View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 101

Which technology is commonly used to collect and correlate security logs from multiple systems?

1. SIEM
2. VPN
3. NAC
4. WAF

Correct Answer: 1

Explanation

A Security Information and Event Management (SIEM) platform collects security events and logs from multiple sources and correlates them to identify suspicious activity. Common sources include firewalls, servers, endpoints, authentication systems, applications, and cloud services. Correlation allows analysts to connect separate events that may represent one attack sequence. SIEM platforms can also support alerting, dashboards, investigations, and reporting. Proper configuration is important because excessive irrelevant logs can create alert fatigue, while missing important sources can leave significant visibility gaps.

Question 102

What is the primary purpose of network segmentation?

1. Increase bandwidth
2. Limit unauthorized movement between network areas
3. Replace antivirus software
4. Eliminate authentication

Correct Answer: 2

Explanation

Network segmentation divides a network into separate logical or physical areas and controls communication between them. This limits an attacker’s ability to move laterally after compromising one system. For example, sensitive servers can be separated from user workstations and only required traffic can be permitted between the segments. Segmentation can also reduce the impact of malware outbreaks and improve monitoring. Security teams should regularly review segmentation rules because overly broad access can weaken its effectiveness and unnecessarily expose protected systems to other network zones.

Question 103

Which indicator is most useful for identifying a suspicious file across multiple systems?

1. MAC address
2. Hostname
3. File hash
4. Subnet mask

Correct Answer: 3

Explanation

A file hash is a fixed-length value generated from the contents of a file using a hashing algorithm. Security analysts can use hashes as indicators of compromise to identify known malicious files across multiple systems. If the same malicious file appears on several endpoints, its hash can help security tools locate it quickly. However, hashes can change when malware is modified, so analysts should combine them with other indicators such as domains, IP addresses, filenames, behavioral indicators, and process activity when investigating suspicious files.

Question 104

A user receives an email requesting an urgent password reset through an unfamiliar link. What should the analyst suspect first?

1. Phishing
2. DDoS
3. DNS poisoning
4. Port scanning

Correct Answer: 1

Explanation

An unexpected email requesting an urgent password reset through an unfamiliar link is a common phishing indicator. Attackers often create a sense of urgency to persuade users to click malicious links or disclose credentials. Analysts should inspect the sender address, email headers, linked domain, message content, and authentication results. The suspicious URL should not be opened directly from the user’s workstation. If the message is confirmed as malicious, security teams may block related domains, search for other recipients, remove the message, and investigate whether any credentials were submitted.

Question 105

Which metric measures the average time required to detect a security incident?

1. MTTR
2. MTTC
3. RPO
4. MTTD

Correct Answer: 4

Explanation

Mean Time to Detect (MTTD) measures the average time between the occurrence of a security event and its detection by the security team or monitoring systems. A lower MTTD generally indicates that suspicious activity is being identified more quickly. Analysts can use this metric to evaluate monitoring and detection capabilities over time. MTTD differs from Mean Time to Respond or Mean Time to Recover, which measure later stages of incident handling. Accurate timestamps and consistent measurement methods are necessary for meaningful MTTD calculations.

Question 106

Which technique involves testing an application without executing its code?

1. Dynamic analysis
2. Sandboxing
3. Static analysis
4. Behavioral monitoring

Correct Answer: 3

Explanation

Static analysis examines software, source code, binaries, or other artifacts without executing the program. Security professionals can use static analysis to identify suspicious strings, embedded commands, insecure coding patterns, known indicators, and other characteristics. It is commonly used during malware analysis and secure software development. Dynamic analysis differs because it observes software while it is executing in a controlled environment. Static analysis can be performed safely without running potentially malicious code, although sophisticated threats may hide important behavior that becomes visible only during execution.

Question 107

Which vulnerability identifier provides a standardized reference for a publicly known software vulnerability?

1. CVE
2. CVSS
3. CWE
4. SIEM

Correct Answer: 1

Explanation

The Common Vulnerabilities and Exposures (CVE) system provides standardized identifiers for publicly known cybersecurity vulnerabilities. A CVE identifier allows security teams, vendors, researchers, and vulnerability-management platforms to refer to the same vulnerability consistently. CVE itself does not determine how severe a vulnerability is. Severity can be assessed using systems such as the Common Vulnerability Scoring System (CVSS). Analysts often use CVE information together with affected software versions, exploit availability, asset importance, and business context when prioritizing remediation.

Question 108

Which authentication method requires users to provide two or more different types of evidence?

1. Single sign-on
2. Multifactor authentication
3. Password synchronization
4. Account federation

Correct Answer: 2

Explanation

Multifactor authentication (MFA) requires users to provide authentication factors from different categories, such as something they know, something they have, or something they are. For example, a password combined with a hardware token or biometric factor provides multiple forms of verification. MFA can significantly reduce the risk of account compromise when passwords are stolen. However, implementation should consider phishing-resistant methods and appropriate recovery procedures. MFA is an authentication control and does not eliminate the need for authorization, monitoring, or least-privilege access.

Question 109

What is the primary purpose of a sandbox in malware analysis?

1. To increase storage capacity
2. To permanently remove malware
3. To safely observe suspicious behavior
4. To replace network monitoring

Correct Answer: 3

Explanation

A sandbox provides an isolated environment where suspicious files or programs can be executed and observed without exposing production systems to the same level of risk. Analysts can monitor processes, file changes, registry activity, network connections, and other behaviors. Sandboxing is particularly useful for analyzing malware whose behavior cannot be determined through static inspection alone. The environment should be carefully isolated because sophisticated malware may attempt to detect virtualized or sandboxed conditions. Results can be combined with other indicators to support incident investigation and detection development.

Question 110

Which attack attempts to overwhelm a service with excessive traffic or requests?

1. Credential stuffing
2. SQL injection
3. DDoS
4. Privilege escalation

Correct Answer: 3

Explanation

A Distributed Denial-of-Service (DDoS) attack attempts to make a service unavailable by overwhelming it with large amounts of traffic or requests. Distributed attacks commonly use many compromised systems or other sources to generate traffic simultaneously. Security teams can use traffic filtering, rate limiting, content delivery networks, DDoS protection services, and network monitoring to reduce the impact. During an investigation, analysts should examine traffic patterns, source distribution, targeted services, and timing. The objective is generally service disruption rather than directly stealing information.

Question 111

Which control is designed to prevent users from executing unauthorized applications?

1. Application allowlisting
2. Network address translation
3. Load balancing
4. Packet fragmentation

Correct Answer: 1

Explanation

Application allowlisting permits only approved applications or software components to execute on a system. This can prevent unauthorized or malicious programs from running even when an attacker attempts to introduce them onto an endpoint. Allowlisting can be especially useful for systems with predictable workloads, such as servers or dedicated business devices. Security teams must maintain accurate application inventories and update policies when legitimate software changes. Poorly maintained allowlists can block necessary applications or create administrative overhead, so regular review is important.

Question 112

Which log source is most useful for investigating repeated failed login attempts?

1. DNS logs
2. Authentication logs
3. Printer logs
4. DHCP lease logs

Correct Answer: 2

Explanation

Authentication logs record events related to user sign-ins, including successful and failed authentication attempts. Analysts can review these logs to identify repeated failures that may indicate brute-force attacks, password spraying, credential misuse, or legitimate user errors. Useful details include usernames, source addresses, timestamps, authentication methods, and targeted systems. Correlating authentication events across multiple systems can reveal broader attack patterns. Analysts should also consider normal user behavior and expected administrative activity before determining whether repeated failures represent malicious activity.

Question 113

What is the main purpose of a vulnerability scan?

1. Identify potentially vulnerable systems and software
2. Restore deleted files
3. Encrypt network traffic
4. Create user accounts

Correct Answer: 1

Explanation

A vulnerability scan identifies systems, applications, services, and configurations that may contain known security weaknesses. Scanners compare observed software versions and configurations against vulnerability databases and predefined checks. Results can help security teams prioritize systems for further investigation and remediation. Vulnerability scans do not necessarily prove that a vulnerability can be successfully exploited, so important findings may require manual validation or penetration testing. Regular scanning supports vulnerability-management programs by helping organizations discover changes and newly introduced weaknesses across their environments.

Question 114

Which security principle gives users only the permissions required for their job?

1. Defense in depth
2. Least privilege
3. Open access
4. Fail-open

Correct Answer: 2

Explanation

The principle of least privilege ensures that users, applications, and services receive only the permissions necessary to perform their authorized tasks. Limiting privileges reduces the potential impact of compromised accounts, malicious insiders, and vulnerable applications. For example, a standard employee should not automatically receive administrative access to servers they do not manage. Security teams should periodically review permissions because responsibilities change and excessive privileges can accumulate over time. Least privilege should be applied across operating systems, applications, cloud environments, databases, and other resources.

Question 115

Which technology can inspect and filter HTTP or HTTPS application traffic?

1. WAF
2. DHCP
3. NTP
4. VPN

Correct Answer: 1

Explanation

A Web Application Firewall (WAF) monitors and filters HTTP or HTTPS traffic directed toward web applications. It can help detect and block attacks such as SQL injection, cross-site scripting, malicious requests, and certain application-layer abuse patterns. WAF rules may be based on request content, headers, URLs, parameters, or known attack patterns. A WAF should complement secure application development rather than replace it. Analysts should monitor WAF alerts and tune rules carefully because overly broad rules can generate false positives and interfere with legitimate application traffic.

Question 116

What does a false positive represent in security monitoring?

1. A real attack that was missed
2. A legitimate event incorrectly identified as malicious
3. A confirmed security incident
4. A successful vulnerability exploit

Correct Answer: 2

Explanation

A false positive occurs when a security monitoring system identifies legitimate activity as suspicious or malicious. For example, a normal administrative process might trigger an alert because its behavior resembles a known attack pattern. Excessive false positives can cause alert fatigue and reduce analyst efficiency. Security teams can reduce them by tuning detection rules, improving baselines, adding contextual information, and creating appropriate exceptions. However, tuning should be performed carefully because excessively broad exclusions may hide genuine malicious activity and increase the risk of false negatives.

Question 117

Which action is part of the containment phase of incident response?

1. Writing the final report
2. Conducting a lessons-learned meeting
3. Isolating an infected system
4. Rebuilding all unaffected systems

Correct Answer: 3

Explanation

Containment focuses on limiting the spread and impact of an active security incident. Isolating an infected endpoint from the network is a common containment action because it can prevent malware from communicating with external systems or spreading to additional internal devices. Other containment measures may include blocking malicious domains, disabling compromised accounts, or restricting affected network segments. Containment should be performed according to the organization’s incident response procedures and business requirements. Analysts must balance rapid threat reduction with preserving evidence and maintaining essential operations.

Question 118

Which protocol securely transfers files over an encrypted SSH connection?

1. FTP
2. SFTP
3. TFTP
4. Telnet

Correct Answer: 2

Explanation

Secure File Transfer Protocol (SFTP) provides file transfer capabilities over an SSH connection, offering encryption and authentication for the communication session. This helps protect files and credentials from interception while they are transferred across untrusted networks. SFTP should not be confused with FTPS, which uses TLS to secure FTP connections. Security teams should select secure transfer protocols based on organizational requirements and ensure that authentication and access permissions are properly configured. Monitoring file transfers can also help identify unauthorized movement of sensitive information.

Question 119

Which threat intelligence type focuses on attacker methods, tactics, and procedures?

1. Strategic intelligence
2. Operational intelligence
3. Tactical intelligence
4. Financial intelligence

Correct Answer: 3

Explanation

Tactical threat intelligence focuses on the techniques, tactics, and procedures used by threat actors. Security teams can use this information to improve detection rules, threat-hunting hypotheses, defensive controls, and incident investigations. Examples include information about credential attacks, persistence methods, lateral movement, or command-and-control techniques. Strategic intelligence generally addresses broader trends and risks for decision-makers, while operational intelligence focuses on information about specific campaigns or operations. Effective threat intelligence should be relevant to the organization’s environment and translated into actionable defensive measures.

Question 120

Which activity should occur after an incident has been resolved to improve future response?

1. Disabling all monitoring
2. Conducting a lessons-learned review
3. Removing security controls
4. Deleting incident records

Correct Answer: 2

Explanation

A lessons-learned review is performed after an incident to identify what worked well, what failed, and what improvements are needed. Security teams may review detection speed, communication, containment actions, evidence handling, technical controls, and response procedures. Findings can lead to updated playbooks, improved monitoring rules, additional training, or changes to security architecture. Incident records should be preserved according to organizational and regulatory requirements. The goal is to use experience from completed incidents to strengthen future prevention, detection, response, and recovery activities.