CS0-003 Exam Questions

A security analyst needs to prioritize vulnerabilities for patching. Given the following vulnerability and system information: Which of the following systems should the analyst pat...

During a packet capture review, a security analyst identifies the output below as suspicious: Which of the following best describes the type of activity the analyst has identified?

A security analyst reviews a packet capture and identifies the following output as anomalous: Which of the following activities explains the output?

Which of the following is the best authentication method to secure access to sensitive data?

A security analyst wants to implement new monitoring controls in order to find abnormal account activity for traveling employees. Which of the following techniques would deliver th...

A DevOps analyst implements a webhook to trigger code vulnerability scanning for submissions to the repository. Which of the following is the primary benefit of this enhancement?

A security manager reviews the permissions for the approved users of a shared folder and finds accounts that are not on the approved access list. While investigating an incident, a...

A group of hacktivists has breached and exfiltrated data from several of a bank's competitors. Given the following network log output: Which of the following represents the greates...

The architecture team has been given a mandate to reduce the triage time of phishing incidents by 20%. Which of the following solutions will most likely help with this effort?

A user is flagged for consistently consuming a high volume of network bandwidth over the past week. During the investigation, the security analyst finds traffic to the following we...

A security analyst identifies a device on which different malware was detected multiple times, even after the systems were scanned and cleaned several times. Which of the following...

The DevSecOps team is remediating a Server-Side Request Forgery (SSRF) issue on the company's public-facing website. Which of the following is the best mitigation technique to addr...

An organization utilizes multiple vendors, each with its own portal that a security analyst must sign in to daily. Which of the following is the best solution for the organization...

Which of the following is the best way to provide realistic training for SOC analysts?

A vulnerability scan shows the following issues: At the same time, the following security advisory was released: "A zero-day vulnerability with a CVSS score of 10 may be affecting...

An organization has implemented code into a production environment. During a routine test, a penetration tester found that some of the code had a backdoor implemented, causing a de...

A security analyst has just received an incident ticket regarding a ransomware attack. Which of the following would most likely help an analyst properly triage the ticket?

A user reports a message as suspicious to the IT security team. An analyst reviews the message and notices that the following text string becomes a hyperlink in an email: %77%77%77...

When undertaking a cloud migration of multiple SaaS applications, an organization's systems administrators struggled with the complexity of extending identity and access management...

An organization performs software assurance activities and reviews some web framework code that uses exploitable jquery modules. Which of the following tools or techniques should t...

An organization is preparing for a disaster recovery exercise. Which of the following actions should be implemented first?

As part of an incident investigation, an analyst creates a detailed document that describes all activities, timelines, root causes, and mitigation actions. Which of the following r...

A third-party assessment of a recent incident determined that the incident response team spent too long trying to get the scope needed for the incident timeline and too much time w...

A security analyst is developing a script to filter firewall vulnerabilities. The script will impact the integrity of data hosted on devices connected to networks. Which of the fol...

An analyst wants to detect outdated software packages on a server. Which of the following methodologies will achieve this objective?

A systems administrator receives several reports about emails containing phishing links. The hosting domain is always different, but the URL follows a specific pattern of character...

A security analyst receives an alert with the following packet capture attached: Which of the following has occurred?

A company runs a website that allows public posts. Recently, some users report that when visiting the website, pop-ups appear asking the users for their credentials. Which of the f...

A security manager has decided to form a special group of analysts who participate in both penetration testing and defending the company's network infrastructure during exercises....

A security analyst reviews the following output: Which of the following malicious activities is occurring?

An e-commerce organization recently experienced a cyberattack. During a lessons learned meeting, a cybersecurity analyst requests that the RTO is prioritized. Which of the followin...

An analyst is reviewing an SSLscan from a web server in an environment: The analyst needs to immediately disable ciphers that do not comply with company security standards. Which o...

After several tabletop exercises, the cybersecurity team is underperforming against MTTR and MTTD. Which of the following would help the team achieve improved performance?

An IDS is triggered during after-hours operations. The indicator records an abnormal amount of SYN requests being sent to port 21 from numerous external systems. A security analyst...

An analyst finds that duplicate entries may exist in the asset inventory, which is skewing vulnerability scan data. Which of the following is the best way for the analyst to improv...

After a series of UEBA alerts, a company's SOC observes an extended period of suspicious outbound traffic all with the same destination. Which of the following steps of the cyber k...

Security analysts can review the Windows Registry on endpoints to get insights into:

An analyst notices that logs contain multiple events for computer account changes during monthly patch maintenance windows, resulting in a flood of tickets. The events generated ar...

A red team engineer discovers that analyzing multiple pieces of less sensitive public information results in knowledge of a sensitive piece of confidential information. Which of th...

A security analyst notices multiple attempts of the same exploit being made on the perimeter network. The behavioral patterns indicate that a TCP SYN flood attack has been initiate...

The SOC team reestablishes user access after a threat actor successfully performed a business account compromise in which the attacker revoked the legitimate user's access. The fol...

SIMULATION A healthcare organization must develop an action plan based on the findings from a risk assessment. The action plan must consist of risk categorization and prioritizatio...

Which of the following is best suited for determining the methods of an adversary?

An organization adds an MSSP to supplement its security monitoring operations during weekends and holidays. Which of the following would best demonstrate procurement value to the C...

Which of the following explains the reason a security analyst would map an attack route?

The most recent vulnerability scan results show the following: The vulnerability team learned the following from the asset owners: - Server HQFIN01 is a financial transaction datab...

A company's policy is to follow NIST standards and use strong encryption to avoid disclosure of sensitive information in transit between any systems. An analyst reviews a lab web s...

Which of the following does a security policy do?

A security analyst is assessing the security of a cloud environment. The following output is generated when the assessment runs: Authentication error Instance not found on preset l...

Which of the following threat-hunting concepts is most concerned with identifying the behaviors of the bad actor?