View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 1

Which security control is primarily used to detect suspicious network traffic?

1. Firewall
2. Antivirus
3. Network IDS
4. Password policy

Correct Answer: 3

Explanation

A network intrusion detection system (NIDS) monitors network traffic and analyzes it for suspicious patterns, known attack signatures, or abnormal behavior. When potentially malicious activity is detected, the IDS generates an alert for security personnel to investigate. Unlike an intrusion prevention system, an IDS normally does not automatically block the traffic. Firewalls primarily enforce access-control rules, while antivirus software focuses mainly on malicious files and processes on endpoints. Security analysts commonly use NIDS alerts as an important source of information during threat detection and incident investigation.

Question 2

What is the main purpose of vulnerability scanning?

1. Identify weaknesses in systems
2. Encrypt network traffic
3. Remove malware automatically
4. Create user accounts

Correct Answer: 1

Explanation

Vulnerability scanning is used to identify weaknesses, missing patches, insecure configurations, and other security issues in systems and applications. A scanner examines assets against known vulnerability information and configuration checks, producing findings that security teams can review and prioritize. Vulnerability scanning differs from penetration testing because scanning generally identifies potential weaknesses without attempting to exploit them extensively. Regular scanning helps organizations maintain visibility into their security posture and discover problems before attackers can take advantage of them. Findings should be validated and prioritized according to risk.

Question 3

Which log source would be most useful for investigating repeated failed login attempts?

1. Printer logs
2. HVAC logs
3. Authentication logs
4. Backup logs

Correct Answer: 3

Explanation

Authentication logs record events related to user authentication, including successful and failed login attempts. During an investigation involving repeated failed logins, analysts can examine these logs to identify usernames, source addresses, timestamps, authentication methods, and patterns of activity. A large number of failures may indicate password spraying, brute-force activity, or another unauthorized access attempt. Analysts should correlate authentication events with other relevant sources, such as firewall or endpoint logs, to determine whether the activity represents a genuine attack or legitimate user behavior.

Question 4

An analyst discovers that an employee’s credentials were used from two distant countries within minutes. What should the analyst investigate first?

1. Password expiration
2. Impossible travel
3. Disk fragmentation
4. Software licensing

Correct Answer: 2

Explanation

Impossible travel refers to authentication activity occurring from geographically distant locations within a timeframe that makes normal physical travel unrealistic. It can indicate credential theft, account compromise, VPN usage, or unusual authentication behavior. An analyst should investigate the associated login timestamps, source IP addresses, authentication methods, device information, and user activity. However, an impossible-travel alert does not automatically prove compromise because legitimate VPNs, proxies, cloud services, or mobile connections can produce misleading locations. Analysts should correlate multiple data points before confirming an incident.

Question 5

Which attack attempts to guess passwords by trying many combinations?

1. Phishing
2. Tailgating
3. Shoulder surfing
4. Brute force

Correct Answer: 4

Explanation

A brute-force attack attempts to discover credentials by systematically trying many possible password combinations. Unlike password spraying, which typically tries a small number of common passwords across many accounts, brute force focuses on trying many combinations against a particular account or authentication target. Strong passwords, account lockout policies, multifactor authentication, and monitoring can reduce the effectiveness of these attacks. Security analysts should investigate repeated authentication failures and identify whether attempts originate from unusual addresses, devices, or geographic locations.

Question 6

Which technology aggregates security events from multiple systems for centralized analysis?

1. NAC
2. DLP
3. SIEM
4. VPN

Correct Answer: 3

Explanation

A Security Information and Event Management system, or SIEM, collects and analyzes security-related events from multiple sources. These sources can include servers, endpoints, firewalls, identity systems, applications, and network devices. Centralizing events allows analysts to correlate activity across different systems and identify patterns that might not be obvious when reviewing individual logs. SIEM platforms can also support alerting, dashboards, investigation, and reporting. Effective SIEM use depends on appropriate log collection, normalization, correlation rules, and careful tuning to reduce unnecessary alerts.

Question 7

Which security principle requires users to receive only the permissions necessary for their jobs?

1. Least privilege
2. Separation of duties
3. Non-repudiation
4. Defense in depth

Correct Answer: 1

Explanation

The principle of least privilege limits users, applications, and services to only the permissions required to perform their authorized tasks. This reduces the potential impact of compromised accounts and accidental or unauthorized actions. For example, a user who only needs to read a database should not automatically receive administrative or modification privileges. Least privilege should be applied to human users as well as service accounts and applications. Security teams should periodically review permissions because excessive privileges can accumulate as responsibilities and organizational roles change.

Question 8

Which malware type can replicate itself across networks without requiring a user to execute an infected file?

1. Trojan
2. Worm
3. Spyware
4. Rootkit

Correct Answer: 2

Explanation

A worm is malware capable of self-replication and propagation, often across networks, without requiring the same type of user interaction associated with many traditional malware infections. Worms may exploit vulnerabilities in operating systems, applications, or network services to spread from one system to another. This behavior can allow an infection to expand rapidly across an organization. Security teams can reduce worm propagation through timely patching, network segmentation, endpoint security, access controls, and monitoring for unusual scanning or lateral movement activity.

Question 9

What does threat intelligence primarily provide to security analysts?

1. Password recovery
2. Hardware inventory
3. Information about threats and indicators
4. Software licensing

Correct Answer: 3

Explanation

Threat intelligence provides information about threats, threat actors, attack techniques, indicators of compromise, and other information that can help organizations understand and respond to security risks. Analysts can use intelligence such as malicious IP addresses, domains, file hashes, tactics, techniques, and procedures to improve detection and investigation. Threat intelligence can come from internal observations, commercial providers, government sources, industry groups, and other trusted channels. Analysts should evaluate the reliability, relevance, and age of intelligence before using it in operational security decisions.

Question 10

Which action is commonly performed during the containment phase of incident response?

1. Writing the final report
2. Restoring normal operations
3. Performing a lessons-learned meeting
4. Isolating an affected endpoint

Correct Answer: 4

Explanation

Containment focuses on limiting the spread and impact of a security incident. Isolating an affected endpoint from the network is a common containment action because it can prevent an attacker or malware from communicating with other systems. The exact response depends on the incident and organizational procedures. Containment occurs before full eradication and recovery activities. Security teams should preserve appropriate evidence while containing the incident and document actions taken. Effective containment helps prevent additional damage while investigators determine the root cause and scope of compromise.

Question 11

Which metric measures the percentage of vulnerabilities that have been remediated?

1. Remediation rate
2. Mean time to detect
3. False positive rate
4. Asset utilization

Correct Answer: 1

Explanation

A remediation rate measures the proportion of identified vulnerabilities that have been addressed within a defined period or scope. Security teams can use this metric to evaluate how effectively vulnerability-management processes are reducing known weaknesses. For example, an organization may track how many critical vulnerabilities identified during a scan have been patched. Remediation rate should be interpreted alongside other measurements, such as vulnerability severity, asset importance, remediation deadlines, and exceptions. A high remediation rate does not necessarily mean that all organizational risk has been eliminated.

Question 12

Which technique attempts to deceive users into revealing sensitive information through fraudulent messages?

1. DDoS
2. Phishing
3. Port scanning
4. Hash cracking

Correct Answer: 2

Explanation

Phishing is a social-engineering technique that attempts to trick users into providing sensitive information, opening malicious content, transferring funds, or performing another attacker-controlled action. Phishing messages may imitate trusted organizations or individuals and can be delivered through email, messaging platforms, or other communication channels. Analysts can examine sender information, URLs, attachments, message content, and authentication records when investigating suspected phishing. Security awareness training, email filtering, multifactor authentication, and careful verification of unusual requests can reduce the effectiveness of phishing campaigns.

Question 13

Which tool is commonly used to capture and analyze network packets?

1. SIEM
2. Vulnerability scanner
3. Packet analyzer
4. Password manager

Correct Answer: 3

Explanation

A packet analyzer captures and examines network traffic at the packet level. Security analysts can use packet analysis to investigate suspicious connections, identify protocols, examine communication patterns, and understand how systems interacted during a security event. Packet captures can provide detailed evidence that may not be available in higher-level logs. Analysts should consider the capture location, timestamps, relevant protocols, and surrounding network activity when interpreting results. Packet analysis is particularly useful when investigating network-based attacks, unusual communications, or suspected command-and-control activity.

Question 14

What is the primary purpose of a vulnerability management program?

1. Increase system performance
2. Identify, prioritize, and remediate vulnerabilities
3. Replace all security controls
4. Eliminate user accounts

Correct Answer: 2

Explanation

A vulnerability management program provides a structured process for identifying, assessing, prioritizing, and remediating security weaknesses. It commonly includes asset discovery, vulnerability scanning, risk assessment, remediation, validation, and ongoing monitoring. Not every vulnerability has the same level of risk, so organizations should prioritize findings based on factors such as severity, exploitability, asset criticality, exposure, and business impact. A mature program also tracks remediation progress and validates that vulnerabilities have actually been addressed rather than assuming that a patch or configuration change was successful.

Question 15

Which attack involves sending a large number of requests to overwhelm a service?

1. Credential stuffing
2. DDoS
3. SQL injection
4. DNS poisoning

Correct Answer: 2

Explanation

A distributed denial-of-service attack attempts to overwhelm a service, application, or network resource with excessive traffic or requests. In a distributed attack, traffic may originate from many compromised systems, making the activity more difficult to block using a single source-based control. Analysts can investigate traffic volume, source distribution, request patterns, and affected services when responding to suspected DDoS activity. Mitigation can involve traffic filtering, rate limiting, upstream protection services, load balancing, or other controls designed to maintain service availability during an attack.

Question 16

Which process determines the potential impact and likelihood associated with a security risk?

1. Risk assessment
2. Log rotation
3. Data normalization
4. Patch deployment

Correct Answer: 1

Explanation

Risk assessment evaluates potential threats and vulnerabilities by considering factors such as likelihood and impact. Security teams use risk assessments to determine which risks require greater attention and which controls or mitigation actions may be appropriate. For example, a vulnerability affecting an internet-facing critical server may receive greater priority than a similar vulnerability on an isolated test system. Risk assessment should consider technical findings as well as business context. Organizations can then make informed decisions about remediation, mitigation, transfer, acceptance, or avoidance of identified risks.

Question 17

Which indicator is commonly used to identify a known malicious file?

1. Username
2. MAC address
3. Hostname
4. File hash

Correct Answer: 4

Explanation

A file hash is a value generated from the contents of a file and can be used as an indicator of compromise when the hash is associated with known malicious software. Security tools can compare observed file hashes against threat-intelligence databases or internal blocklists. Common cryptographic hashing algorithms include SHA-256. However, hashes can change when a file is modified, so analysts should not rely on a single indicator. Combining hashes with domains, IP addresses, behavioral indicators, and other evidence can provide stronger detection and investigation results.

Question 18

What is the purpose of network segmentation?

1. Increase password length
2. Limit communication between network areas
3. Remove endpoint logs
4. Disable authentication

Correct Answer: 2

Explanation

Network segmentation divides a network into separate security zones and controls communication between them. This can limit lateral movement if an attacker compromises one system or network segment. For example, critical servers can be placed in a restricted segment with tightly controlled access from user networks. Segmentation can also help separate sensitive systems from less trusted environments. Security teams should define appropriate access rules between segments and monitor traffic crossing those boundaries. Effective segmentation reduces unnecessary connectivity and can limit the scope of a security incident.

Question 19

Which type of vulnerability allows an attacker to execute unauthorized database queries through application input?

1. Cross-site scripting
2. Buffer overflow
3. SQL injection
4. DDoS

Correct Answer: 3

Explanation

SQL injection occurs when untrusted input is improperly incorporated into database queries, allowing an attacker to manipulate the intended SQL statement. Successful exploitation may allow unauthorized data access, modification, or other database actions depending on the application’s privileges and configuration. Security teams can reduce SQL injection risk through parameterized queries, prepared statements, input validation, secure coding practices, and appropriate database permissions. During vulnerability assessment, analysts should identify applications that construct database queries from user-controlled input and verify that appropriate protections are implemented.

Question 20

Which phase focuses on restoring systems to normal operation after an incident?

1. Recovery
2. Identification
3. Containment
4. Preparation

Correct Answer: 1

Explanation

The recovery phase focuses on restoring affected systems and services to normal, trusted operation after an incident. Activities can include rebuilding compromised systems, restoring data from clean backups, removing temporary containment measures, monitoring restored systems, and confirming that security controls are functioning correctly. Recovery should be performed carefully because returning a compromised system to production too quickly can allow an attacker to regain access. Security teams should validate systems before normal operations resume and document relevant findings for later lessons learned and improvements to incident-response procedures.