CS0-003 Exam Questions

A security analyst is responding to an indent that involves a malicious attack on a network. Data closet. Which of the following best explains how are analyst should properly docum...

While reviewing the web server logs a security analyst notices the following snippet ..\../..\../boot.ini Which of the following is being attempted?

An analyst is designing a message system for a bank. The analyst wants to include a feature that allows the recipient of a message to prove to a third party that the message came f...

Exploit code for a recently disclosed critical software vulnerability was publicly available (or download for several days before being removed. Which of the following CVSS v.3.1 t...

Several critical bugs were identified during a vulnerability scan. The SLA risk requirement is that all critical vulnerabilities should be patched within 24 hours. After sending a...

Which of the following would most likely be used to update a dashboard that integrates with multiple vendor tools?

Which of the following would eliminate the need for different passwords for a variety or internal application?

During normal security monitoring activities, the following activity was observed: cd C:\Users\Documents\HR\Employees takeown/f .* SUCCESS: Which of the following best describes th...

An organization has established a formal change management process after experiencing several critical system failures over the past year. Which of the following are key factors th...

An analyst reviews a recent government alert on new zero-day threats and finds the following CVE metrics for the most critical of the vulnerabilities: CVSS: 3.1/AV:N/AC: L/PR:N/UI:...

An incident responder was able to recover a binary file through the network traffic. The binary file was also found in some machines with anomalous behavior. Which of the following...

A security analyst would like to integrate two different SaaS-based security tools so that one tool can notify the other in the event a threat is detected. Which of the following s...

Following an attack, an analyst needs to provide a summary of the event to the Chief Information Security Officer. The summary needs to include the who-what-when information and ev...

Which of the following is the most appropriate action a security analyst to take to effectively identify the most security risks associated with a locally hosted server?

Which of the following best explains the importance of communicating with staff regarding the official public communication plan related to incidents impacting the organization?

Which of the following documents should link to the recovery point objectives and recovery time objectives on critical services?

A vulnerability analyst is writing a report documenting the newest, most critical vulnerabilities identified in the past month. Which of the following public MITRE repositories wou...

An analyst is investigating a phishing incident and has retrieved the following as part of the investigation: cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -...

Which of the following best describes the key goal of the containment stage of an incident response process?

During a tabletop exercise, engineers discovered that an ICS could not be updated due to hardware versioning incompatibility. Which of the following is the most likely cause of thi...

Results of a SOC customer service evaluation indicate high levels of dissatisfaction with the inconsistent services provided after regular work hours. To address this, the SOC lead...

A cybersecurity analyst has been assigned to the threat-hunting team to create a dynamic detection strategy based on behavioral analysis and attack patterns. Which of the following...

A development team is preparing to roll out a beta version of a web application and wants to quickly test for vulnerabilities, including SQL injection, path traversal, and cross-si...

An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM. Which of the following is the best option for th...

Which of the following will most likely cause severe issues with authentication and logging?

A list of loCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost. exe. Which of the following best describe...

A SOC analyst determined that a significant number of the reported alarms could be closed after removing the duplicates. Which of the following could help the analyst reduce the nu...

A company is launching a new application in its internal network, where internal customers can communicate with the service desk. The security team needs to ensure the application...

SIMULATION An organization has noticed large amounts of data are being sent out of its network. An analyst is identifying the cause of the data exfiltration. INSTRUCTIONS Select th...

A security administrator is tasked with modifying the vulnerability scan process to reduce the network traffic but maintain thorough checks. Which of the following scanning approac...

SIMULATION An organization's website was maliciously altered. INSTRUCTIONS Review information in each tab to select the source IP the analyst should be concerned about, the indicat...

SIMULATION A systems administrator is reviewing the output of a vulnerability scan. INSTRUCTIONS Review the information in each tab. Based on the organization's environment archite...

Which of the following explains the importance of a timeline when providing an incident response report?

A security administrator has found indications of dictionary attacks against the company's external-facing portal. Which of the following should be implemented to best mitigate the...

Which of the following best explains the importance of the implementation of a secure software development life cycle in a company with an internal development team?

Which of the following is the best reason to implement an MOU?

Which of the following ensures that a team receives simulated threats to evaluate incident response performance and coordination?

A new SOC manager reviewed findings regarding the strengths and weaknesses of the last tabletop exercise in order to make improvements. Which of the following should the SOC manage...

K company has recently experienced a security breach via a public-facing service. Analysis of the event on the server was traced back to the following piece of code: SELECT ' From...

A report contains IoC and TTP information for a zero-day exploit that leverages vulnerabilities in a specific version of a web application. Which of the following actions should a...

A web application has a function to retrieve content from an internal URL to identify CSRF attacks in the logs. The security analyst is building a regular expression that will filt...

Which of the following best explains the importance of network microsegmentation as part of a Zero Trust architecture?

A company's internet-facing web application has been compromised several times due to identified design flaws. The company would like to minimize the risk of these incidents from r...

A network security analyst for a large company noticed unusual network activity on a critical system. Which of the following tools should the analyst use to analyze network traffic...

A Chief Information Security Officer wants to lock down the users' ability to change applications that are installed on their Windows systems. Which of the following is the best en...

A Chief Information Security Officer (CISO) has determined through lessons learned and an associated after-action report that staff members who use legacy applications do not adequ...

Which of the following is most appropriate to use with SOAR when the security team would like to automate actions across different vendor platforms?

Which of the following responsibilities does the legal team have during an incident management event? (Choose two.)

Executives at an organization email sensitive financial information to external business partners when negotiating valuable contracts. To ensure the legal validity of these message...

A company patches its servers using automation software. Remote SSH or RDP connections are allowed to the servers only from the service account used by the automation software. All...