CompTIA CompTIA Certifications CS0-003 Questions & Answers

• Question 71:

  Exploit code for a recently disclosed critical software vulnerability was publicly available (or download for several days before being removed. Which of the following CVSS v.3.1 temporal metrics was most impacted by this exposure?

  A. Remediation level

  B. Exploit code maturity

  C. Report confidence

  D. Availability

  Correct Answer: B

  Exploit code maturity in the CVSS v.3.1 temporal metrics refers to the reliability and availability of exploit code for a vulnerability. Public availability of exploit code increases the exploit code maturity score. The availability of exploit code affects the 'Exploit Code Maturity' metric in CVSS v.3.1. This metric evaluates the level of maturity of the exploit that targets the vulnerability. When exploit code is readily available, it suggests a higher level of maturity, indicating that the exploit is more reliable and easier to use.

• Question 72:

  A Chief Information Security Officer has outlined several requirements for a new vulnerability scanning project:

  1.

  Must use minimal network bandwidth

  2.

  Must use minimal host resources

  3.

  Must provide accurate, near real-time updates

  4.

  Must not have any stored credentials in configuration on the scanner

  Which of the following vulnerability scanning methods should be used to best meet these requirements?

  A. Internal

  B. Agent

  C. Active

  D. Uncredentialed

  Correct Answer: B

  Agent-based vulnerability scanning is a method that uses software agents installed on the target systems to scan for vulnerabilities. This method meets the requirements of the project because it uses minimal network bandwidth and host

  resources, provides accurate and near real-time updates, and does not require any stored credentials on the scanner. References: What Is Vulnerability Scanning? Types, Tools and Best Practices, Section: Types of vulnerability scanning;

  CompTIA CySA+ Study Guide:

  S0-003, 3rd Edition, Chapter 4: Security Operations and Monitoring, page 154.

• Question 73:

  An analyst is conducting monitoring against an authorized team that win perform adversarial techniques. The analyst interacts with the team twice per day to set the stage for the techniques to be used. Which of the following teams is the analyst a member of?

  A. Orange team

  B. Blue team

  C. Red team

  D. Purple team

  Correct Answer: D

  The Purple team is a collaborative team that combines the efforts of both the Red team (attackers) and the Blue team (defenders). The Purple team facilitates communication between the Red and Blue teams to ensure that both are effectively working together, improving security posture. In this scenario, the analyst interacts with both the team performing adversarial techniques (likely Red team) and monitors the response (likely Blue team), which aligns with the role of the Purple team.

• Question 74:

  A team of analysts is developing a new internal system that correlates information from a variety of sources analyzes that information, and then triggers notifications according to company policy.

  Which of the following technologies was deployed?

  A. SIEM

  B. SOAR

  C. IPS

  D. CERT

  Correct Answer: B

  SOAR (Security Orchestration, Automation, and Response) refers to a collection of software solutions and tools that allow an organization to streamline security operations in three key areas: threat and vulnerability management, incident response, and security operations automation. It correlates information from various sources, analyzes it, and triggers notifications or actions based on predefined policies, which matches the scenario described.

• Question 75:

  Which of the following statements best describes the MITRE ATTandCK framework?

  A. It provides a comprehensive method to test the security of applications.

  B. It provides threat intelligence sharing and development of action and mitigation strategies.

  C. It helps identify and stop enemy activity by highlighting the areas where an attacker functions.

  D. It tracks and understands threats and is an open-source project that evolves.

  E. It breaks down intrusions into a clearly defined sequence of phases.

  Correct Answer: C

  The MITRE ATTandCK framework is a knowledge base of adversary tactics and techniques based on real-world observations. It helps organizations identify and understand how attackers operate and where they focus their efforts, enabling more effective defense strategies. It highlights areas where an attacker functions during a cyber intrusion, which can help in identifying and stopping their activity.

• Question 76:

  An employee downloads a freeware program to change the desktop to the classic look of legacy Windows. Shortly after the employee installs the program, a high volume of random DNS queries begin to originate from the system. An investigation on the system reveals the following:

  Add-MpPreference -ExclusionPath '%Program Filest\ksysconfig'

  Which of the following is possibly occurring?

  A. Persistence

  B. Privilege escalation

  C. Credential harvesting

  D. Defense evasion

  Correct Answer: D

  Defense evasion is the technique of avoiding detection or prevention by security tools or mechanisms. In this case, the freeware program is likely a malware that generates random DNS queries to communicate with a command and control server or exfiltrate data. The command Add-MpPreference -ExclusionPath '%Program Filest\ksysconfig' is used to add an exclusion path to Windows Defender, which is a built-in antivirus software, to prevent it from scanning the malware folder. References: CompTIA CySA+ Study Guide: S0-003, 3rd Edition, Chapter 5, page 204; CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 5, page 212. pr

• Question 77:

  A disgruntled open-source developer has decided to sabotage a code repository with a logic bomb that will act as a wiper. Which of the following parts of the Cyber Kill Chain does this act exhibit?

  A. Reconnaissance

  B. Weaponization

  C. Exploitation

  D. Installation

  Correct Answer: B

  Weaponization is the stage of the Cyber Kill Chain where the attacker creates or modifies a malicious payload to use against a target. In this case, the disgruntled open-source developer has created a logic bomb that will act as a wiper, which is a type of malware that destroys data on a system. This is an example of weaponization, as the developer has prepared a cyberweapon to sabotage the code repository. References: The answer was based on the web search results from Bing, especially the following sources: Cyber Kill Chain?| Lockheed Martin, which states: "In the weaponization step, the adversary creates remote access malware weapon, such as a virus or worm, tailored to one or more vulnerabilities." The Cyber Kill Chain: The Seven Steps of a Cyberattack - EC-Council, which states: "In the weaponization stage, all of the attacker's preparatory work culminates in the creation of malware to be used against an identified target." What is the Cyber Kill Chain? Introduction Guide -CrowdStrike, which states: "Weaponization: The attacker creates a malicious payload that will be delivered to the target."

• Question 78:

  Each time a vulnerability assessment team shares the regular report with other teams, inconsistencies regarding versions and patches in the existing infrastructure are discovered. Which of the following is the best solution to decrease the inconsistencies?

  A. Implementing credentialed scanning

  B. Changing from a passive to an active scanning approach

  C. Implementing a central place to manage IT assets

  D. Performing agentless scanning

  Correct Answer: C

  Implementing a central place to manage IT assets is the best solution to decrease the inconsistencies regarding versions and patches in the existing infrastructure. A central place to manage IT assets, such as a configuration management database (CMDB), can help the vulnerability assessment team to have an accurate and up-to-date inventory of all the hardware and software components in the network, as well as their relationships and dependencies. A CMDB can also track the changes and updates made to the IT assets, and provide a single source of truth for the vulnerability assessment team and other teams to compare and verify the versions and patches of the infrastructure12. Implementing credentialed scanning, changing from a passive to an active scanning approach, and performing agentless scanning are all methods to improve the vulnerability scanning process, but they do not address the root cause of the inconsistencies, which is the lack of a central place to manage IT assets3. References: What is a Configuration Management Database (CMDB)?, How to Use a CMDB to Improve Vulnerability Management, Vulnerability Scanning Best Practices

• Question 79:

  Which of following would best mitigate the effects of a new ransomware attack that was not properly stopped by the company antivirus?

  A. Install a firewall.

  B. Implement vulnerability management.

  C. Deploy sandboxing.

  D. Update the application blocklist.

  Correct Answer: C

  Sandboxing is a technique that isolates potentially malicious programs or files in a controlled environment, preventing them from affecting the rest of the system. It can help mitigate the effects of a new ransomware attack by preventing it from encrypting or deleting important data or spreading to other devices. References: CompTIA CySA+ Study Guide: S0-003, 3rd Edition, Chapter 5, page 202; CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 5, page 210.

• Question 80:

  Following an incident, a security analyst needs to create a script for downloading the configuration of all assets from the cloud tenancy. Which of the following authentication methods should the analyst use?

  A. MFA

  B. User and password

  C. PAM

  D. Key pair

  Correct Answer: D

  Key pair authentication is a method of using a public and private key to securely access cloud resources, such as downloading the configuration of assets from a cloud tenancy. Key pair authentication is more secure than user and password or PAM, and does not require an additional factor like MFA. References: Authentication Methods - Configuring Tenant-Wide Settings in Azure ..., Cloud Foundation - Oracle Help Center