CompTIA CompTIA Certifications CS0-003 Questions & Answers

• Question 141:

  An organization is conducting a pilot deployment of an e-commerce application. The application's source code is not available. Which of the following strategies should an analyst recommend to evaluate the security of the software?

  A. Static testing

  B. Vulnerability testing

  C. Dynamic testing

  D. Penetration testing

  Correct Answer: D

  Penetration testing is the best strategy to evaluate the security of the software without the source code. Penetration testing is a type of security testing that simulates real-world attacks on the software to identify and exploit its vulnerabilities. Penetration testing can be performed on the software as a black box, meaning that the tester does not need to have access to the source code or the internal structure of the software. Penetration testing can help the analyst to assess the security posture of the software, the potential impact of the vulnerabilities, and the effectiveness of the existing security controls12. Static testing, vulnerability testing, and dynamic testing are other types of security testing, but they usually require access to the source code or the internal structure of the software. Static testing is the analysis of the software code or design without executing it. Vulnerability testing is the identification and evaluation of the software weaknesses or flaws. Dynamic testing is the analysis of the software code or design while executing it345. References: Penetration Testing - OWASP, What is a Penetration Test and How Does It Work?, Static Code Analysis | OWASP Foundation, Vulnerability Scanning Best Practices, Dynamic Testing - OWASP

• Question 142:

  A security analyst recently used Arachni to perform a vulnerability assessment of a newly developed web application. The analyst is concerned about the following output:

  [+] XSS: In form input 'txtSearch' with action https://localhost/search.aspx

  [-] XSS: Analyzing response #1...

  [-] XSS: Analyzing response #2...

  [-] XSS: Analyzing response #3...

  [+] XSS: Response is tainted. Looking for proof of the vulnerability.

  Which of the following is the most likely reason for this vulnerability?

  A. The developer set input validation protection on the specific field of search.aspx.

  B. The developer did not set proper cross-site scripting protections in the header.

  C. The developer did not implement default protections in the web application build.

  D. The developer did not set proper cross-site request forgery protections.

  Correct Answer: B

  The most likely reason for this vulnerability is B. The developer did not set proper cross-site scripting protections in the header. Cross-site scripting (XSS) is a type of web application vulnerability that allows an attacker to inject malicious code into a web page that is viewed by other users. XSS can be used to steal cookies, session tokens, credentials, or other sensitive information, or to perform actions on behalf of the victim1. One of the common ways to prevent XSS attacks is to set proper HTTP response headers that instruct the browser how to handle the content of the web page. For example, the Content-Type header can specify the MIME type and character encoding of the web page, which can help the browser avoid interpreting data as code. The X-XSS-Protection header can enable or disable the browser's built-in XSS filter, which can block or sanitize suspicious scripts. The Content-Security-Policy header can define a whitelist of sources and directives that control what resources and scripts can be loaded or executed on the web page2. According to the output of Arachni, a web application security scanner framework3, it detected an XSS vulnerability in the form input `txtSearch' with action https://localhost/search.aspx. This means that Arachni was able to inject a malicious script into the input field and observe its execution in the response. This indicates that the developer did not set proper cross-site scripting protections in the header of search.aspx, which allowed Arachni to bypass the browser's default security mechanisms and execute arbitrary code on the web page.

• Question 143:

  A threat hunter seeks to identify new persistence mechanisms installed in an organization's environment. In collecting scheduled tasks from all enterprise workstations, the following host details are aggregated: Which of the following actions should the hunter perform first based on the details above?

  

  A. Acquire a copy of taskhw.exe from the impacted host

  B. Scan the enterprise to identify other systems with taskhw.exe present

  C. Perform a public search for malware reports on taskhw.exe.

  D. Change the account that runs the -caskhw. exe scheduled task

  Correct Answer: B

• Question 144:

  A security analyst observed the following activity from a privileged account:

  1.

  Accessing emails and sensitive information

  2.

  Audit logs being modified

  3.

  Abnormal log-in times

  Which of the following best describes the observed activity?

  A. Irregular peer-to-peer communication

  B. Unauthorized privileges

  C. Rogue devices on the network

  D. Insider attack

  Correct Answer: D

  The observed activity from a privileged account indicates an insider attack, which is when a trusted user or employee misuses their access rights to compromise the security of the organization. Accessing emails and sensitive information, modifying audit logs, and logging in at abnormal times are all signs of malicious behavior by a privileged user who may be trying to steal, tamper, or destroy data, or cover their tracks. An insider attack can cause significant damage to the organization's reputation, operations, and compliance12. References: The Privileged Identity Playbook Guides Management of Privileged User Accounts, How to Track Privileged Users' Activities in Active Directory

• Question 145:

  Which of the following best describes the goal of a disaster recovery exercise as preparation for possible incidents?

  A. To provide metrics and test continuity controls

  B. To verify the roles of the incident response team

  C. To provide recommendations for handling vulnerabilities

  D. To perform tests against implemented security controls

  Correct Answer: A

  A disaster recovery exercise is a simulation or a test of the disaster recovery plan, which is a set of procedures and resources that are used to restore the normal operations of an organization after a disaster or a major incident. The goal of a disaster recovery exercise is to provide metrics and test continuity controls, which are the measures that ensure the availability and resilience of the critical systems and processes of an organization. A disaster recovery exercise can help evaluate the effectiveness, efficiency, and readiness of the disaster recovery plan, as well as identify and address any gaps or issues . The other options are not the best descriptions of the goal of a disaster recovery exercise. Verifying the roles of the incident response team (B) is a goal of an incident response exercise, which is a simulation or a test of the incident response plan, which is a set of procedures and roles that are used to detect, contain, analyze, and remediate an incident. Providing recommendations for handling vulnerabilities ?is a goal of a vulnerability assessment, which is a process of identifying and prioritizing the weaknesses and risks in an organization's systems or network. Performing tests against implemented security controls (D) is a goal of a penetration test, which is an authorized and simulated attack on an organization's systems or network to evaluate their security posture and identify any vulnerabilities or misconfigurations.

• Question 146:

  A company has a primary control in place to restrict access to a sensitive database. However, the company discovered an authentication vulnerability that could bypass this control. Which of the following is the best compensating control?

  A. Running regular penetration tests to identify and address new vulnerabilities

  B. Conducting regular security awareness training of employees to prevent social engineering attacks

  C. Deploying an additional layer of access controls to verify authorized individuals

  D. Implementing intrusion detection software to alert security teams of unauthorized access attempts

  Correct Answer: C

  Deploying an additional layer of access controls to verify authorized individuals is the best compensating control for the authentication vulnerability that could bypass the primary control. A compensating control is a security measure that is implemented to mitigate the risk of a vulnerability or a threat when the primary control is not sufficient or feasible. A compensating control should provide a similar or greater level of protection as the primary control, and should be closely related to the vulnerability or the threat it is addressing1. In this case, the primary control is to restrict access to a sensitive database, and the vulnerability is an authentication bypass. Therefore, the best compensating control is to deploy an additional layer of access controls, such as multifactor authentication, role-based access control, or encryption, to verify the identity and the authorization of the individuals who are accessing the database. This way, the compensating control can prevent unauthorized access to the database, even if the primary control is bypassed23. Running regular penetration tests, conducting regular security awareness training, and implementing intrusion detection software are all good security practices, but they are not compensating controls for the authentication vulnerability, as they do not provide a similar or greater level of protection as the primary control, and they are not closely related to the vulnerability or the threat they are addressing. References: Compensating Controls: An Impermanent Solution to an IT ... - Tripwire, What is Multifactor Authentication (MFA)? | Duo Security, Role-Based Access Control (RBAC) and Role-Based Security, [What is a Penetration Test and How Does It Work?]

• Question 147:

  A cybersecurity analyst has recovered a recently compromised server to its previous state. Which of the following should the analyst perform next?

  A. Eradication

  B. Isolation

  C. Reporting

  D. Forensic analysis

  Correct Answer: D

  After recovering a compromised server to its previous state, the analyst should perform forensic analysis to determine the root cause, impact, and scope of the incident, as well as to identify any indicators of compromise, evidence, or artifacts that can be used for further investigation or prosecution. References: CompTIA CySA+ Study Guide: S0-003, 3rd Edition, Chapter 6, page 244; CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 6, page 253.

• Question 148:

  A systems administrator notices unfamiliar directory names on a production server. The administrator reviews the directory listings and files, and then concludes the server has been compromised. Which of the following steps should the administrator take next?

  A. Inform the internal incident response team.

  B. Follow the company's incident response plan.

  C. Review the lessons learned for the best approach.

  D. Determine when the access started.

  Correct Answer: B

  An incident response plan is a set of predefined procedures and guidelines that an organization follows when faced with a security breach or attack. An incident response plan helps to ensure that the organization can quickly and effectively contain, analyze, eradicate, and recover from the incident, as well as prevent or minimize the damage and impact to the business operations, reputation, and customers. An incident response plan also defines the roles and responsibilities of the incident response team, the communication channels and protocols, the escalation and reporting procedures, and the tools and resources available for the incident response. By following the company's incident response plan, the administrator can ensure that they are following the best practices and standards for handling a security incident, and that they are coordinating and collaborating with the relevant stakeholders and authorities. Following the company's incident response plan can also help to avoid or reduce any legal, regulatory, or contractual liabilities or penalties that may arise from the incident. The other options are not as effective or appropriate as following the company's incident response plan. Informing the internal incident response team (A) is a good step, but it should be done according to the company's incident response plan, which may specify who, when, how, and what to report. Reviewing the lessons learned for the best approach ?is a good step, but it should be done after the incident has been resolved and closed, not during the active response phase. Determining when the access started (D) is a good step, but it should be done as part of the analysis phase of the incident response plan, not before following the plan.

• Question 149:

  Which of the following describes a contract that is used to define the various levels of maintenance to be provided by an external business vendor in a secure environment?

  A. MOU

  B. NDA

  C. BIA

  D. SLA

  Correct Answer: D

  SLA stands for Service Level Agreement, which is a contract that defines the various levels of maintenance to be provided by an external business vendor in a secure environment. An SLA specifies the expectations, responsibilities, and obligations of both parties, such as the scope, quality, availability, and performance of the service, as well as the metrics and methods for measuring and reporting the service level. An SLA also outlines the penalties or remedies for any breach or failure of the service level. An SLA can help ensure that the external business vendor delivers the service in a timely, consistent, and secure manner, and that the customer receives the service that meets their needs and requirements. Official References: https://partners.comptia.org/docs/default-source/resources/comptia-cysa-cs0-002- exam-objectives https://www.comptia.org/certifications/cybersecurity-analyst https://www.comptia.org/blog/the-new-comptia-cybersecurity-analyst-your- questions-answered

• Question 150:

  Which of the following can be used to learn more about TTPs used by cybercriminals?

  A. ZenMAP

  B. MITRE ATTandCK

  C. National Institute of Standards and Technology

  D. theHarvester

  Correct Answer: B

  MITRE ATTandCK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as a foundation for the development of specific threat models and methodologies in the private sector,

  in government, and in the cybersecurity product and service community. It can help security professionals understand, detect, and mitigate cyber threats by providing a comprehensive framework of TTPs.

  References: MITRE ATTandCK, Getting Started with ATTandCK, MITRE ATTandCK | MITRE