CS0-003 Exam Questions
658 real CS0-003 exam questions with expert-verified answers and explanations. Page 2 of 14.
- Question #51Incident Response and Management
An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data...
incident responsedigital forensicsorder of volatilityevidence collection - Question #52Security operations
Which of the following security operations tasks are ideal for automation?
security automationsecurity operationsSOARautomation tasks - Question #53Reporting and Communication
An organization has experienced a breach of customer transactions. Under the terms of PCI DSS, which of the following groups should the organization report the breach to?
PCI DSSdata breach reportingcompliance - Question #54Security Operations
Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?
security metricsSIEMSOARmean time to detect - Question #55Vulnerability Management
A company is implementing a vulnerability management program and moving from an on- premises environment to a hybrid IaaS cloud environment. Which of the following implications sho...
vulnerability scanninghybrid cloudIaaScloud misconfiguration - Question #56Incident Response and Management
A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SO...
incident investigationprivacy policiesHR compliancelog collection - Question #57Incident Response and Management
Which of the following is the first step that should be performed when establishing a disaster recovery plan?
disaster recovery planningDRPgoals and objectives - Question #58Incident Response and Management
Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?
incident communicationCSIRTincident response policy - Question #59Reporting and Communication
A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the brief...
threat intelligenceindicators of compromiseexecutive briefing - Question #60Security Operations
An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following des...
C2 trafficbeaconingnetwork anomaly detection - Question #61Incident Response and Management
A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ft...
packet analysisWiresharkFTPincident investigation - Question #62Incident Response and Management
An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following st...
incident response phaseseradicationremediation - Question #63Incident Response and Management
Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer...
insider threatlegal counselHR policiesincident response decision-making - Question #64Security Operations
The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to c...
zero trustattack surface reductionprivileged access management - Question #65Incident Response and Management
During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to...
incident responsedigital forensicsvirtual machine cloningevidence preservation - Question #66Security Operations
A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address....
C2 beaconingnetwork traffic analysisthreat detection - Question #67Vulnerability Management
A software developer is correcting the error-handling capabilities of an application following the initial coding of the fix. Which of the following would the software developer MO...
static analysiscode reviewsecure development lifecycle - Question #68Security Operations
Forming a hypothesis, looking for indicators of compromise, and using the findings to proactively improve detection capabilities are examples of the value of:
threat huntingindicators of compromiseproactive defense - Question #69Security Operations
Which of the following BEST explains the function of a managerial control?
managerial controlssecurity controlsrisk assessment - Question #70Security Operations
Which of the following types of controls defines placing an ACL on a file folder?
technical controlsaccess control listssecurity controls - Question #71Vulnerability Management
A code review reveals a web application is using lime-based cookies for session management. This is a security concern because lime-based cookies are easy to:
web application securitysession managementvulnerabilitiescode review - Question #72Security Operations
A security analyst discovers suspicious host activity while performing monitoring activities. The analyst pulls a packet capture for the activity and sees the following: Follow TCP...
packet analysisnetwork monitoringTCP streamsuspicious activity - Question #73Security operations
A security analyst is reviewing the following Internet usage trend report: Which of the following usernames should the security analyst investigate further?
Log analysisSuspicious activityInternet usage monitoringUser behavior analytics - Question #74Vulnerability Management
A consultant evaluating multiple threat intelligence leads to assess potential risks for a client. Which of the following is the BEST approach for the consultant to consider when m...
Threat intelligenceAttack surface modelingRisk assessmentVulnerability assessment - Question #75Security operations
Which of the following, BEST explains the function of TPM?
TPMHardware securityCryptographic keysSecure boot - Question #76Incident Response and Management
An analyst determines a security incident has occurred. Which of the following is the most appropriate NEXT step in an incident response plan?
Incident response planCommunication planIncident handlingFirst steps - Question #77Vulnerability Management
A company's application development has been outsourced to a third-party development team. Based on the SLA, the development team must follow industry best practices for secure cod...
Secure codingApplication security testingFuzzingThird-party risk management - Question #78Security operations
A security administrator needs to provide access from partners to an Isolated laboratory network inside an organization that meets the following requirements: - The partners' PCs m...
Secure remote accessJump boxVDINetwork segmentationPartner access - Question #79Reporting and Communication
Which of the following are the MOST likely reasons lo include reporting processes when updating an incident response plan after a breach? (Select TWO).
Incident reportingRegulatory complianceChain of commandPost-incident review - Question #80Vulnerability Management
Which of the following is MOST dangerous to the client environment during a vulnerability assessment penetration test?
Penetration testingVulnerability assessmentScope creepEthical hacking - Question #81Security operations
Which of the following is MOST important when developing a threat hunting program?
Threat huntingAsset managementProgram developmentCyber defense - Question #82Vulnerability Management
A cybersecurity analyst needs to harden a server that is currently being used as a web server. Additionally, web pages require frequent updates, which are performed by a remote con...
Server hardeningVulnerability managementPort securityService managementRemote access security - Question #83Security operations
Which of the following BEST describes HSM?
HSMHardware security moduleKey managementCryptography - Question #84Security operations
A threat hurting team received a new loC from an ISAC that follows a threat actor's profile and activities. Which of the following should be updated NEXT?
Threat intelligenceIoCIDS/IPS signaturesSecurity operations - Question #85Reporting and Communication
Which of the following BEST describes what an organizations incident response plan should cover regarding how the organization handles public or private disclosures of an incident?
Incident response planDisclosure policyRegulatory compliancePublic relations - Question #86Vulnerability Management
An IT security analyst has received an email alert regarding a vulnerability within the new fleet of vehicles the company recently purchased. Which of the following attack vectors...
Automotive securityCAN busVulnerabilityIoT security - Question #87Incident Response and Management
After examining a header and footer file, a security analyst begins reconstructing files by scanning the raw data bytes of a hard disk and rebuilding them. Which of the following t...
File carvingDigital forensicsData recoveryIncident analysis - Question #88Security operations
An organization is experiencing security incidents in which a systems administrator is creating unauthorized user accounts A security analyst has created a script to snapshot the s...
Linux commandsChange detectionLog analysisUnauthorized accessInsider threat - Question #89Security operations
A company's domain has been spooled in numerous phishing campaigns. An analyst needs to determine the company is a victim of domain spoofing, despite having a DMARC record that sho...
DMARCEmail securityDomain spoofingPhishing preventionDNS records - Question #90Security operations
Which of the following BEST explains the function of trusted firmware updates as they relate to hardware assurance?
Firmware updatesHardware assuranceSecure bootCode signing - Question #91Incident Response and Management
A help desk technician inadvertently sent the credentials of the company's CRM n clear text to an employee's personal email account. The technician then reset the employee's accoun...
Incident responseIncident reportingCredential compromiseData breachPost-incident steps - Question #92Security operations
A developer downloaded and attempted to install a file transfer application in which the installation package is bundled with adware. The next-generation antivirus software prevent...
Malware preventionWeb proxyNGAVEndpoint securityNetwork security - Question #93Vulnerability Management
After detecting possible malicious external scanning, an internal vulnerability scan was performed, and a critical server was found with an outdated version of JBoss. A legacy appl...
Vulnerability remediationNetwork segmentationLegacy systemsDMZ - Question #94Incident Response and Management
An incident response team detected malicious software that could have gained access to credit card data. The incident response team was able to mitigate significant damage and impl...
Incident response processLessons learnedStakeholder communication - Question #95Incident Response and Management
In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers Ba...
Incident containmentSIEM analysisBrute-force attackNetwork segmentation - Question #96Security Operations
While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certificate authority that is only used to sign intermediate certificates. Whi...
PKI securityCertificate AuthorityAir gapSecure configuration - Question #97Security Operations
Which of the following BEST identifies the appropriate use of threat intelligence as a function of detection and response?
Threat intelligenceDetection and responseAttack scenarios - Question #98Vulnerability management
While conducting a cloud assessment, a security analyst performs a Prowler scan, which generates the following within the report: Based on the Prowler report, which of the followin...
Cloud security assessmentProwler scanAccess key managementVulnerability remediation - Question #99Vulnerability Management
An internally developed file-monitoring system identified the following except as causing a program to crash often: char filedata[100]; fp = fopen(`access.log`, `r`); srtcopy (file...
Buffer overflowSecure codingstrcpyVulnerability remediation - Question #100Security Operations
An organization has the following policy statements: - AlI emails entering or leaving the organization will be subject to inspection for malware, policy violations, and unauthorize...
Security policiesData managementComplianceData governance