View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 181

Which tool can help automate repetitive security response tasks?

1. Vulnerability scanner
2. Packet analyzer
3. Password manager
4. SOAR

Correct Answer: 4

Explanation

Security Orchestration, Automation, and Response (SOAR) platforms automate repetitive security operations and coordinate actions across multiple security tools. A SOAR workflow might receive an alert, gather threat intelligence, enrich the event with additional information, create an incident ticket, and perform predefined containment actions. Automation can reduce response times and allow analysts to focus on more complex investigations. However, automated actions should be carefully tested because an incorrectly configured workflow could disrupt legitimate users or systems. High-impact actions may require analyst approval.

Question 182

Which security control prevents unauthorized devices from connecting to a network?

1. NAC
2. SIEM
3. DLP
4. WAF

Correct Answer: 1

Explanation

Network Access Control (NAC) controls access to network resources based on defined security policies. It can require authentication and evaluate device characteristics such as identity, operating system, security status, or compliance before granting network access. Noncompliant devices may be denied access or placed into a restricted remediation network. NAC can help prevent unknown or unmanaged devices from connecting to sensitive environments. Effective NAC deployments require accurate policies, device identification, authentication integration, and regular monitoring to ensure that legitimate devices are not incorrectly blocked.

Question 183

Which activity examines memory to identify running malicious processes?

1. Vulnerability scanning
2. Memory forensics
3. Threat modeling
4. Asset discovery

Correct Answer: 2

Explanation

Memory forensics analyzes the contents of a system’s volatile memory to identify information that may not be available on disk. Investigators can examine running processes, network connections, loaded modules, command history, credentials, and potentially malicious code. Memory analysis can be especially useful when malware operates primarily in memory or attempts to avoid leaving traditional files behind. Investigators should acquire memory using appropriate forensic procedures and document the collection process. Findings can then be correlated with disk artifacts, logs, and network evidence.

Question 184

Which attack involves sending a large number of requests to exhaust a service’s resources?

1. Phishing
2. Denial-of-service
3. Privilege escalation
4. Credential stuffing

Correct Answer: 2

Explanation

A Denial-of-Service (DoS) attack attempts to make a service unavailable by overwhelming its resources or exploiting weaknesses that cause the service to stop responding. Attackers may generate excessive requests, consume bandwidth, exhaust system resources, or exploit application behavior. Distributed Denial-of-Service attacks use multiple sources to increase the volume and difficulty of blocking the traffic. Security teams can use rate limiting, filtering, traffic analysis, load balancing, and specialized DDoS protection services to reduce the impact of these attacks.

Question 185

Which security practice helps identify unauthorized software installed on endpoints?

1. Asset inventory
2. Software inventory
3. Data encryption
4. Password rotation

Correct Answer: 2

Explanation

A software inventory records applications and software components installed across organizational systems. Security teams can compare the inventory against approved software lists to identify unauthorized, outdated, or potentially vulnerable applications. Maintaining an accurate inventory supports vulnerability management, patching, application allowlisting, and attack-surface reduction. Analysts should investigate unknown software rather than automatically assuming it is malicious because some applications may have been legitimately installed by administrators or business users. Automated inventory tools can help organizations maintain visibility across large endpoint environments.

Question 186

Which process determines whether security controls are working as intended?

1. Control validation
2. Data destruction
3. Account provisioning
4. Traffic routing

Correct Answer: 1

Explanation

Control validation verifies that security controls are functioning correctly and providing the intended protection. This can involve testing firewall rules, authentication controls, endpoint protections, detection rules, access permissions, or incident-response procedures. Validation may use automated checks, controlled tests, vulnerability scans, or manual reviews. Security teams should document test results and address identified weaknesses. Regular validation is important because configurations can change, software can be updated, and new attack techniques can reduce the effectiveness of previously reliable controls.

Question 187

Which attack technique uses legitimate administrative tools for malicious purposes?

1. Living off the land
2. Password spraying
3. SQL injection
4. DNS poisoning

Correct Answer: 1

Explanation

Living off the land refers to attackers using legitimate tools, utilities, and features already available within an environment to perform malicious activities. Examples may include scripting engines, remote administration tools, command interpreters, or system management utilities. This approach can make detection more difficult because the tools themselves may be legitimate and commonly used by administrators. Analysts should therefore focus on context and behavior, such as unusual command execution, unexpected parent-child processes, abnormal account activity, and connections from systems that normally do not perform administrative tasks.

Question 188

What is the purpose of a vulnerability assessment?

1. Identify and evaluate security weaknesses
2. Restore deleted data
3. Manage employee schedules
4. Encrypt all communications

Correct Answer: 1

Explanation

A vulnerability assessment identifies and evaluates weaknesses in systems, applications, networks, and configurations. Tools may compare software versions and configurations against known vulnerabilities and security requirements. The resulting findings help organizations prioritize remediation based on factors such as severity, exploitability, exposure, and business impact. Vulnerability assessments differ from penetration tests because they primarily identify and assess potential weaknesses rather than attempting extensive exploitation. Regular assessments help organizations detect newly introduced vulnerabilities and maintain better visibility into their security posture.

Question 189

Which technique can help detect unusual data transfers from a compromised endpoint?

1. Data classification
2. Network traffic analysis
3. Password rotation
4. Patch management

Correct Answer: 2

Explanation

Network traffic analysis examines communications between systems to identify unusual patterns, destinations, volumes, and protocols. Analysts can use it to detect potentially suspicious data transfers, command-and-control communication, lateral movement, or other abnormal activity. Indicators may include unexpectedly large outbound transfers, connections to unfamiliar external destinations, unusual protocols, or activity occurring outside normal operating patterns. Traffic analysis becomes more effective when combined with endpoint telemetry, DNS logs, proxy records, and threat intelligence. Encryption may limit content visibility, but traffic metadata can still provide useful investigative information.

Question 190

Which security principle separates sensitive systems from general user networks?

1. Network segmentation
2. Password hashing
3. Data compression
4. Log rotation

Correct Answer: 1

Explanation

Network segmentation separates systems or resources into different network zones and controls communication between them. Sensitive systems such as databases, administrative infrastructure, or critical services can be isolated from ordinary user networks. Segmentation reduces an attacker’s ability to move laterally after compromising a workstation or server. Security teams can use firewalls, VLANs, access-control rules, and other technologies to enforce segmentation. Rules should permit only necessary communication because excessive access between segments can reduce the security benefits of the architecture.

Question 191

Which type of indicator describes attacker behavior rather than a specific file or IP address?

1. IOA
2. CVE
3. CVSS
4. Hash

Correct Answer: 1

Explanation

An Indicator of Attack (IOA) describes behavior or activity associated with an attack, rather than focusing only on a specific artifact. Examples include suspicious credential dumping, unusual privilege escalation, abnormal process execution, or attempts to disable security controls. IOAs can be useful because attackers may change file hashes, domains, or IP addresses while continuing to use similar techniques. Security teams can combine IOAs with Indicators of Compromise (IOCs), threat intelligence, and behavioral analytics to improve detection of evolving threats.

Question 192

Which control helps ensure that only authorized applications can execute?

1. DLP
2. Application allowlisting
3. SIEM
4. NTP

Correct Answer: 2

Explanation

Application allowlisting restricts software execution to applications that have been explicitly approved by the organization. This can prevent unauthorized or malicious programs from running even if an attacker manages to place them on a system. Allowlisting is particularly useful on systems with predictable workloads and limited application requirements. Security teams must maintain accurate application inventories and update allowlists when legitimate software changes. Poorly managed policies can block business-critical applications, so organizations should establish exception procedures and regularly review approved software.

Question 193

Which security activity analyzes an application’s source code for vulnerabilities without running it?

1. DAST
2. Penetration testing
3. SAST
4. Vulnerability scanning

Correct Answer: 3

Explanation

Static Application Security Testing (SAST) analyzes source code, bytecode, or other application components without executing the application. It can identify insecure coding practices, potential injection vulnerabilities, hardcoded secrets, and other weaknesses during development. SAST can provide developers with feedback early in the software development lifecycle, when security issues may be easier to correct. Dynamic Application Security Testing (DAST), by contrast, tests an application while it is running. Organizations may use both approaches to obtain broader application-security coverage.

Question 194

Which action best protects forensic evidence from unauthorized alteration?

1. Store evidence in a controlled environment
2. Edit the original files
3. Share evidence through public storage
4. Disable evidence timestamps

Correct Answer: 1

Explanation

Forensic evidence should be stored in a controlled environment where access is restricted and handling can be documented. Investigators should preserve original evidence and perform analysis on verified copies whenever possible. Hashes can help demonstrate that evidence has not changed, while chain-of-custody records document who handled or accessed it. Evidence should be protected from unauthorized modification, deletion, or disclosure. Proper evidence handling is important because unreliable or improperly managed evidence may weaken an investigation and could affect its usefulness for legal or organizational proceedings.

Question 195

Which technology can identify malicious patterns in network traffic without necessarily blocking them?

1. IPS
2. IDS
3. DLP
4. NAC

Correct Answer: 2

Explanation

An Intrusion Detection System (IDS) monitors network or system activity for patterns associated with suspicious or malicious behavior and generates alerts when potential threats are detected. Unlike an IPS, an IDS generally does not automatically block the detected traffic. Analysts can investigate IDS alerts using packet captures, endpoint information, firewall logs, and threat intelligence. IDS rules may rely on signatures, protocol behavior, or other detection methods. Regular tuning is necessary to reduce false positives and ensure important malicious activity receives appropriate attention.

Question 196

Which risk treatment option involves shifting financial consequences to another party?

1. Risk transfer
2. Risk avoidance
3. Risk acceptance
4. Risk mitigation

Correct Answer: 1

Explanation

Risk transfer involves shifting some or all of the financial or operational consequences of a risk to another party. Cyber insurance and certain contractual arrangements are examples of risk transfer. The underlying risk may still exist, so transferring financial responsibility does not necessarily eliminate the security threat itself. Risk avoidance means eliminating the activity that creates the risk, while mitigation reduces the likelihood or impact. Acceptance means formally acknowledging the risk without implementing additional treatment beyond the organization’s chosen approach.

Question 197

Which activity involves removing unnecessary services from a server to reduce exposure?

1. Attack surface reduction
2. Data classification
3. Threat intelligence
4. Log correlation

Correct Answer: 1

Explanation

Disabling or removing unnecessary services reduces the attack surface of a system by eliminating potential entry points that attackers could exploit. Security teams should identify services that are required for business operations and disable those that are unnecessary. They can also restrict required services using firewalls, authentication, and network segmentation. Attack-surface reduction should be performed carefully because disabling a required service could affect availability. Regular configuration reviews help organizations identify newly installed software, unnecessary services, and configuration changes that may increase exposure.

Question 198

Which backup strategy provides multiple copies of data in different locations?

1. Single-copy backup
2. Redundant backup
3. Temporary caching
4. Log rotation

Correct Answer: 2

Explanation

Redundant backups maintain multiple copies of important data, ideally using different storage locations or technologies. Redundancy can protect organizations against hardware failures, accidental deletion, ransomware, natural disasters, or other events affecting a primary system or backup location. Security teams should also protect backups from unauthorized access and test restoration procedures regularly. Simply creating backups does not guarantee successful recovery. Offline or otherwise isolated copies can provide additional protection against ransomware because attackers may attempt to compromise backups that remain continuously accessible from production systems.

Question 199

Which attack attempts to exploit a web application by injecting script content into pages viewed by users?

1. CSRF
2. SQL injection
3. XSS
4. SSRF

Correct Answer: 3

Explanation

Cross-Site Scripting (XSS) occurs when an attacker injects malicious script content into a web application and causes it to execute in a victim’s browser. Depending on the vulnerability, attackers may attempt to steal session information, modify displayed content, or perform actions within the victim’s browser context. Common protections include output encoding, proper input handling, Content Security Policy, and secure application design. Analysts can investigate suspicious request parameters, application logs, affected pages, and unusual browser activity when XSS exploitation is suspected.

Question 200

Which incident response activity focuses on identifying what happened and determining the scope of an incident?

1. Identification
2. Recovery
3. Eradication
4. Preparation

Correct Answer: 1

Explanation

The identification phase focuses on determining whether a security incident has occurred and understanding its scope and characteristics. Analysts review alerts, logs, endpoint data, network traffic, user activity, and other evidence to identify affected systems and potential attack methods. Accurate identification helps the response team choose appropriate containment and remediation actions. Analysts should document findings and preserve relevant evidence throughout the process. Moving too quickly into remediation without understanding the incident can result in missed evidence, incomplete containment, or failure to identify additional compromised systems.