View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 221

Which technology is primarily used to detect suspicious endpoint behavior?

1. VPN
2. EDR
3. DHCP
4. NTP

Correct Answer: 4

Explanation

Endpoint Detection and Response, or EDR, continuously monitors endpoint activity to identify suspicious behavior and potential security threats. It can collect information about processes, files, network connections, user activity, and other endpoint events. Security analysts can use this telemetry to investigate incidents and respond to compromised systems. VPNs provide secure remote connectivity, DHCP assigns network addresses, and NTP synchronizes system time. EDR solutions may also provide response capabilities such as isolating an endpoint, terminating malicious processes, or quarantining suspicious files.

Question 222

What is the main purpose of data normalization in a SIEM?

1. Convert different log formats into a consistent structure
2. Encrypt every collected log
3. Delete duplicate security events
4. Block malicious network traffic

Correct Answer: 1

Explanation

Data normalization converts information from different log sources into a consistent format that a SIEM can analyze more effectively. Firewalls, operating systems, applications, and cloud services may record similar events using different field names and structures. Normalization allows the SIEM to recognize comparable data across these sources and perform more accurate correlation. It does not inherently encrypt logs, block traffic, or simply delete duplicates. Proper normalization improves searching, alert correlation, dashboards, reporting, and automated detection by providing consistent fields and values.

Question 223

An organization wants to identify unusual behavior by comparing a user’s activity with normal behavior for that user. Which capability is most appropriate?

1. DLP
2. NAC
3. UEBA
4. WAF

Correct Answer: 3

Explanation

User and Entity Behavior Analytics, or UEBA, analyzes normal patterns of behavior for users and other entities and identifies significant deviations. For example, a user who normally accesses systems during business hours from one location may generate an alert after suddenly accessing sensitive resources at unusual times from an unfamiliar location. UEBA can help identify compromised accounts, insider threats, privilege misuse, and other abnormal activity. DLP focuses on preventing unauthorized data movement, NAC controls network access, and WAF protects web applications from malicious traffic.

Question 224

Which protocol is commonly used to securely transfer files between systems?

1. FTP
2. SFTP
3. Telnet
4. HTTP

Correct Answer: 2

Explanation

SFTP, or SSH File Transfer Protocol, provides secure file transfer through an SSH connection. It protects authentication and transferred data using encryption, making it suitable for moving sensitive files between systems. Traditional FTP does not inherently provide encryption and can expose credentials and data. Telnet is an insecure remote-access protocol, while HTTP is primarily designed for transferring web content. Security analysts should consider both the protocol and its configuration when evaluating whether file transfers meet organizational security requirements.

Question 225

Which log source is especially useful when investigating suspicious web application requests?

1. DHCP logs
2. NTP logs
3. Printer logs
4. Web server logs

Correct Answer: 4

Explanation

Web server logs record requests made to web applications and commonly include information such as source IP addresses, requested URLs, HTTP methods, response codes, user agents, and timestamps. Analysts can use these records to investigate attacks such as SQL injection, cross-site scripting attempts, directory traversal, and unusual authentication activity. DHCP logs provide information about IP address assignments, NTP logs concern time synchronization, and printer logs are generally unrelated to web requests. Correlating web logs with WAF, authentication, and endpoint data can provide additional investigative context.

Question 226

Which technique involves analyzing malicious software without executing it?

1. Static analysis
2. Dynamic analysis
3. Behavioral analysis
4. Sandbox execution

Correct Answer: 3

Explanation

Static malware analysis examines malicious files without executing them. Analysts may inspect file hashes, strings, metadata, headers, embedded resources, imports, and code characteristics to understand what a sample may do. Dynamic analysis instead executes the malware in a controlled environment and observes its behavior. Sandboxing is commonly used to support dynamic analysis, while behavioral analysis generally focuses on actions observed during execution. Static analysis can provide useful intelligence while reducing the risk associated with directly executing an unknown sample.

Question 227

A company discovers that a former employee’s account remains active after termination. What security issue does this represent?

1. Credential rotation
2. Account provisioning
3. Deprovisioning failure
4. Network segmentation

Correct Answer: 1

Explanation

An account that remains active after an employee leaves the organization represents a deprovisioning failure. Terminated users should have their access disabled promptly to prevent unauthorized use of their credentials. This process is an important part of identity and access management and should be connected to employee offboarding procedures. Credential rotation may be appropriate after certain security events, but it does not address the inactive employee account itself. Network segmentation also does not directly solve the problem of an unnecessary active identity.

Question 228

Which method can help detect unauthorized changes to a critical configuration file?

1. Hash comparison
2. Data classification
3. Load balancing
4. Network address translation

Correct Answer: 2

Explanation

Hash comparison can help identify whether a file has changed. A cryptographic hash can be calculated for a known-good configuration file and later compared with a newly calculated hash. If the values differ, the file content has changed and should be investigated. This method is commonly associated with file integrity monitoring. Data classification determines the sensitivity of information, load balancing distributes workloads, and NAT translates network addresses. Hash comparison does not explain what changed, so additional analysis may be required to determine whether a modification was authorized.

Question 229

Which attack attempts to obtain sensitive information by sending DNS queries that contain encoded data?

1. Credential stuffing
2. Session hijacking
3. DNS tunneling
4. Buffer overflow

Correct Answer: 3

Explanation

DNS tunneling abuses DNS queries and responses to transfer data or maintain communication with an external system. Attackers may encode information within subdomain requests and use DNS infrastructure as a covert communication channel. Analysts can investigate unusual DNS query lengths, high volumes of requests, random-looking subdomains, unusual query patterns, and connections to suspicious domains. Credential stuffing targets accounts using previously stolen credentials, session hijacking targets authenticated sessions, and buffer overflows exploit memory-handling weaknesses. DNS monitoring can therefore provide valuable indicators during investigations.

Question 230

What is the primary goal of vulnerability prioritization?

1. Identify every asset owned by a company
2. Remove all security controls
3. Increase the number of vulnerabilities
4. Address the most significant risks first

Correct Answer: 4

Explanation

Vulnerability prioritization helps security teams determine which weaknesses should be addressed first based on their potential risk. Factors can include vulnerability severity, exploitability, asset criticality, exposure, available exploits, business impact, and compensating controls. Simply identifying vulnerabilities is not enough because organizations often have limited time and resources for remediation. Prioritization allows teams to focus efforts where they can reduce the greatest amount of risk. A vulnerability with a high technical score may still require different treatment depending on the importance and exposure of the affected asset.

Question 231

Which email security mechanism uses cryptographic signatures to help verify that a message was authorized by the sending domain?

1. DKIM
2. DHCP
3. SNMP
4. ARP

Correct Answer: 1

Explanation

DomainKeys Identified Mail, or DKIM, uses cryptographic signatures to help receiving mail systems verify that an email was authorized by the sending domain and that specified message content was not altered after signing. The sending domain publishes a public key in DNS, while the email contains a corresponding digital signature. DKIM is different from SPF, which identifies authorized sending servers. DMARC can use authentication results from SPF and DKIM when applying a domain’s email policy. These mechanisms collectively help reduce spoofing and phishing risks.

Question 232

What does a CVSS score primarily communicate?

1. The identity of the affected vendor
2. The severity of a vulnerability
3. The location of a server
4. The number of users on a system

Correct Answer: 2

Explanation

The Common Vulnerability Scoring System, or CVSS, provides a standardized way to communicate the severity of a vulnerability. Scores are based on characteristics such as attack complexity, required privileges, user interaction, scope, and potential impact. CVSS helps security teams compare vulnerabilities and support remediation prioritization. However, a CVSS score should not be treated as the only factor in deciding what to remediate first. Asset importance, exposure, exploit availability, business impact, and compensating controls should also be considered.

Question 233

Which phase of incident response focuses on removing malware and attacker persistence from affected systems?

1. Preparation
2. Detection
3. Eradication
4. Identification

Correct Answer: 4

Explanation

Eradication focuses on removing the root cause and malicious components of an incident. Depending on the situation, this may involve deleting malware, removing persistence mechanisms, disabling compromised accounts, eliminating unauthorized tools, and addressing exploited vulnerabilities. Preparation occurs before incidents and involves establishing procedures, tools, and resources. Detection and identification involve recognizing and analyzing suspicious activity. Successful eradication should occur after appropriate containment and investigation activities and should be followed by recovery steps to safely return affected systems to normal operation.

Question 234

Which control is designed specifically to inspect and filter HTTP and HTTPS traffic to web applications?

1. WAF
2. VPN
3. NAC
4. SIEM

Correct Answer: 3

Explanation

A Web Application Firewall, or WAF, monitors and filters web application traffic, commonly focusing on HTTP and HTTPS requests. It can help detect or block attacks such as SQL injection, cross-site scripting, malicious requests, and certain application-layer exploits. A VPN provides encrypted remote connectivity, NAC controls whether devices can access a network, and SIEM platforms collect and correlate security events. A WAF can provide an additional defensive layer for internet-facing applications, although secure application development remains important because a WAF should not be the only security control.

Question 235

An analyst wants to determine whether an IP address contacted a suspicious domain shortly before malware appeared on an endpoint. What should be correlated?

1. Asset inventory and payroll data
2. DNS logs and endpoint telemetry
3. Printer logs and badge records
4. Backup schedules and software licenses

Correct Answer: 2

Explanation

Correlating DNS logs with endpoint telemetry can help establish relationships between suspicious domain lookups and subsequent activity on an affected endpoint. DNS logs can show when a system resolved a domain, while endpoint telemetry can reveal processes, files, network connections, and other activity occurring around the same time. Combining these sources can help analysts establish a timeline and determine whether the DNS request was associated with malware execution or command-and-control activity. Other listed data sources generally provide little direct evidence for this particular investigation.

Question 236

Which security principle assumes that no user or device should automatically be trusted?

1. Zero Trust
2. Open access
3. Shared administration
4. Implicit trust

Correct Answer: 1

Explanation

Zero Trust is a security approach based on the principle that users and devices should not receive implicit trust simply because they are inside a network or have previously authenticated. Access decisions should consider identity, device state, resource sensitivity, context, and other relevant signals. Continuous verification and least-privilege access are commonly associated with Zero Trust architectures. The approach can help limit unauthorized access and reduce lateral movement. It does not mean that every connection must be blocked; rather, access should be explicitly evaluated and appropriately controlled.

Question 237

Which artifact can help determine the exact sequence of events during a security incident?

1. Asset inventory
2. Security baseline
3. Incident timeline
4. Password policy

Correct Answer: 4

Explanation

An incident timeline organizes relevant events chronologically to help investigators reconstruct what happened during a security incident. Analysts may combine authentication records, endpoint events, network traffic, application logs, file timestamps, and other forensic artifacts to build the timeline. This can reveal initial access, execution, persistence, lateral movement, and other stages of an attack. Asset inventories identify systems, security baselines define expected configurations, and password policies govern authentication requirements. Timeline analysis is particularly useful when multiple data sources must be correlated during a complex investigation.

Question 238

Which practice helps ensure that collected evidence can be traced from acquisition through analysis?

1. Data compression
2. Chain of custody
3. Network segmentation
4. Load balancing

Correct Answer: 2

Explanation

Chain of custody documents how digital evidence is collected, transferred, stored, accessed, and analyzed throughout an investigation. Proper documentation helps demonstrate that evidence was handled consistently and that unauthorized modification or access did not occur. Investigators may record timestamps, responsible individuals, storage locations, evidence identifiers, and integrity verification information. Data compression reduces file size, network segmentation separates systems, and load balancing distributes traffic. Maintaining a reliable chain of custody is particularly important when forensic findings may need to support legal, regulatory, or formal organizational proceedings.

Question 239

Which activity is an example of attack surface management?

1. Disabling all security monitoring
2. Ignoring unknown cloud assets
3. Identifying exposed internet-facing systems
4. Removing vulnerability reports

Correct Answer: 3

Explanation

Attack surface management involves identifying, monitoring, and reducing assets and services that could potentially be targeted by attackers. This includes discovering internet-facing servers, domains, cloud resources, applications, APIs, remote services, and other externally accessible assets. Unknown or forgotten systems can introduce significant security exposure because they may not receive appropriate patches or monitoring. Attack surface management helps organizations maintain visibility and reduce unnecessary exposure. It complements vulnerability management by helping security teams understand which assets exist and which externally reachable resources require attention.

Question 240

What is the primary purpose of a security playbook?

1. Provide predefined response procedures for specific scenarios
2. Replace all security analysts
3. Store employee salary information
4. Increase network bandwidth

Correct Answer: 1

Explanation

A security playbook provides predefined procedures that guide analysts through responding to a specific type of security event. A phishing playbook, for example, may define steps for analyzing the message, examining links and attachments, identifying affected users, containing compromised accounts, and documenting the incident. Playbooks improve consistency and can reduce response time by giving analysts an established workflow. They may also support automation through SOAR platforms. Playbooks should be reviewed and updated as threats, technologies, procedures, and organizational requirements change.