View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 381

Which security control is designed to prevent unauthorized users from accessing a restricted physical area?

1. Load balancer
2. Proxy server
3. SIEM
4. Badge reader

Correct Answer: 4

Explanation

A badge reader is a physical access control that verifies an individual’s authorization before allowing entry to a restricted area. It may use an access card, proximity badge, or other credential linked to an authorized user. Physical access controls are important because attackers who gain physical access may bypass many logical security protections or directly access sensitive equipment. Load balancers distribute network traffic, proxy servers forward network requests, and SIEM platforms collect security events. Badge readers therefore directly support physical access restrictions and help organizations control entry to protected facilities.

Question 382

Which activity involves searching for vulnerabilities in systems without actively exploiting them?

1. Vulnerability scanning
2. Penetration testing
3. Incident response
4. Threat hunting

Correct Answer: 1

Explanation

Vulnerability scanning uses automated or semi-automated tools to identify known weaknesses, missing patches, insecure configurations, outdated software, and exposed services. Unlike penetration testing, a typical vulnerability scan does not attempt to fully exploit discovered vulnerabilities. The results help security teams identify systems requiring further investigation or remediation. Penetration testing goes further by safely attempting to exploit weaknesses, incident response addresses active or suspected security incidents, and threat hunting proactively searches for signs of compromise. Vulnerability scanning is therefore an important recurring activity within vulnerability management programs.

Question 383

Which attack attempts to use a compromised server to access resources on another internal or external system?

1. XSS
2. SSRF
3. Password spraying
4. Credential stuffing

Correct Answer: 2

Explanation

Server-Side Request Forgery (SSRF) occurs when an attacker manipulates a vulnerable server-side application into making requests to unintended destinations. This can allow access to internal services, cloud metadata endpoints, administrative interfaces, or other resources that the attacker cannot directly reach. SSRF is particularly dangerous in cloud environments where metadata services may contain sensitive credentials or configuration information. XSS targets users through malicious client-side content, while password spraying and credential stuffing are authentication attacks. Proper input validation, network restrictions, allowlists, and cloud security controls can help reduce SSRF risk.

Question 384

A security analyst receives an alert for a suspicious login but finds that the login was generated by an approved vulnerability scanner. What should the analyst classify it as?

1. True positive
2. Security incident
3. False positive
4. Data breach

Correct Answer: 3

Explanation

The alert should be classified as a false positive if the activity initially appeared suspicious but investigation confirmed that it was legitimate and authorized. Security tools may generate alerts for approved scanners, automated administrative processes, testing activities, or other expected behavior. Analysts should validate alerts before escalating them as incidents. A true positive would involve genuinely malicious or unauthorized activity. Proper tuning can help reduce recurring false positives by allowing known legitimate scanner activity while maintaining detection coverage for actual threats. This improves analyst efficiency and reduces unnecessary alert fatigue.

Question 385

Which protocol provides encrypted remote administration of a system?

1. SSH
2. Telnet
3. FTP
4. HTTP

Correct Answer: 1

Explanation

Secure Shell (SSH) provides encrypted remote access and administration capabilities. It protects authentication information and session data from interception when properly configured. SSH is commonly used by administrators to manage Linux and Unix systems, transfer files through related secure protocols, and execute commands remotely. Telnet does not provide encryption and can expose credentials and session information. FTP is primarily a file transfer protocol, while HTTP is used for web communication and does not inherently provide encryption. SSH is therefore the appropriate protocol when secure remote command-line administration is required.

Question 386

What is the primary purpose of log normalization in a SIEM?

1. Delete duplicate evidence
2. Standardize data from different sources
3. Encrypt all log files
4. Prevent endpoint infections

Correct Answer: 2

Explanation

Log normalization converts data from different security devices and applications into a consistent format that a SIEM can process and correlate effectively. Different systems may use different field names, timestamp formats, severity levels, or event structures. Normalization helps the SIEM interpret these events consistently and makes correlation rules more reliable. It does not mean deleting evidence or encrypting every log. Endpoint protection addresses malware prevention. By standardizing security data, log normalization improves centralized monitoring, search capabilities, correlation, and investigation efficiency across diverse environments.

Question 387

Which attack involves sending malicious script content that executes in another user’s browser?

1. SQL injection
2. SSRF
3. Cross-site scripting
4. Buffer overflow

Correct Answer: 3

Explanation

Cross-Site Scripting (XSS) occurs when an application allows attacker-controlled script content to be delivered to users and executed within their browsers. Depending on the type of XSS, attackers may steal session information, manipulate page content, or perform actions using the victim’s browser context. SQL injection targets database queries, SSRF abuses server-side requests, and buffer overflows exploit memory-handling weaknesses. Strong output encoding, input validation, content security policies, and secure application development practices can help reduce XSS risks. Web application testing should specifically examine user-controlled input and output handling.

Question 388

Which security principle requires two different individuals to complete a sensitive transaction?

1. Least privilege
2. Separation of duties
3. Defense in depth
4. Zero Trust

Correct Answer: 2

Explanation

Separation of duties divides sensitive responsibilities among multiple people so that one individual cannot independently complete a high-risk process. For example, one employee may create a payment request while another approves it. This reduces the risk of fraud, abuse, and unauthorized actions because multiple parties are involved. Least privilege limits permissions to what is necessary, defense in depth uses multiple security layers, and Zero Trust requires continuous verification rather than automatically trusting users or systems. Separation of duties is particularly useful for protecting sensitive administrative and financial processes.

Question 389

Which type of threat intelligence is most useful for senior management making long-term security decisions?

1. Technical intelligence
2. Tactical intelligence
3. Strategic intelligence
4. Indicator intelligence

Correct Answer: 3

Explanation

Strategic threat intelligence provides high-level information that supports long-term security and business decisions. It may address threat trends, geopolitical developments, industry risks, attacker motivations, and potential business impacts. Senior leaders can use this information when considering security investments, risk management strategies, and organizational priorities. Tactical intelligence generally focuses on attacker TTPs, while technical intelligence often contains specific indicators such as hashes, IP addresses, or domains. Strategic intelligence is therefore more appropriate when decision-makers need broader context rather than detailed technical indicators.

Question 390

Which action is part of the containment phase of incident response?

1. Isolating an infected endpoint
2. Restoring a clean backup
3. Removing malware permanently
4. Writing the final lessons-learned report

Correct Answer: 1

Explanation

Containment focuses on limiting the spread and impact of an active security incident. Isolating an infected endpoint can prevent it from communicating with other systems, spreading malware, or contacting attacker infrastructure. The goal is to control the situation while preserving the ability to investigate and proceed with further response actions. Restoring a clean backup is generally associated with recovery, removing malware is part of eradication, and documenting lessons learned occurs after the incident response process. Containment is therefore a critical step for reducing immediate damage while the investigation continues.

Question 391

Which technique can help identify unauthorized changes to a configuration file?

1. File integrity monitoring
2. Network address translation
3. Password spraying
4. DNS filtering

Correct Answer: 1

Explanation

File Integrity Monitoring (FIM) can detect unauthorized changes to important files by tracking attributes such as cryptographic hashes, permissions, timestamps, or contents. If a monitored configuration file changes unexpectedly, the system can generate an alert for investigation. This can help identify malware activity, unauthorized administrative changes, or configuration tampering. Network address translation handles address translation, password spraying targets authentication systems, and DNS filtering controls access to domains. FIM is therefore well suited to detecting unexpected modifications to security-sensitive configuration files.

Question 392

A company wants to identify devices that are connected to its network but are missing from its asset inventory. What should it perform?

1. Data classification
2. Asset discovery
3. Password auditing
4. Log retention

Correct Answer: 2

Explanation

Asset discovery identifies devices, systems, applications, and other resources connected to or operating within an organization’s environment. It can reveal unknown, unmanaged, or unauthorized devices that are missing from the official asset inventory. Maintaining accurate asset visibility is essential because security teams cannot effectively patch, monitor, or protect systems they do not know exist. Data classification categorizes information, password auditing evaluates authentication controls, and log retention determines how long logs are stored. Asset discovery therefore directly addresses the need to identify previously unknown network-connected devices.

Question 393

Which method is most appropriate for examining malware without executing it?

1. Dynamic analysis
2. Static analysis
3. Behavioral simulation
4. Network isolation

Correct Answer: 2

Explanation

Static malware analysis examines a suspicious file without executing it. Analysts may inspect file metadata, strings, headers, imported functions, embedded resources, and other characteristics to identify potentially malicious behavior. This approach reduces the risk associated with directly running unknown code. Dynamic analysis, by contrast, executes the malware in a controlled environment to observe its behavior. Network isolation limits communications but does not itself constitute malware analysis. Static analysis is often performed first to gather information that can guide deeper investigation and help determine whether dynamic execution is appropriate.

Question 394

Which security control protects web applications by inspecting and filtering HTTP requests?

1. VPN
2. WAF
3. NAC
4. HIDS

Correct Answer: 2

Explanation

A Web Application Firewall (WAF) monitors and filters HTTP or HTTPS requests directed at web applications. It can help detect or block attacks such as SQL injection, cross-site scripting, malicious requests, and certain application-layer exploits. WAF rules can often be customized according to the application’s expected traffic and security requirements. A VPN provides protected network connectivity, NAC controls network access, and HIDS monitors activity on individual hosts. A WAF is specifically designed to provide a protective layer between web applications and potentially malicious HTTP traffic.

Question 395

What does MTTR commonly measure in security operations?

1. Average time to detect a threat
2. Average time to acknowledge an alert
3. Average time to recover or remediate
4. Average time to create an account

Correct Answer: 3

Explanation

Mean Time to Repair or Recover (MTTR) measures the average time required to restore systems or remediate an issue after it has been identified. In security operations, a lower MTTR can indicate that teams are able to respond and recover from incidents efficiently. MTTD measures the time required to detect an event, while MTTA measures the time taken to acknowledge an alert. Account creation time is unrelated to these incident response metrics. Organizations use MTTR alongside other measurements to evaluate response effectiveness and identify opportunities for process improvement.

Question 396

Which approach assumes that no user or device should be trusted automatically?

1. Zero Trust
2. Open access
3. Implicit trust
4. Single sign-on

Correct Answer: 1

Explanation

Zero Trust is a security approach based on the principle that users, devices, and connections should not automatically receive trust simply because they are inside a network. Access decisions should be continuously evaluated using factors such as identity, device security, resource sensitivity, and contextual information. Authentication and authorization are applied before granting access, and permissions should be limited according to need. Open or implicit trust approaches provide weaker security assumptions, while single sign-on is an authentication convenience rather than a complete security architecture. Zero Trust emphasizes verification and least privilege.

Question 397

Which network evidence can reveal the contents and sequence of communications between two systems?

1. Asset inventory
2. Packet capture
3. Security baseline
4. Password policy

Correct Answer: 2

Explanation

Packet capture records network packets transmitted between systems and can provide detailed information about network communications. Analysts can inspect packet headers, protocols, addresses, ports, and, where traffic is not encrypted, potentially application-level content. Packet captures are useful for investigating suspicious connections, malware communications, protocol abuse, and data transfers. Asset inventories identify systems but do not record individual communications. Security baselines define expected configurations, while password policies control authentication requirements. Packet capture therefore provides detailed network-level evidence that can support incident investigation and traffic analysis.

Question 398

Which security control can prevent unauthorized devices from connecting to an organization’s network?

1. NAC
2. SIEM
3. WAF
4. DLP

Correct Answer: 1

Explanation

Network Access Control (NAC) can enforce policies that determine whether a device is permitted to connect to a network. NAC solutions may evaluate device identity, authentication status, security posture, or compliance with organizational requirements before granting access. Unauthorized or noncompliant devices can be blocked, quarantined, or placed into restricted network segments. SIEM provides centralized event analysis, WAF protects web applications, and DLP protects sensitive information. NAC therefore provides a direct mechanism for controlling which devices can gain network access and under what conditions.

Question 399

Which attack attempts to overwhelm a service with excessive traffic or requests?

1. Credential stuffing
2. SQL injection
3. Denial-of-service
4. Privilege escalation

Correct Answer: 3

Explanation

A Denial-of-Service (DoS) attack attempts to make a service or system unavailable to legitimate users by exhausting resources such as bandwidth, processing capacity, memory, or application connections. Distributed Denial-of-Service (DDoS) attacks use multiple systems to generate the traffic or requests, making mitigation more difficult. Credential stuffing targets authentication systems, SQL injection targets database interactions, and privilege escalation attempts to gain higher permissions. Organizations can use rate limiting, traffic filtering, load balancing, upstream protection, and monitoring to reduce the impact of denial-of-service attacks.

Question 400

Which activity should be performed after an incident to improve future response capabilities?

1. Disable security controls
2. Remove all evidence
3. Conduct a lessons-learned review
4. Delete incident documentation

Correct Answer: 3

Explanation

A lessons-learned review examines an incident after response activities have been completed to identify what worked well and what should be improved. Teams can review detection time, communication, containment, eradication, recovery, evidence handling, and coordination between departments. Findings may lead to updated playbooks, improved monitoring rules, additional training, stronger controls, or changes to response procedures. Disabling controls or deleting evidence would reduce future security capabilities and potentially destroy valuable information. A structured lessons-learned process helps organizations improve their incident response maturity and prepare more effectively for future events.