View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 241

Which technology can automatically execute predefined actions in response to security alerts?

1. SOAR
2. DHCP
3. FTP
4. RAID

Correct Answer: 4

Explanation

Security Orchestration, Automation, and Response, or SOAR, can automate predefined actions in response to security alerts and incidents. A SOAR platform can integrate with security tools and execute workflows such as blocking an IP address, disabling an account, collecting additional information, or creating an incident ticket. Automation can reduce repetitive manual work and improve response speed. DHCP assigns network addresses, FTP transfers files, and RAID provides storage redundancy. SOAR is especially useful when organizations need consistent responses to frequent and well-understood security events.

Question 242

What is the primary purpose of vulnerability scanning?

1. Recover deleted files
2. Identify known security weaknesses
3. Encrypt network traffic
4. Monitor employee attendance

Correct Answer: 1

Explanation

Vulnerability scanning is used to identify known security weaknesses in systems, applications, devices, and network services. Scanners can detect outdated software, missing patches, insecure configurations, exposed services, and vulnerabilities associated with known identifiers. The results help security teams determine which issues require further investigation or remediation. Vulnerability scanning differs from penetration testing because a scanner generally identifies potential weaknesses automatically, while penetration testing involves controlled attempts to exploit weaknesses. Regular scanning helps organizations maintain visibility into their security posture as environments change.

Question 243

An analyst observes a process creating a suspicious executable and then launching it from a temporary directory. What should the analyst examine next?

1. CPU warranty information
2. Monitor brightness settings
3. Parent-child process relationships
4. Printer configuration

Correct Answer: 3

Explanation

Parent-child process relationships can reveal how suspicious processes were created and executed. An analyst should examine which process launched the suspicious executable, the command-line arguments used, the account involved, and the timing of the activity. Unusual relationships, such as an office application spawning a command shell or scripting engine, may indicate malicious execution. Endpoint telemetry can provide this information and help establish an attack chain. Hardware settings and printer configuration generally provide no useful context for determining how a suspicious process was launched.

Question 244

Which control helps prevent sensitive information from leaving an organization through unauthorized channels?

1. NTP
2. DLP
3. NAT
4. DHCP

Correct Answer: 2

Explanation

Data Loss Prevention, or DLP, helps identify and prevent unauthorized transmission, copying, or exposure of sensitive information. DLP controls can monitor email, web uploads, removable media, cloud storage, and other data movement channels. Policies may identify sensitive information using classifications, patterns, keywords, or other detection methods. NTP synchronizes system time, NAT translates network addresses, and DHCP provides IP configuration. DLP is particularly valuable when organizations need to reduce the risk of accidental or intentional disclosure of confidential, financial, personal, or proprietary information.

Question 245

Which activity is most likely to reveal an attacker’s command-and-control infrastructure?

1. Reviewing suspicious outbound connections
2. Updating password policies
3. Checking printer toner levels
4. Reviewing employee vacation records

Correct Answer: 4

Explanation

Reviewing suspicious outbound connections can help identify command-and-control infrastructure used by attackers to communicate with compromised systems. Analysts may examine destination IP addresses, domains, ports, connection frequency, timing, and traffic patterns. Connections to known malicious infrastructure or unusual external destinations can provide important indicators of compromise. Password policies and unrelated administrative information do not directly reveal command-and-control activity. Network traffic analysis, DNS logs, proxy logs, and endpoint telemetry can be correlated to strengthen the investigation and determine whether a system is communicating with attacker-controlled infrastructure.

Question 246

Which vulnerability allows an attacker to inject malicious commands into an operating system through an application?

1. CSRF
2. Command injection
3. Clickjacking
4. Session fixation

Correct Answer: 3

Explanation

Command injection occurs when an application improperly handles user-controlled input and allows an attacker to execute operating system commands. Successful exploitation can enable unauthorized actions using the privileges of the vulnerable application or account. Strong input validation, parameterized interfaces, secure coding practices, and appropriate privilege restrictions can help reduce this risk. CSRF abuses a user’s authenticated session, clickjacking tricks users into interacting with hidden or misleading interface elements, and session fixation targets session management. Analysts should investigate both the vulnerable application and any commands executed after exploitation.

Question 247

Which security assessment actively attempts to exploit vulnerabilities under controlled conditions?

1. Penetration test
2. Log review
3. Asset inventory
4. Configuration backup

Correct Answer: 1

Explanation

A penetration test is a controlled security assessment in which authorized testers attempt to exploit vulnerabilities to determine whether weaknesses can actually be abused. Penetration testing can provide evidence about attack paths, potential impact, and the effectiveness of existing controls. It should be performed under defined rules of engagement to establish scope, permitted techniques, systems, and testing limitations. Log reviews examine recorded events, asset inventories identify systems, and configuration backups preserve settings. Penetration testing complements vulnerability scanning by providing deeper validation of exploitable weaknesses.

Question 248

What is the primary purpose of network traffic baselining?

1. Increase network bandwidth
2. Establish normal traffic patterns
3. Replace endpoint security
4. Remove all firewall rules

Correct Answer: 2

Explanation

Network traffic baselining establishes a picture of normal communication patterns within an environment. Analysts can examine factors such as common destinations, protocols, ports, traffic volumes, connection frequencies, and normal communication times. Once a baseline exists, significant deviations can be investigated as potential indicators of compromise, misconfiguration, or unusual activity. Baselining does not automatically prove that an anomaly is malicious because legitimate operational changes can also create deviations. It is therefore most effective when combined with other security telemetry and contextual analysis.

Question 249

Which type of malware is designed to conceal its presence by modifying or interfering with operating system functions?

1. Worm
2. Trojan
3. Rootkit
4. Adware

Correct Answer: 3

Explanation

A rootkit is malware designed to maintain privileged access while concealing its presence from users and security tools. Rootkits may manipulate operating system components, processes, files, or system information to hide malicious activity. Because they can operate at deep levels of the system, detecting them may require specialized endpoint analysis, integrity checks, memory forensics, or trusted offline tools. Worms primarily self-propagate across systems, Trojans disguise malicious functionality as legitimate software, and adware primarily displays unwanted advertisements. Rootkits are particularly concerning because they can support long-term persistence.

Question 250

Which factor should be considered when determining the business impact of a compromised server?

1. Keyboard layout
2. Screen resolution
3. Asset criticality
4. Mouse sensitivity

Correct Answer: 4

Explanation

Asset criticality is an important factor when determining the business impact of a compromised server. A server supporting essential business operations, financial systems, customer services, or critical infrastructure may require faster response than a system with limited operational importance. Analysts should consider the data stored, services provided, dependencies, number of users affected, and potential consequences of downtime or compromise. Technical vulnerability severity alone may not accurately represent business risk. Combining technical findings with asset criticality allows security teams to prioritize incidents and remediation activities more effectively.

Question 251

Which method can help identify whether a suspicious file is associated with a known malware sample?

1. Hash comparison
2. Network segmentation
3. Data classification
4. Load balancing

Correct Answer: 1

Explanation

Hash comparison can help determine whether a suspicious file matches a previously identified malware sample. Analysts can calculate a cryptographic hash of the file and compare it against trusted malware intelligence or internal records. A matching hash can provide a useful indicator that the file is known, although a different hash does not necessarily mean the file is safe because attackers can modify malware. Hashes are therefore one component of malware analysis. Additional evidence such as behavior, metadata, network activity, and file characteristics may also be required.

Question 252

Which cloud security practice helps identify unauthorized activity within cloud resources?

1. Disabling audit logs
2. Reviewing cloud activity logs
3. Removing access controls
4. Sharing administrative accounts

Correct Answer: 2

Explanation

Cloud activity logs provide visibility into actions performed against cloud resources, such as authentication attempts, administrative changes, resource creation, configuration modifications, and API activity. Reviewing these logs can help identify unauthorized access and suspicious behavior. Security teams should monitor important cloud events and correlate them with identity, endpoint, and network telemetry when possible. Disabling audit logs or sharing administrative accounts reduces accountability and visibility. Cloud monitoring should also include appropriate retention, access protection, alerting, and time synchronization to support effective investigations.

Question 253

What is the main security benefit of multifactor authentication?

1. Eliminates all phishing attacks
2. Removes the need for passwords
3. Adds an additional authentication factor
4. Prevents every account compromise

Correct Answer: 4

Explanation

Multifactor authentication, or MFA, improves account security by requiring users to provide multiple authentication factors rather than relying on a single credential. Factors may include something the user knows, something the user has, or something the user is. MFA can reduce the impact of stolen passwords because an attacker may still need another authentication factor. However, MFA does not eliminate every account compromise, particularly when attackers use techniques such as session theft, MFA fatigue, or social engineering. Strong, phishing-resistant MFA provides additional protection against credential-based attacks.

Question 254

Which type of threat intelligence is most useful for identifying specific malicious IP addresses and file hashes?

1. Strategic
2. Tactical
3. Technical
4. Operational

Correct Answer: 3

Explanation

Technical threat intelligence focuses on specific technical indicators associated with malicious activity. Examples include IP addresses, domain names, URLs, file hashes, email addresses, and other indicators of compromise. Security teams can use these indicators in detection systems, SIEM rules, endpoint tools, firewalls, and other controls. Strategic intelligence generally addresses broader business-level trends and risks, while tactical intelligence often focuses on attacker techniques and procedures. Operational intelligence can provide information about active campaigns and adversary activities. Technical intelligence is therefore especially useful for direct detection and blocking.

Question 255

Which action is most appropriate when a confirmed compromised endpoint is actively communicating with an attacker?

1. Increase its screen brightness
2. Isolate the endpoint
3. Delete all logs immediately
4. Disable every security control

Correct Answer: 2

Explanation

Isolating a confirmed compromised endpoint can prevent continued communication with attacker infrastructure and reduce the risk of lateral movement or additional damage. Endpoint isolation should be performed according to the organization’s incident response procedures and with consideration for business impact. Security teams should preserve relevant evidence before taking actions that could destroy useful forensic information when circumstances permit. Deleting logs would remove valuable evidence, while disabling security controls would increase risk. Containment should limit the incident while allowing investigators to continue analyzing the compromised system appropriately.

Question 256

Which attack technique involves moving from one compromised system to another within a network?

1. Lateral movement
2. Reconnaissance
3. Exfiltration
4. Initial access

Correct Answer: 1

Explanation

Lateral movement occurs when an attacker moves from one compromised system or account to additional systems within an environment. Attackers may use stolen credentials, remote services, administrative tools, or other techniques to expand their access. Detecting lateral movement often requires correlating authentication events, endpoint activity, network connections, and privilege changes. Reconnaissance generally involves gathering information before or during an attack, while exfiltration concerns unauthorized data transfer. Initial access describes techniques used to gain an initial foothold. Limiting privileges and segmenting networks can reduce lateral movement opportunities.

Question 257

Which control can restrict network access based on the security status of a connecting device?

1. NAC
2. DNS
3. RAID
4. SMTP

Correct Answer: 4

Explanation

Network Access Control, or NAC, can evaluate devices before or during network access and apply policies based on factors such as device identity, authentication status, security posture, or compliance state. An organization may require a device to have approved security software, current updates, or specific configuration settings before granting access. DNS resolves domain names, RAID provides storage redundancy, and SMTP is used for email transmission. NAC can help prevent unmanaged or noncompliant devices from gaining unrestricted access to sensitive network resources.

Question 258

What does the principle of separation of duties help prevent?

1. Excessive log retention
2. One person controlling an entire sensitive process
3. Network congestion
4. Duplicate backups

Correct Answer: 2

Explanation

Separation of duties divides sensitive responsibilities among multiple individuals so that one person does not have complete control over a critical process. For example, the person who approves a financial transaction may be different from the person who executes it. This reduces the risk of fraud, abuse, and unauthorized changes. Separation of duties differs from least privilege, which limits the permissions granted to an individual or system. Organizations may combine both principles to strengthen access control and reduce the likelihood that a single compromised account can perform an entire sensitive operation.

Question 259

Which web attack attempts to execute malicious script code in a victim’s browser?

1. SQL injection
2. SSRF
3. Cross-site scripting
4. Directory traversal

Correct Answer: 3

Explanation

Cross-site scripting, or XSS, occurs when an attacker causes malicious script content to execute in a victim’s web browser. Depending on the type and context, XSS may allow attackers to steal session information, manipulate web pages, or perform actions using the victim’s browser context. Input validation, output encoding, content security policies, and secure application development practices can help reduce XSS risk. SQL injection targets database queries, SSRF abuses server-side requests, and directory traversal attempts to access files outside an intended directory.

Question 260

Which recovery objective defines the maximum acceptable amount of data loss measured in time?

1. RTO
2. MTTR
3. MTTD
4. RPO

Correct Answer: 1

Explanation

Recovery Point Objective, or RPO, defines the maximum acceptable amount of data loss measured in time. For example, an organization with an RPO of one hour should have recovery mechanisms capable of restoring data to a point no more than approximately one hour before an incident. RTO, or Recovery Time Objective, instead defines how quickly a service or system should be restored. MTTR measures the time associated with repair or recovery, while MTTD measures the time required to detect an incident. RPO is therefore closely connected to backup and replication strategies.