View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 281

Which technology can detect suspicious behavior across endpoints, networks, and cloud environments?

1. FTP
2. XDR
3. DHCP
4. RAID

Correct Answer: 4

Explanation

Extended Detection and Response, or XDR, combines security telemetry from multiple environments such as endpoints, networks, email systems, and cloud services. By correlating information across different security layers, XDR can help analysts identify attack patterns that might be difficult to recognize from a single data source. EDR primarily focuses on endpoints, while XDR extends visibility across multiple security domains. FTP transfers files, DHCP provides network configuration, and RAID provides storage redundancy. XDR can improve investigation efficiency by presenting related security events together.

Question 282

What is the primary purpose of a security information and event management system?

1. Collect and correlate security events
2. Replace all endpoint security tools
3. Physically secure data centers
4. Encrypt every network packet

Correct Answer: 1

Explanation

A SIEM collects security events from multiple sources and provides centralized capabilities for searching, correlation, alerting, investigation, and reporting. Logs may come from firewalls, endpoints, servers, applications, identity systems, cloud platforms, and other security controls. Correlation allows analysts to connect seemingly unrelated events and identify suspicious patterns. A SIEM does not replace every security control, physically protect facilities, or automatically encrypt all network traffic. Effective SIEM deployments depend on appropriate log collection, normalization, detection rules, retention, and regular tuning.

Question 283

An attacker sends many login attempts using a small number of commonly used passwords against numerous accounts. What attack is this?

1. Credential stuffing
2. Brute-force attack
3. Password spraying
4. Session hijacking

Correct Answer: 3

Explanation

Password spraying involves attempting a small number of commonly used passwords against many different accounts. Attackers use this technique to avoid triggering account lockout mechanisms that might activate after repeated failures against a single account. Credential stuffing instead uses previously stolen username-and-password combinations, while traditional brute-force attacks generally try many passwords against one account or target. Session hijacking involves stealing or abusing an authenticated session. Monitoring authentication failures across multiple accounts can help security teams identify password spraying activity.

Question 284

Which control can restrict communication between different network security zones?

1. File integrity monitoring
2. Firewall
3. Hashing
4. Data classification

Correct Answer: 2

Explanation

A firewall can enforce rules that control traffic between different network zones based on criteria such as source, destination, protocol, port, and connection state. Organizations often use firewalls to separate sensitive systems from less trusted networks and restrict unnecessary communication. This supports network segmentation and can reduce opportunities for lateral movement. File integrity monitoring detects changes to files, hashing verifies data integrity, and data classification categorizes information. Firewall rules should be carefully reviewed because overly permissive rules can create unnecessary exposure between security zones.

Question 285

Which artifact is most useful for determining whether a downloaded file matches a known malicious sample?

1. MAC address
2. Hostname
3. File hash
4. Subnet mask

Correct Answer: 4

Explanation

A file hash provides a compact representation of a file’s contents and can be compared with known malware hashes. If the hash exactly matches a trusted malicious sample, the file can be identified with a high degree of confidence as the same file. Common cryptographic hashes used in security investigations include SHA-256. A MAC address identifies a network interface, a hostname identifies a system, and a subnet mask defines network addressing boundaries. Hashes are useful indicators, although modified malware can produce a different hash and require additional analysis.

Question 286

Which activity is most closely associated with vulnerability management?

1. Identifying, prioritizing, and remediating weaknesses
2. Creating employee schedules
3. Designing marketing campaigns
4. Managing office supplies

Correct Answer: 3

Explanation

Vulnerability management is a continuous process involving the identification, assessment, prioritization, remediation, and validation of security weaknesses. Organizations typically discover vulnerabilities through scanning, security assessments, threat intelligence, and other sources. They then prioritize issues based on factors such as severity, exploitability, asset criticality, exposure, and business impact. Remediation may involve patching, configuration changes, compensating controls, or system replacement. Vulnerability management is broader than simply running scans because it includes tracking weaknesses through remediation and confirming that corrective actions were successful.

Question 287

Which attack technique attempts to access a user’s account using previously stolen username and password combinations?

1. Credential stuffing
2. DNS tunneling
3. Port scanning
4. Command injection

Correct Answer: 1

Explanation

Credential stuffing uses previously stolen username-and-password combinations to attempt access to accounts on other services. Attackers rely on password reuse because users frequently use the same credentials across multiple websites. This attack differs from brute force and password spraying because the attacker is using known credential pairs rather than guessing passwords broadly. Security teams can reduce credential-stuffing risk through MFA, breached-password detection, rate limiting, bot detection, and monitoring for unusual authentication patterns. Reviewing login locations, device information, and failed authentication rates can also help identify this activity.

Question 288

Which security measure helps prevent attackers from using an application account to perform unnecessary privileged actions?

1. Load balancing
2. Least privilege
3. DNS caching
4. Packet fragmentation

Correct Answer: 2

Explanation

Least privilege ensures that an application, service, or user receives only the permissions necessary to perform its intended functions. If an application account is compromised, excessive permissions could allow an attacker to access sensitive resources, modify configurations, or move laterally. Restricting the account’s privileges limits the potential impact. Least privilege should be applied to service accounts as well as human users, and permissions should be reviewed periodically. Load balancing, DNS caching, and packet fragmentation address different technical functions and do not directly control application privileges.

Question 289

Which attack exploits a weakness where an application trusts user-controlled input when constructing database queries?

1. SSRF
2. XSS
3. SQL injection
4. CSRF

Correct Answer: 3

Explanation

SQL injection occurs when an application incorporates untrusted user input into database queries without appropriate protection. An attacker may manipulate the input to alter the intended query and potentially retrieve, modify, or delete database information. Parameterized queries and prepared statements are key defenses because they separate data from executable SQL instructions. XSS targets script execution in a user’s browser, CSRF abuses an authenticated user’s session, and SSRF causes a server to make unintended requests. Web application logs and database activity can provide useful evidence during an investigation.

Question 290

Which incident response activity focuses on restoring systems to normal operation?

1. Preparation
2. Identification
3. Eradication
4. Recovery

Correct Answer: 4

Explanation

Recovery focuses on restoring affected systems and services to normal, secure operation after an incident. Activities may include restoring data from clean backups, rebuilding systems, reconnecting isolated devices, monitoring restored services, and confirming that security controls are functioning correctly. Preparation occurs before incidents, identification involves recognizing and analyzing incidents, and eradication focuses on removing malware or attacker persistence. Recovery should be carefully monitored because prematurely returning compromised systems to production can allow an attacker to regain access.

Question 291

Which log can help determine which websites or domains a user attempted to access through an organizational proxy?

1. Proxy log
2. BIOS log
3. Printer log
4. Battery log

Correct Answer: 1

Explanation

Proxy logs can provide valuable information about web requests passing through an organization’s proxy infrastructure. Depending on configuration, these logs may include the requesting user or device, destination domain, requested URL, timestamp, response status, and other connection details. Analysts can use proxy data to investigate suspicious browsing, malware callbacks, phishing links, and potential data exfiltration. Proxy logs are especially useful when correlated with DNS and endpoint telemetry. BIOS, printer, and battery logs generally do not provide the web-access information needed for this type of investigation.

Question 292

Which technique allows an attacker to maintain access after a system reboots?

1. Persistence
2. Reconnaissance
3. Scanning
4. Enumeration

Correct Answer: 2

Explanation

Persistence refers to techniques attackers use to maintain access to a compromised system even after events such as reboots, password changes, or temporary interruptions. Examples can include malicious scheduled tasks, startup entries, services, unauthorized accounts, or other mechanisms that automatically execute attacker-controlled code. Reconnaissance and scanning are generally focused on gathering information, while enumeration identifies specific resources or services. Security analysts should examine startup mechanisms, scheduled tasks, account changes, services, and unusual configuration modifications when investigating suspected persistence.

Question 293

What is the purpose of a vulnerability remediation validation scan?

1. Discover employee identities
2. Confirm that a vulnerability was fixed
3. Increase network traffic
4. Encrypt vulnerability reports

Correct Answer: 3

Explanation

A remediation validation scan is performed after corrective action to confirm that a previously identified vulnerability has been successfully addressed. The scan can determine whether a patch, configuration change, or other remediation action removed the weakness. This step is important because a remediation attempt may fail, may not apply correctly, or may leave related vulnerabilities unresolved. Simply marking a ticket as complete does not prove that the risk has been reduced. Validation provides evidence that the vulnerability is no longer detectable under the tested conditions.

Question 294

Which technology can inspect application-layer web requests and block malicious patterns?

1. WAF
2. NTP
3. DHCP
4. RAID

Correct Answer: 4

Explanation

A Web Application Firewall, or WAF, analyzes web application traffic and can identify and block suspicious HTTP or HTTPS requests. It can provide protection against common web attacks such as SQL injection, cross-site scripting, and certain malicious request patterns. A WAF can be configured with rules based on signatures, behavior, request characteristics, and application-specific requirements. NTP synchronizes system clocks, DHCP assigns network configuration, and RAID provides storage redundancy. A WAF should complement secure application development rather than serve as the application’s only security mechanism.

Question 295

Which metric measures the average time between detecting an incident and beginning a response?

1. RPO
2. MTTR
3. MTTA
4. RTO

Correct Answer: 2

Explanation

Mean Time to Acknowledge, or MTTA, measures how long it takes for a security team or responsible analyst to acknowledge an alert or incident after it is detected. A lower MTTA can indicate that alerts are being reviewed promptly. MTTR commonly measures the time required to recover or repair an issue, depending on organizational definitions. RTO defines the target time for restoring a service, while RPO defines the acceptable amount of data loss measured in time. Organizations should define metrics consistently so performance comparisons remain meaningful.

Question 296

Which approach provides continuous verification rather than automatically trusting devices inside the corporate network?

1. Zero Trust
2. Open authentication
3. Shared credentials
4. Implicit trust

Correct Answer: 1

Explanation

Zero Trust requires access decisions to be based on explicit verification rather than assuming that users or devices are trustworthy because they are inside a corporate network. Organizations may evaluate identity, device security posture, resource sensitivity, location, behavior, and other contextual information before granting access. Least privilege and continuous monitoring are commonly associated with Zero Trust. This model helps reduce the impact of compromised accounts and limits lateral movement. It does not mean that internal users are automatically considered malicious; instead, access is granted according to verified requirements.

Question 297

Which evidence source is especially valuable because it can contain running processes and credentials that may disappear after shutdown?

1. Archived emails
2. Memory
3. Printed reports
4. Asset labels

Correct Answer: 4

Explanation

Volatile memory can contain information that disappears when a system is powered off or restarted. Memory forensics may reveal running processes, active network connections, loaded modules, encryption keys, and potentially credential material or malware artifacts. For this reason, investigators may prioritize memory acquisition when circumstances and procedures allow. Archived emails and printed reports can provide useful information but do not normally contain the live system state available in RAM. Evidence acquisition should follow established forensic procedures to preserve integrity and document how the evidence was collected.

Question 298

Which control helps detect unauthorized modifications to critical operating system files?

1. File integrity monitoring
2. Network address translation
3. Load balancing
4. Email filtering

Correct Answer: 2

Explanation

File Integrity Monitoring, or FIM, detects changes to important files by comparing their current state against an established trusted baseline. It can identify modifications, deletions, or unexpected additions involving operating system files, configuration files, and other critical resources. Unexpected changes may indicate malware, unauthorized administrative activity, or configuration drift. NAT translates network addresses, load balancing distributes traffic, and email filtering focuses on messages. FIM alerts should be reviewed in context because legitimate software updates and authorized administrative changes can also modify monitored files.

Question 299

Which action is most appropriate after identifying a suspicious domain associated with malware?

1. Ignore the domain
2. Share it publicly without verification
3. Investigate related DNS and network activity
4. Delete all endpoint logs

Correct Answer: 3

Explanation

After identifying a suspicious domain, analysts should investigate related DNS queries, network connections, endpoint processes, timestamps, and other relevant telemetry. This can help determine which systems contacted the domain and whether the communication was associated with malware or command-and-control activity. Analysts should validate indicators before taking broad blocking or response actions because legitimate domains can sometimes appear suspicious due to compromised infrastructure or misleading context. Deleting logs would remove valuable evidence. Correlating multiple data sources provides stronger evidence than relying on a single suspicious domain.

Question 300

Which practice helps ensure that security logs remain available for future investigations?

1. Log retention
2. Password reuse
3. Traffic compression
4. Account sharing

Correct Answer: 1

Explanation

Log retention policies determine how long security logs and related records are preserved for monitoring, investigations, compliance, and forensic analysis. Appropriate retention periods should consider organizational requirements, legal obligations, storage capacity, and the likelihood that historical data will be needed during an investigation. Logs should also be protected against unauthorized modification or deletion. Password reuse and account sharing weaken security, while traffic compression does not determine how long logs remain available. Effective retention helps analysts reconstruct incidents even when suspicious activity is discovered long after it occurred.