server. Which of the following compensating controls will help contain the adversary while meeting the other requirements? (Choose two). E. Comment out the HTTP account in the /etc/passwd file of the web server. F. Move the database from the database server to the web server.
#86
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 An incident response team member is triaging a Linux server. The output is shown below:Which of the following is the adversary most likely trying to do?
#87
Answer: B✅ Correct❌ Incorrect
CompTIA's CS0-003 A SOC analyst identifies the following content while examining the output of a debugger command over a client-server application:getConnection(database01,"alpha" ,"AxTv.127GdCx94GTd");Which of the following is the most likely vulnerability in this system?
#88
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A technician is analyzing output from a popular network mapping tool for a PCI audit:Which of the following best describes the output?
#89
Answer: C✅ Correct❌ Incorrect
CompTIA's CS0-003 A managed security service provider is having difficulty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network. Which of the following would best aid in decreasing the workload without increasing staff?