View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 321

Which metric measures the average time required to detect a security incident?

1. MTTR
2. MTTC
3. MTTA
4. MTTD

Correct Answer: 4

Explanation

Mean Time to Detect (MTTD) measures how long it takes an organization or security team to identify a security incident after it begins. A lower MTTD generally indicates that monitoring and detection capabilities are identifying suspicious activity more quickly. Other metrics measure different stages of incident handling. MTTR focuses on recovery or remediation time, while MTTA measures the time taken to acknowledge an alert. MTTC can refer to the time required to contain a threat. Security teams use MTTD to evaluate the effectiveness of monitoring, detection rules, and security analytics.

Question 322

A security analyst wants to identify abnormal user behavior across multiple systems. Which technology is most appropriate?

1. UEBA
2. DLP
3. NAC
4. WAF

Correct Answer: 1

Explanation

User and Entity Behavior Analytics (UEBA) is designed to identify unusual behavior by users, devices, and other entities. It establishes behavioral baselines and detects deviations that may indicate compromised accounts, insider threats, or other suspicious activity. For example, a user who normally accesses systems during business hours might suddenly authenticate from an unusual location and access sensitive resources. DLP focuses on preventing unauthorized data movement, NAC controls network access, and WAF protects web applications. UEBA is therefore particularly useful for detecting behavioral anomalies across multiple systems.

Question 323

Which threat intelligence type provides information about attacker tactics, techniques, and procedures?

1. Strategic intelligence
2. Operational intelligence
3. Tactical intelligence
4. Technical intelligence

Correct Answer: 3

Explanation

Tactical threat intelligence focuses on the tactics, techniques, and procedures (TTPs) used by threat actors. It helps defenders understand how attacks are conducted and improve detection and defensive controls. For example, information describing credential dumping, lateral movement, or command-and-control techniques can support threat hunting and detection engineering. Strategic intelligence is generally intended for high-level business decisions, while operational intelligence focuses on campaigns and imminent activities. Technical intelligence commonly includes indicators such as IP addresses, hashes, domains, and other observable artifacts.

Question 324

A company discovers that an attacker used a stolen administrator account to access several internal servers. Which attack technique is this activity most closely associated with?

1. Persistence
2. Lateral movement
3. Reconnaissance
4. Data destruction

Correct Answer: 2

Explanation

Lateral movement occurs when an attacker moves from one compromised system or account to additional systems within an environment. Attackers often use stolen credentials, remote services, administrative tools, or vulnerabilities to expand their access. In this scenario, the attacker already has access through a compromised administrator account and uses it to reach multiple internal servers. Reconnaissance generally occurs before or during initial access and involves gathering information. Persistence focuses on maintaining access, while data destruction involves damaging or deleting information rather than expanding access.

Question 325

Which artifact is most useful for determining whether a downloaded executable has been modified?

1. File name
2. File size
3. File hash
4. File extension

Correct Answer: 3

Explanation

A cryptographic file hash provides a fixed value representing the contents of a file. Investigators can calculate the hash of a downloaded executable and compare it with a known-good or previously recorded hash. If the values differ, the file contents have changed. Hashes are commonly used for malware identification, file integrity verification, and forensic analysis. A filename, size, or extension can change without necessarily revealing the exact contents of a file. Hash comparison therefore provides a more reliable method for identifying modifications to executable files.

Question 326

Which security control is most effective for preventing unauthorized applications from executing on endpoints?

1. Network segmentation
2. DNS filtering
3. Application allowlisting
4. Log retention

Correct Answer: 3

Explanation

Application allowlisting permits only approved applications or software components to execute on an endpoint. This can prevent unauthorized executables, scripts, and potentially malicious programs from running even when they reach the system. It is particularly useful for reducing the risk associated with unknown or unapproved software. Network segmentation limits communication between systems, DNS filtering controls domain resolution, and log retention preserves security records for later analysis. Allowlisting directly addresses the execution of unauthorized applications and can therefore provide strong endpoint protection.

Question 327

Which vulnerability identifier is commonly used to describe a specific publicly disclosed software vulnerability?

1. CVE
2. CVSS
3. CWE
4. IOC

Correct Answer: 1

Explanation

Common Vulnerabilities and Exposures (CVE) identifiers provide standardized references for publicly disclosed vulnerabilities. A CVE identifier allows security teams, vendors, researchers, and vulnerability management platforms to refer to the same vulnerability consistently. CVSS is different because it provides a severity scoring framework for vulnerabilities. CWE categorizes weaknesses in software or hardware, while an IOC is an artifact that may indicate malicious activity, such as a suspicious domain or file hash. Analysts commonly use CVE identifiers when tracking vulnerabilities and determining whether affected systems require remediation.

Question 328

What is the primary purpose of a security baseline?

1. Identify phishing emails
2. Define an approved system configuration
3. Detect malicious domains
4. Calculate incident response time

Correct Answer: 2

Explanation

A security baseline defines an approved and secure configuration for systems, applications, devices, or networks. It can specify settings such as password requirements, enabled services, logging configurations, software versions, and security controls. Security teams compare actual configurations against the baseline to identify unauthorized or insecure changes. This process supports configuration management and helps maintain consistent security across an environment. Phishing detection, domain analysis, and incident response metrics address different security functions. A properly maintained baseline provides a reference point for identifying configuration drift and improving overall security posture.

Question 329

An analyst observes repeated DNS requests for unusually long subdomains containing encoded data. What activity should be investigated?

1. Password spraying
2. Port scanning
3. DNS tunneling
4. Credential stuffing

Correct Answer: 3

Explanation

DNS tunneling can abuse DNS queries and responses to transport commands or data through DNS traffic. Attackers may create unusually long or frequently changing subdomains and encode information within them. Repeated DNS requests containing suspiciously structured data can therefore indicate command-and-control communication or data exfiltration. Password spraying and credential stuffing involve authentication attacks rather than DNS traffic patterns. Port scanning involves probing network services. Analysts should investigate the queried domains, query frequency, source systems, and encoded patterns to determine whether legitimate software or malicious tunneling is responsible.

Question 330

Which incident response phase focuses on removing malware and attacker mechanisms from affected systems?

1. Identification
2. Containment
3. Recovery
4. Eradication

Correct Answer: 4

Explanation

Eradication is the incident response phase in which security teams remove the root cause and malicious artifacts associated with an incident. This may include deleting malware, removing persistence mechanisms, disabling compromised accounts, closing exploited vulnerabilities, and eliminating unauthorized tools. Identification focuses on determining whether an incident has occurred and understanding its scope. Containment limits further damage, while recovery restores affected systems to normal operation. Effective eradication should occur before full recovery so that the organization does not restore systems while the attacker or malicious software remains present.

Question 331

Which technique helps an analyst identify suspicious relationships between processes on an endpoint?

1. Parent-child process analysis
2. Data classification
3. Network segmentation
4. Vulnerability scoring

Correct Answer: 1

Explanation

Parent-child process analysis examines relationships between processes to identify unusual or potentially malicious execution chains. For example, an office application unexpectedly launching a command shell may warrant investigation because that behavior can indicate exploitation or malicious scripting. Analysts can use endpoint telemetry to examine process names, command-line arguments, parent processes, users, and execution times. Data classification focuses on categorizing information, network segmentation separates systems or network zones, and vulnerability scoring evaluates weaknesses. Process relationship analysis is therefore especially useful during endpoint threat investigation and malware detection.

Question 332

Which email authentication mechanism allows a receiving mail server to verify that a message was authorized by the sending domain?

1. SPF
2. DKIM
3. NAC
4. SFTP

Correct Answer: 2

Explanation

DomainKeys Identified Mail (DKIM) uses a digital signature to help receiving mail systems verify that an email was authorized by the sending domain and that specified message content has not been altered in transit. The receiving server retrieves the sender domain’s public key from DNS and validates the signature. SPF instead checks whether the sending server is authorized to send mail for a domain. NAC controls network access, while SFTP provides secure file transfer. DKIM is therefore specifically associated with cryptographic email message authentication.

Question 333

A vulnerability scanner reports a critical vulnerability on a server, but the analyst confirms the affected software is not installed. What should the analyst record?

1. True positive
2. Exploit
3. False negative
4. False positive

Correct Answer: 4

Explanation

A false positive occurs when a security tool reports a vulnerability or threat that does not actually exist. In this scenario, the scanner identifies a critical vulnerability, but investigation confirms that the vulnerable software is not installed. The alert should therefore be classified as a false positive. A true positive would mean the reported vulnerability was genuinely present. A false negative occurs when a real vulnerability or threat is missed. Analysts should document false positives because excessive inaccurate alerts can contribute to alert fatigue and reduce the efficiency of security operations.

Question 334

Which activity is most closely associated with vulnerability remediation?

1. Collecting threat intelligence
2. Capturing network packets
3. Applying a security patch
4. Creating a phishing simulation

Correct Answer: 3

Explanation

Vulnerability remediation involves taking action to eliminate or reduce the risk created by an identified weakness. Applying a vendor-provided security patch is a common remediation activity because it can correct the vulnerable software component. Threat intelligence collection supports awareness of threats but does not directly fix a vulnerability. Packet capture is used for network analysis, while phishing simulations are generally used for security awareness training. After applying a patch, security teams should validate the remediation to confirm that the vulnerability is no longer present and that the change did not introduce new problems.

Question 335

Which method can help detect unauthorized changes to critical system files?

1. Network address translation
2. File integrity monitoring
3. Load balancing
4. Packet fragmentation

Correct Answer: 2

Explanation

File Integrity Monitoring (FIM) detects changes to important files by tracking attributes such as hashes, timestamps, permissions, or file contents. When a monitored file changes unexpectedly, FIM can generate an alert for investigation. This can help identify malware installation, unauthorized configuration changes, or attacker activity involving system files. Network address translation changes how network addresses are represented, load balancing distributes traffic, and packet fragmentation divides network packets. FIM is therefore specifically suited to identifying unexpected modifications to files that should remain stable or tightly controlled.

Question 336

A security analyst needs to determine whether an endpoint contacted a known malicious IP address. Which data source is most useful?

1. Network connection logs
2. Asset inventory
3. Security baseline
4. Vulnerability report

Correct Answer: 1

Explanation

Network connection logs can reveal communications between endpoints and external or internal IP addresses. By searching these logs for a known malicious IP address, an analyst can determine whether an endpoint established a connection with the suspected infrastructure. Useful fields may include source and destination addresses, ports, timestamps, protocols, and connection status. Asset inventories describe organizational systems but do not normally record individual network connections. Security baselines define expected configurations, while vulnerability reports identify weaknesses. Network connection data is therefore the most direct source for confirming suspicious communications.

Question 337

What is the main purpose of threat hunting?

1. Automatically patch every endpoint
2. Replace all security controls
3. Search proactively for hidden threats
4. Encrypt every network connection

Correct Answer: 3

Explanation

Threat hunting is a proactive security activity in which analysts search an environment for signs of malicious or suspicious activity that automated detection may have missed. Hunters typically begin with a hypothesis based on threat intelligence, known attacker behavior, anomalies, or observed indicators. They then examine logs, endpoint telemetry, network traffic, and other evidence to validate or reject the hypothesis. Threat hunting does not replace security controls or automatically patch systems. Its primary purpose is to uncover threats that may already be present but have not generated a conventional security alert.

Question 338

Which control limits access to resources according to a user’s assigned job role?

1. ABAC
2. RBAC
3. DAC
4. NAC

Correct Answer: 2

Explanation

Role-Based Access Control (RBAC) assigns permissions according to predefined roles within an organization. Users receive access based on their job responsibilities, such as administrator, analyst, or finance employee. This simplifies access management and supports least privilege by allowing users to receive only the permissions associated with their roles. Attribute-Based Access Control (ABAC) evaluates attributes such as user, resource, location, or device conditions. Discretionary Access Control relies heavily on resource owners, while NAC controls access to networks. RBAC is specifically designed around job-role-based authorization.

Question 339

Which log source would be most useful for investigating repeated failed login attempts against a server?

1. DNS logs
2. Proxy logs
3. Authentication logs
4. File integrity logs

Correct Answer: 3

Explanation

Authentication logs record events related to user authentication, including successful and failed login attempts, usernames, timestamps, source addresses, and authentication methods. Repeated failed attempts can indicate brute-force attacks, password spraying, credential misuse, or legitimate user errors. DNS logs focus on domain resolution activity, proxy logs primarily record web or forwarded network requests, and file integrity logs track changes to monitored files. By examining authentication logs, analysts can identify patterns such as repeated failures from one source, attempts against multiple accounts, or unusual login times.

Question 340

What should an analyst do first when a high-confidence security alert indicates an active compromise?

1. Validate and assess the alert
2. Delete all related logs
3. Rebuild every server
4. Disable all network connectivity

Correct Answer: 1

Explanation

The analyst should validate and assess the alert to confirm the activity, determine its scope, and identify the affected systems before selecting an appropriate response. Even when an alert has high confidence, analysts need enough information to understand what occurred and what assets may be involved. Immediately deleting logs would destroy valuable evidence. Rebuilding every server may be unnecessary and could disrupt business operations, while disabling all network connectivity may cause excessive impact. Proper validation supports informed containment and helps ensure that incident response actions are proportional to the actual threat.