CompTIA CompTIA Certifications CS0-003 Questions & Answers

• Question 401:

  An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?

  A. To satisfy regulatory requirements for incident reporting

  B. To hold other departments accountable

  C. To identify areas of improvement in the incident response process

  D. To highlight the notable practices of the organization's incident response team

  Correct Answer: C

  The most likely reason to include lessons learned in an after-action report is to identify areas of improvement in the incident response process. The lessons learned process is a way of reviewing and evaluating the incident response activities and outcomes, as well as identifying and documenting any strengths, weaknesses, gaps, or best practices. Identifying areas of improvement in the incident response process can help enhance the security posture, readiness, or capability of the organization for future incidents, as well as provide feedback or recommendations on how to address any issues or challenges.

• Question 402:

  An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign?

  A. Information sharing organization

  B. Blogs/forums

  C. Cybersecuritv incident response team

  D. Deep/dark web

  Correct Answer: A

  An information sharing organization is a group or network of organizations that share threat intelligence, best practices, or lessons learned related to cybersecurity issues or incidents. An information sharing organization can help security analysts learn about new ransomware campaigns or other emerging threats, as well as get recommendations or guidance on how to prevent, detect, or respond to them. An information sharing organization can also help security analysts collaborate or coordinate with other organizations in the same industry or region that may face similar threats or challenges.

• Question 403:

  New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?

  A. Human resources must email a copy of a user agreement to all new employees

  B. Supervisors must get verbal confirmation from new employees indicating they have read the user agreement

  C. All new employees must take a test about the company security policy during the cjitoardmg process

  D. All new employees must sign a user agreement to acknowledge the company security policy

  Correct Answer: D

  The best action that the SOC manager can recommend to help ensure new employees are accountable for following the company policy is to require all new employees to sign a user agreement to acknowledge the company security policy. A user agreement is a document that defines the rights and responsibilities of the users regarding " networks, or resources, as well as the consequences of violatin" Signing a user agreement can help ensure new employees are aware of and agree to comply with the company security policy, as well as hold them accountable for any breaches or incidents caused by their actions or inactions.

• Question 404:

  During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first?

  A. Clone the virtual server for forensic analysis

  B. Log in to the affected server and begin analysis of the logs

  C. Restore from the last known-good backup to confirm there was no loss of connectivity

  D. Shut down the affected server immediately

  Correct Answer: A

  The first action that the analyst should take in this case is to clone the virtual server for forensic analysis. Cloning the virtual server involves creating an exact" state at a specific point in time. Cloning the virtual server can help preserve and protect any evidence or information related to the security incident, as well as prevent any tampering, contamination, or destruction of evidence. Cloning the virtual server can also allow the analyst to safely analyze and investigate the incident without affecting the original server or its operations.

• Question 405:

  A systems administrator is reviewing after-hours traffic flows from data-center servers and sees regular outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation?

  A. C2 beaconing activity

  B. Data exfiltration

  C. Anomalous activity on unexpected ports

  D. Network host IP address scanning

  E. A rogue network device

  Correct Answer: A

  The most likely explanation for this traffic pattern is C2 beaconing activity. C2 stands for command and control, which is a phase of the Cyber Kill Chain that involves the adversary attempting to establish communication with a successfully exploited target. C2 beaconing activity is a type of network traffic that indicates a compromised system is sending periodic messages or signals to an " protocols, such as HTTP(S), DNS, ICMP, or UDP. C2 beaconing activity can enable the attacker to remotely control or manipulate the target system or network using various methods, such as malware callbacks, backdoors, botnets, or covert channels.

• Question 406:

  The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program. Which of the following is the best priority based on common attack frameworks?

  A. Reduce the administrator and privileged access accounts

  B. Employ a network-based IDS

  C. Conduct thorough incident response

  D. Enable SSO to enterprise applications

  Correct Answer: A

  The best priority based on common attack frameworks for a new program to reduce attack surface risks and threats as part of a zero trust approach is to reduce the administrator and privileged access accounts. Administrator and privileged access accounts are accounts that have elevated permissions or capabilities to perform sensitive or critical tasks on systems or networks, such as installing software, changing configurations, accessing data, or granting access. Reducing the administrator and privileged access accounts can help minimize the attack surface, as it can limit the number of potential targets or entry points for attackers, as well as reduce the impact or damage of an attack if an account is compromised.

• Question 407:

  Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?

  A. Isolate Joe's PC from the network

  B. Reimage the PC based on standard operating procedures

  C. Initiate a remote wipe of Joe's PC using mobile device management

  D. Perform no action until HR or legal counsel advises on next steps

  Correct Answer: D

  The best action for the incident response team to recommend in this scenario is to perform no action until HR or legal counsel advises on next steps. This action can help avoid any potential legal or ethical issues, such as violating employee privacy rights, contractual obligations, or organizational policies. This action can also help ensure that any evidence or information collected from the "of any legal action or dispute. The incident response team should consult with HR or legal counsel before taking any action that may "

• Question 408:

  An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?

  A. Eradication

  B. Recovery

  C. Containment

  D. Preparation

  Correct Answer: A

  Eradication is a step in the incident response process that involves removing any traces or remnants of the incident from the affected systems or networks, such as malware, backdoors, compromised accounts, or malicious files. Eradication also involves restoring the systems or networks to their normal or secure state, as well as verifying that the incident is completely eliminated and cannot recur. In this case, the analyst is remediating items associated with a recent incident by isolating the vulnerability and actively removing it from the system. This describes the eradication step of the incident response process.

• Question 409:

  The security operations team is required to consolidate several threat intelligence feeds due to redundant tools and portals. Which of the following will best achieve the goal and maximize results?

  A. Single pane of glass

  B. Single sign-on

  C. Data enrichment

  D. Deduplication

  Correct Answer: A

• Question 410:

  Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

  A. MITRE ATTACK

  B. Cyber Kill Cham

  C. OWASP

  D. STIXTAXII

  Correct Answer: A

  MITRE ATTandCK is a framework and knowledge base that describes the tactics, techniques, and procedures (TTPs) used by various adversaries in cyberattacks. MITRE ATTandCK can help security analysts compare TTPs between different known adversaries of an organization, as well as identify patterns, gaps, or trends in adversary behavior. MITRE ATTandCK can also help security analysts improve threat detection, analysis, and response capabilities, as well as share threat intelligence with other organizations or communities