CS0-003 Exam Questions

An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data...

Which of the following security operations tasks are ideal for automation?

An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to?

Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

A company is implementing a vulnerability management program and moving from an on- premises environment to a hybrid IaaS cloud environment. Which of the following implications sho...

A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SO...

Which of the following is the first step that should be performed when establishing a disaster recovery plan?

Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the brief...

An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following des...

A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ft...

An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following st...

Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer...

The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to c...

During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to...

A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address....

A software developer is correcting the error-handling capabilities of an application following the initial coding of the fix. Which of the following would the software developer MO...

Forming a hypothesis, looking for indicators of compromise, and using the findings to proactively improve detection capabilities are examples of the value of:

Which of the following BEST explains the function of a managerial control?

Which of the following types of controls defines placing an ACL on a file folder?

A code review reveals a web application is using lime-based cookies for session management. This is a security concern because lime-based cookies are easy to:

A security analyst discovers suspicious host activity while performing monitoring activities. The analyst pulls a packet capture for the activity and sees the following: Follow TCP...

A security analyst is reviewing the following Internet usage trend report: Which of the following usernames should the security analyst investigate further?

A consultant evaluating multiple threat intelligence leads to assess potential risks for a client. Which of the following is the BEST approach for the consultant to consider when m...

Which of the following, BEST explains the function of TPM?

An analyst determines a security incident has occurred. Which of the following is the most appropriate NEXT step in an incident response plan?

A company's application development has been outsourced to a third-party development team. Based on the SLA, the development team must follow industry best practices for secure cod...

A security administrator needs to provide access from partners to an Isolated laboratory network inside an organization that meets the following requirements: - The partners' PCs m...

Which of the following are the MOST likely reasons lo include reporting processes when updating an incident response plan after a breach? (Select TWO).

Which of the following is MOST dangerous to the client environment during a vulnerability assessment penetration test?

Which of the following is MOST important when developing a threat hunting program?

A cybersecurity analyst needs to harden a server that is currently being used as a web server. Additionally, web pages require frequent updates, which are performed by a remote con...

Which of the following BEST describes HSM?

A threat hurting team received a new loC from an ISAC that follows a threat actor's profile and activities. Which of the following should be updated NEXT?

Which of the following BEST describes what an organizations incident response plan should cover regarding how the organization handles public or private disclosures of an incident?

An IT security analyst has received an email alert regarding a vulnerability within the new fleet of vehicles the company recently purchased. Which of the following attack vectors...

After examining a header and footer file, a security analyst begins reconstructing files by scanning the raw data bytes of a hard disk and rebuilding them. Which of the following t...

An organization is experiencing security incidents in which a systems administrator is creating unauthorized user accounts A security analyst has created a script to snapshot the s...

A company's domain has been spooled in numerous phishing campaigns. An analyst needs to determine the company is a victim of domain spoofing, despite having a DMARC record that sho...

Which of the following BEST explains the function of trusted firmware updates as they relate to hardware assurance?

A help desk technician inadvertently sent the credentials of the company's CRM n clear text to an employee's personal email account. The technician then reset the employee's accoun...

A developer downloaded and attempted to install a file transfer application in which the installation package is bundled with adware. The next-generation antivirus software prevent...

After detecting possible malicious external scanning, an internal vulnerability scan was performed, and a critical server was found with an outdated version of JBoss. A legacy appl...

An incident response team detected malicious software that could have gained access to credit card data. The incident response team was able to mitigate significant damage and impl...

In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers Ba...

While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certificate authority that is only used to sign intermediate certificates. Whi...

Which of the following BEST identifies the appropriate use of threat intelligence as a function of detection and response?

While conducting a cloud assessment, a security analyst performs a Prowler scan, which generates the following within the report: Based on the Prowler report, which of the followin...

An internally developed file-monitoring system identified the following except as causing a program to crash often: char filedata[100]; fp = fopen(`access.log`, `r`); srtcopy (file...

An organization has the following policy statements: - AlI emails entering or leaving the organization will be subject to inspection for malware, policy violations, and unauthorize...