CS0-003 Exam Questions

A newly hired security manager in a SOC wants to improve efficiency by automating routine tasks. Which of the following SOC tasks is most suitable for automation?

Which of the following is a circumstance in which a security operations manager would most likely consider using automation?

A system that provides the user interface for a critical server has potentially been corrupted by malware. Which of the following is the best recommendation to ensure business cont...

Which of following attack methodology frameworks should a cybersecurity analyst use to identify similar TTPs utilized by nation-state actors?

During a training exercise, a security analyst must determine the vulnerabilities to prioritize. The analyst reviews the following vulnerability scan output: Which of the following...

An analyst is trying to capture anomalous traffic from a compromised host. Which of the following are the best tools for achieving this objective? (Choose two.)

Executives want to compare certain metrics from the most recent and last reporting periods to determine whether the metrics are increasing or decreasing. Which of the following wou...

A security analyst is reviewing a recent vulnerability scan report for a new server infrastructure. The analyst would like to make the best use of time by resolving the most critic...

A SOC manager reviews metrics from the last four weeks to investigate a recurring availability issue. The manager finds similar events correlating to the times of the reported issu...

A security analyst must assist the IT department with creating a phased plan for vulnerability patching that meets established SLAs. Which of the following vulnerability management...

A Chief Information Security Officer has requested a dashboard to share critical vulnerability management goals with company leadership. Which of the following would be the best to...

Numerous emails were sent to a company's customer distribution list. The customers reported that the emails contained a suspicious link. The company's SOC determined the links were...

A security analyst is conducting a vulnerability assessment of a company's online store. The analyst discovers a critical vulnerability in the payment processing system that could...

Thousands of computers were compromised in the compromise was detected on only three computers during the latest vulnerability scan. An analyst conducts an after action review to d...

A WAF weekly report shows that a daily spike occurs from the same subnet. An open-source review indicates the IP addresses belong to a legitimate internet service provider but have...

A Chief Information Security Officer (CISO) has decided the cost to protect an asset is greater than the cost of losing the asset. Which of the following risk management principles...

A company was able to reduce triage time by focusing on historical trend analysis. The business partnered with the security team to achieve a 50% reduction in phishing attempts yea...

Several incidents have occurred with a legacy web application that has had little development work completed. Which of the following is the most likely cause of the incidents?

An incident response team is assessing attack vectors of malware that is encrypting data with ransomware. There are no indications of a network-based intrusion. Which of the follow...

A security analyst needs to block vulnerable ports and disable legacy protocols. The analyst has ensured NetBIOS trio, Telnet, SMB, and TFTP are blocked and/or disabled. Which of t...

The SOC receives a number of complaints regarding a recent uptick in desktop error messages that are associated with workstation access to an internal web application. An analyst,...

Which of the following choices is most likely to cause obstacles in vulnerability remediation?

A security analyst needs to identify services in a small, critical infrastructure ICS network. Many components in the network are likely to break if they receive malformed or unusu...

An analyst would like to start automatically ingesting IoCs into the EDR tool. Which of the following sources would be the most cost effective for the analyst to use?

A user clicks on a malicious adware link, and the malware successfully downloads to the machine. The malware has a script that invokes command-and-control activity. Which of the fo...

Which of the following should be performed first when creating a BCP to ensure that all critical functions and financial implications have been considered?

Which of the following best describes root cause analysis?

A security analyst has identified outgoing network traffic leaving the enterprise at odd times. The traffic appears to pivot across network segments and target domain servers. The...

Based on an internal assessment, a vulnerability management team wants to proactively identify risks to the infrastructure prior to production deployments. Which of the following b...

Which of the following best explains the importance of utilizing an incident response playbook?

Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

A security analyst needs to support an organization's legal case against a threat actor. Which of the following processes provides the best way to assist in the prosecution of the...

An end user forwarded an email with a file attachment to the SOC for review. The SOC analysts think the file was specially crafted for the target. Which of the following investigat...

Which of the following is instituting a security policy that users must lock their systems when stepping away from their desks an example of?

A cybersecurity analyst is recommending a solution to ensure emails that contain links or attachments are tested before they reach a mail server. Which of the following will the an...

A security analyst needs to identify an asset that should be remediated based on the following information: Which of the following assets should the analyst remediate first?

A security analyst runs tcpdump on the 10.203.10.22 machine and observes thousands of packets as shown below: Which of the following activities explains the tcpdump output?

Which of the following is the best metric to use when reviewing and addressing findings that caused an incident?

A cybersecurity analyst is setting up a security control that monitors network traffic and produces an active response to a security event. Which of the following tools is the anal...

A security analyst working for an airline is prioritizing vulnerabilities found on a system. The system has the following requirements: - Can store periodically audited documents r...

Which of the following best describe the external requirements that are imposed for incident management communication? (Choose two).

A security analyst observes a high volume of SYN flags from an unexpected source toward a web application server within one hour. The traffic is not flagging for any exploit signat...

Which of the following features is a key component of Zero Trust architecture?

An organization wants to establish a disaster recovery plan for critical applications that are hosted on premises. Which of the following is the first step to prepare for supportin...

A junior security analyst opened ports on the company's firewall, and the company experienced a data breach. Which of the following most likely caused the data breach?

An analyst produces a weekly endpoint status report for the management team. The report Includes specific details for each endpoint in relation to organizational baselines. Which o...

A user is suspected of violating policy by logging in to a Linux VM during non-business hours. Which of the following system files is the best way to track the user's activities?

A user's computer is performing slower than the day before, and unexpected windows continually open and close. The user did not install any new programs, and after the user restart...

A security analyst finds an application that cannot enforce the organization's password policy. An exception is granted. As a compensating control, all users must confirm that thei...

A security analyst provides the management team with an after action report for a security incident. Which of the following is the management team most likely to review in order to...