2023 New CS0-003 Dumps – Real CompTIA Exam Questions [Q28-Q48]

NO.28 Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer’s customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?

Isolate Joe’s PC from the network

Reimage the PC based on standard operating procedures

Initiate a remote wipe of Joe’s PC using mobile device management

Perform no action until HR or legal counsel advises on next steps

NO.29 Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

MITRE ATTACK

Cyber Kill Cham

OWASP

STIXTAXII

NO.30 A security analyst is monitoring a company’s network traffic and finds ping requests going to accounting and human resources servers from a SQL server. Upon investigation, the analyst discovers a technician responded to potential network connectivity issues. Which of the following is the best way for the security analyst to respond?

Report this activity as a false positive, as the activity is legitimate.

Isolate the system and begin a forensic investigation to determine what was compromised.

Recommend network segmentation to the management team as a way to secure the various environments.

Implement host-based firewalls on all systems to prevent ping sweeps in the future.

NO.31 A security analyst is reviewing the following log entries to identify anomalous activity:

Which of the following attack types is occurring?

Directory traversal

SQL injection

Buffer overflow

Cross-site scripting

NO.32 A security analyst reviews the latest vulnerability scans and observes there are vulnerabilities with similar CVSSv3 scores but different base score metrics. Which of the following attack vectors should the analyst remediate first?

CVSS 3.0/AVP/AC:L/PR:L/UI:N/S U/C:H/I:H/A:H

CVSS 3.0/AV:A/AC .L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 3.0/AV:N/AC:L/PR:L/UI:N/S;U/C:H/I:H/A:H

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Explanation
CVSS 3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is the attack vector that the analyst should remediate first, as it has the highest CVSSv3 score of 8.1. CVSSv3 (Common Vulnerability Scoring System version 3) is a standard framework for rating the severity of vulnerabilities, based on various metrics that reflect the characteristics and impact of the vulnerability. The CVSSv3 score is calculated from three groups of metrics:
Base, Temporal, and Environmental. The Base metrics are mandatory and reflect the intrinsic qualities of the vulnerability, such as how it can be exploited, what privileges are required, and what impact it has on confidentiality, integrity, and availability. The Temporal metrics are optional and reflect the current state of the vulnerability, such as whether there is a known exploit, a patch, or a workaround. The Environmental metrics are also optional and reflect the context of the vulnerability in a specific environment, such as how it affects the asset value, security requirements, or mitigating controls. The Base metrics produce a score ranging from 0 to 10, which can then be modified by scoring the Temporal and Environmental metrics. A CVSS score is also represented as a vector string, a compressed textual representation of the values used to derive the score.
The attack vector in question has the following Base metrics:
Attack Vector (AV): Network (N). This means that the vulnerability can be exploited remotely over a network connection.
Attack Complexity (AC): Low (L). This means that the attack does not require any special conditions or changes to the configuration of the target system.
Privileges Required (PR): Low (L). This means that the attacker needs some privileges on the target system to exploit the vulnerability, such as user-level access.
User Interaction (UI): None (N). This means that the attack does not require any user action or involvement to succeed.
Scope (S): Unchanged (U). This means that the impact of the vulnerability is confined to the same security authority as the vulnerable component, such as an application or an operating system.
Confidentiality Impact : High (H). This means that the vulnerability results in a total loss of confidentiality, such as unauthorized disclosure of all data on the system.
Integrity Impact (I): High (H). This means that the vulnerability results in a total loss of integrity, such as unauthorized modification or deletion of all data on the system.
Availability Impact (A): High (H). This means that the vulnerability results in a total loss of availability, such as denial of service or system crash.
Using these metrics, we can calculate the Base score using this formula:
Base Score = Roundup(Minimum[(Impact + Exploitability), 10])
Where:
Impact = 6.42 x [1 – ((1 – Confidentiality) x (1 – Integrity) x (1 – Availability))] Exploitability = 8.22 x Attack Vector x Attack Complexity x Privileges Required x User Interaction Using this formula, we get:
Impact = 6.42 x [1 – ((1 – 0.56) x (1 – 0.56) x (1 – 0.56))] = 5.9
Exploitability = 8.22 x 0.85 x 0.77 x 0.62 x 0.85 = 2.8
Base Score = Roundup(Minimum[(5.9 + 2.8), 10]) = Roundup(8.7) = 8.8
Therefore, this attack vector has a Base score of 8.8, which is higher than any other option.
The other attack vectors have lower Base scores, as they have different values for some of the Base metrics:
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H has a Base score of 6.2, as it has a lower value for Attack Vector (Physical), which means that the vulnerability can only be exploited by having physical access to the target system.
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H has a Base score of 7.4, as it has a lower value for Attack Vector (Adjacent Network), which means that the vulnerability can only be exploited by being on the same physical or logical network as the target system.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H has a Base score of 6.8, as it has a lower value for Attack Vector (Local), which means that the vulnerability can only be exploited by having local access to the target system, such as through a terminal or a command shell.

NO.33 The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

Deploy a CASB and enable policy enforcement

Configure MFA with strict access

Deploy an API gateway

Enable SSO to the cloud applications

NO.34 Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

Mean time to detect

Number of exploits by tactic

Alert volume

Quantity of intrusion attempts

NO.35 An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

Disable the user’s network account and access to web resources

Make a copy of the files as a backup on the server.

Place a legal hold on the device and the user’s network share.

Make a forensic image of the device and create a SRA-I hash.

NO.36 An organization wants to move non-essential services into a cloud computing environment. The management team has a cost focus and would like to achieve a recovery time objective of 12 hours. Which of the following cloud recovery strategies would work best to attain the desired outcome?

Duplicate all services in another instance and load balance between the instances.

Establish a hot site with active replication to another region within the same cloud provider.

Set up a warm disaster recovery site with the same cloud provider in a different region.

Configure the systems with a cold site at another cloud provider that can be used for failover.

NO.37 A product manager is working with an analyst to design a new application that will perform as a data analytics platform and will be accessible via a web browser. The product manager suggests using a PaaS provider to host the application. Which of the following is a security concern when using a PaaS solution?

The use of infrastructure-as-code capabilities leads to an increased attack surface.

Patching the underlying application server becomes the responsibility of the client.

The application is unable to use encryption at the database level.

Insecure application programming interfaces can lead to data compromise.

NO.38 A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user’s workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

Create a timeline of events detailinq the date stamps, user account hostname and IP information associated with the activities

Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation

Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identity the case as an HR-related investigation

Notify the SOC manager for awareness after confirmation that the activity was intentional

NO.39 An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of- life date. Which of the following best describes a security analyst’s concern?

Any discovered vulnerabilities will not be remediated.

An outage of machinery would cost the organization money.

Support will not be available for the critical machinery

There are no compensating controls in place for the OS.

NO.40 The security analyst received the monthly vulnerability report. The following findings were included in the report
* Five of the systems only required a reboot to finalize the patch application.
* Two of the servers are running outdated operating systems and cannot be patched The analyst determines that the only way to ensure these servers cannot be compromised is to isolate them.
Which of the following approaches will best minimize the risk of the outdated servers being compromised?

Compensating controls

Due diligence

Maintenance windows

Passive discovery

NO.41 During a cybersecurity incident, one of the web servers at the perimeter network was affected by ransomware.
Which of the following actions should be performed immediately?

Shut down the server.

Reimage the server

Quarantine the server

Update the OS to latest version.

NO.42 A development team recently released a new version of a public-facing website for testing prior to production. The development team is soliciting the help of various teams to validate the functionality of the website due to its high visibility. Which of the following activities best describes the process the development team is initiating?

Static analysis

Stress testing

Code review

User acceptance testing

NO.43 During the forensic analysis of a compromised machine, a security analyst discovers some binaries that are exhibiting abnormal behaviors. After extracting the strings, the analyst finds unexpected content. Which of the following is the next step the analyst should take?

Validate the binaries’ hashes from a trusted source.

Use file integrity monitoring to validate the digital signature

Run an antivirus against the binaries to check for malware.

Only allow binaries on the approve list to execute.

NO.44 A cybersecurity analyst is reviewing SIEM logs and observes consistent requests originating from an internal host to a blocklisted external server. Which of the following best describes the activity that is taking place?

Data exfiltration

Rogue device

Scanning

Beaconing

NO.45 Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

MITRE ATTACK

Cyber Kill Cham

OWASP

STIXTAXII

NO.46 Which of the following items should be included in a vulnerability scan report? (Choose two.)

Lessons learned

Service-level agreement

Playbook

Affected hosts

Risk score

Education plan

NO.47 Which of the following best describes the goal of a tabletop exercise?

To test possible incident scenarios and how to react properly

To perform attack exercises to check response effectiveness

To understand existing threat actors and how to replicate their techniques

To check the effectiveness of the business continuity plan

NO.48 A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data. Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results?

Credentialed network scanning

Passive scanning

Agent-based scanning

Dynamic scanning