View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 261

Which security tool is designed to detect and block malicious network traffic in real time?

1. Proxy server
2. IDS
3. IPS
4. SIEM

Correct Answer: 4

Explanation

An Intrusion Prevention System, or IPS, monitors network traffic and can automatically block or prevent malicious activity based on configured detection rules. Unlike an IDS, which primarily detects and alerts on suspicious traffic, an IPS is positioned to take preventive action. A SIEM collects and correlates security events, while a proxy server intermediates network connections and may enforce access policies. IPS technology can help stop known attack patterns, exploit attempts, and other malicious traffic before it reaches protected systems.

Question 262

What is the primary purpose of asset inventory?

1. Identify and track organizational assets
2. Encrypt sensitive files
3. Analyze malware behavior
4. Prevent phishing emails

Correct Answer: 1

Explanation

Asset inventory provides an organization with an accurate record of its hardware, software, cloud resources, applications, and other technology assets. Security teams need this visibility to determine which systems require monitoring, patching, vulnerability assessment, and security controls. Unknown or unmanaged assets can introduce significant risk because they may be exposed without appropriate protection. Asset inventory does not directly encrypt files, analyze malware, or prevent phishing. Maintaining accurate inventory information also helps organizations understand ownership, business purpose, location, and criticality of systems.

Question 263

An analyst discovers that an account has suddenly received administrative privileges. What should be investigated first?

1. Network bandwidth
2. Privilege escalation activity
3. Backup compression
4. DNS caching

Correct Answer: 3

Explanation

Unexpected administrative privileges can indicate privilege escalation, unauthorized account modification, or misuse of an existing administrative account. The analyst should examine identity and access logs, account changes, authentication activity, administrative actions, and the reason for the privilege assignment. If the change was unauthorized, the account may have been compromised or an attacker may have gained elevated permissions. Network bandwidth and DNS caching are generally unrelated to privilege changes. Prompt investigation is important because elevated privileges can allow attackers to modify systems, access sensitive information, or establish persistence.

Question 264

Which protocol is commonly used to securely administer a remote Linux server?

1. Telnet
2. FTP
3. SSH
4. HTTP

Correct Answer: 2

Explanation

SSH, or Secure Shell, provides encrypted remote access and administration for systems such as Linux servers. It protects authentication credentials and session data while allowing administrators to execute commands remotely. Telnet also provides remote access but transmits information without strong encryption and is therefore unsuitable for secure administration. FTP is primarily used for file transfers, while HTTP is designed for web communication. Security teams should also monitor SSH activity for unusual login attempts, unfamiliar source addresses, brute-force attacks, and unexpected administrative sessions.

Question 265

Which indicator may suggest that a system is communicating with a command-and-control server?

1. Repeated connections to a suspicious external domain
2. A successful local backup
3. A normal software update
4. A routine printer connection

Correct Answer: 4

Explanation

Repeated connections to a suspicious external domain can indicate communication with command-and-control infrastructure. Analysts should examine the destination, connection frequency, DNS activity, network protocol, timing, and associated processes on the endpoint. Command-and-control communication may allow attackers to issue instructions, maintain persistence, or transfer information. A legitimate software update or normal printer connection may also generate network traffic but should be evaluated within its expected context. Correlating network and endpoint telemetry helps determine whether suspicious outbound communication is actually malicious.

Question 266

Which technique is commonly used to discover open ports and services on a target system?

1. Data classification
2. Port scanning
3. File hashing
4. Log normalization

Correct Answer: 3

Explanation

Port scanning is used to identify open ports and potentially determine which network services are accessible on a system. Security professionals may use authorized scanning during vulnerability assessments and penetration tests to identify unnecessary or exposed services. Attackers can also perform port scanning during reconnaissance to identify potential entry points. File hashing verifies data integrity, data classification categorizes information, and log normalization standardizes collected events. Organizations should monitor unauthorized scanning because unexpected reconnaissance activity may indicate preparation for a later attack.

Question 267

Which process helps ensure that security controls continue to work as intended?

1. Control validation
2. Data deletion
3. Password sharing
4. Network compression

Correct Answer: 1

Explanation

Control validation involves testing security controls to determine whether they continue to function as expected. Organizations may validate firewall rules, detection mechanisms, access controls, endpoint protections, backups, and other security measures. Validation can identify configuration errors, ineffective rules, expired controls, or gaps caused by environmental changes. Simply deploying a security control does not guarantee that it remains effective over time. Regular testing and validation help security teams confirm that controls provide the expected protection and identify areas requiring adjustment or improvement.

Question 268

What is the primary purpose of a proxy server in security monitoring?

1. Synchronize system clocks
2. Inspect and control web traffic
3. Store password hashes
4. Replace endpoint protection

Correct Answer: 2

Explanation

A proxy server acts as an intermediary between clients and external services and can provide visibility and control over web traffic. Security teams may use proxy logs to investigate requested URLs, source users, destination domains, timestamps, and other information. Proxies can also enforce access policies, filter websites, and help detect suspicious communication. A proxy does not replace endpoint protection or synchronize system clocks. When investigating possible malware or data exfiltration, analysts can correlate proxy activity with DNS, firewall, and endpoint telemetry.

Question 269

Which attack attempts to make a database execute unintended SQL commands?

1. CSRF
2. XSS
3. SQL injection
4. SSRF

Correct Answer: 3

Explanation

SQL injection occurs when an application improperly incorporates untrusted input into database queries, allowing attackers to manipulate the intended SQL commands. Successful exploitation can potentially expose, modify, or delete database information and may sometimes enable further compromise. Secure coding techniques such as parameterized queries and prepared statements help prevent SQL injection. XSS targets browser-side script execution, CSRF abuses a user’s authenticated session, and SSRF causes a server to make unintended requests. Web application logs and WAF alerts can provide useful evidence when investigating suspected SQL injection attempts.

Question 270

Which activity is part of the preparation phase of incident response?

1. Restoring compromised systems
2. Removing malware
3. Creating response procedures
4. Investigating attacker infrastructure

Correct Answer: 4

Explanation

The preparation phase occurs before a security incident and focuses on ensuring that an organization is ready to respond effectively. Activities can include creating incident response plans, developing playbooks, assigning responsibilities, training personnel, configuring monitoring tools, and ensuring required forensic and response resources are available. Restoring systems belongs primarily to recovery, while removing malware is associated with eradication. Investigating attacker infrastructure generally occurs during incident analysis. Strong preparation can reduce response delays and help security teams handle incidents consistently.

Question 271

Which type of analysis examines a suspicious file by executing it in a controlled environment?

1. Dynamic analysis
2. Static analysis
3. Source-code review
4. Hash analysis

Correct Answer: 1

Explanation

Dynamic analysis involves executing a suspicious file in a controlled environment and observing its behavior. Analysts may monitor processes, file modifications, registry changes, network connections, system calls, and other activities generated during execution. Sandboxes are commonly used to isolate malware while collecting this information. Static analysis examines a file without executing it, while hash analysis primarily provides an identifier for comparison. Dynamic analysis can reveal behaviors that may not be obvious from inspecting a file’s structure alone, making it useful for malware investigations.

Question 272

Which security measure reduces the risk of unauthorized access if a password is stolen?

1. Network segmentation
2. Multifactor authentication
3. File compression
4. Log rotation

Correct Answer: 2

Explanation

Multifactor authentication adds another verification requirement beyond a password, reducing the likelihood that stolen credentials alone will provide access. Depending on the implementation, the additional factor may be a hardware security key, authenticator application, biometric factor, or another approved method. MFA is not an absolute guarantee against compromise because attackers may use phishing, session theft, or social engineering to bypass or abuse authentication mechanisms. Nevertheless, properly implemented MFA significantly strengthens account security compared with password-only authentication.

Question 273

What does a false negative represent in security detection?

1. A legitimate event incorrectly marked malicious
2. A malicious event incorrectly missed
3. A duplicate alert
4. A successfully blocked attack

Correct Answer: 4

Explanation

A false negative occurs when malicious activity is present but a security control fails to detect it. False negatives are particularly concerning because attackers may remain undetected while continuing their activities. A false positive is the opposite situation, where legitimate activity is incorrectly identified as malicious. Security teams can reduce false negatives by improving detection logic, adding telemetry, tuning thresholds, threat hunting, and regularly validating controls. Analysts should balance detection sensitivity with operational requirements because overly aggressive rules can increase false positives and alert fatigue.

Question 274

Which control is most useful for identifying unauthorized data transfers through email?

1. DLP
2. NTP
3. NAC
4. DHCP

Correct Answer: 3

Explanation

Data Loss Prevention can monitor email communications for sensitive information and apply organizational policies to unauthorized transfers. DLP systems may inspect message content, attachments, recipients, classifications, and other attributes to identify potential data leakage. Depending on policy, an organization may block, quarantine, alert on, or log a suspicious message. NTP handles time synchronization, NAC controls network access, and DHCP provides network configuration. Email-focused DLP is particularly useful for reducing accidental or intentional disclosure of confidential information through corporate messaging systems.

Question 275

Which threat intelligence activity involves collecting, processing, analyzing, and distributing relevant intelligence?

1. Intelligence lifecycle
2. Patch management
3. Network segmentation
4. File recovery

Correct Answer: 2

Explanation

The threat intelligence lifecycle describes the process organizations use to turn collected information into useful intelligence. Common stages include planning or requirements, collection, processing, analysis, dissemination, and feedback. The goal is to provide relevant information that supports security decisions and detection activities. Patch management focuses on updating vulnerable software, network segmentation separates systems, and file recovery restores information after loss. A well-managed intelligence lifecycle helps ensure that intelligence is relevant, timely, actionable, and aligned with the organization’s security requirements.

Question 276

Which vulnerability occurs when an attacker causes a server to make unintended requests to another system?

1. XSS
2. SSRF
3. CSRF
4. SQL injection

Correct Answer: 1

Explanation

Server-Side Request Forgery, or SSRF, occurs when an attacker manipulates a vulnerable server into making requests to unintended destinations. Depending on the environment, an attacker may attempt to access internal services, cloud metadata endpoints, or other resources that are not directly accessible from the internet. SSRF defenses can include strict URL validation, allowlists, network restrictions, and limiting the privileges available to application components. XSS targets browser execution, CSRF abuses authenticated user sessions, and SQL injection targets database queries.

Question 277

Which log source is most useful for investigating repeated failed login attempts?

1. Authentication logs
2. Printer logs
3. Temperature logs
4. Backup logs

Correct Answer: 4

Explanation

Authentication logs record events related to user sign-ins, including successful and failed authentication attempts, usernames, source addresses, timestamps, and authentication methods. Analysts can use these records to identify brute-force attempts, password spraying, unusual login locations, and compromised accounts. Authentication data can also be correlated with endpoint and network information to determine whether suspicious access was successful. Printer, temperature, and backup logs generally do not provide the detailed identity information required to investigate repeated login failures.

Question 278

What is the primary purpose of a vulnerability remediation plan?

1. Increase the number of vulnerabilities
2. Define how identified weaknesses will be addressed
3. Disable vulnerability scanning
4. Remove asset inventories

Correct Answer: 2

Explanation

A vulnerability remediation plan defines how identified security weaknesses will be addressed. It may include the responsible team, remediation method, priority, target completion date, affected assets, validation requirements, and escalation procedures. Plans help organizations track vulnerabilities from identification through resolution and verification. Remediation can involve patching software, changing configurations, replacing unsupported systems, implementing compensating controls, or removing unnecessary services. Disabling scanning or removing asset inventories would reduce visibility rather than address the underlying weaknesses.

Question 279

Which activity is an example of reconnaissance?

1. Encrypting a backup
2. Restoring a server
3. Gathering information about exposed services
4. Removing malware

Correct Answer: 3

Explanation

Reconnaissance involves gathering information about a target before or during an attack. An attacker may identify domains, IP addresses, open ports, exposed services, technologies, employees, or other publicly available information. This information can help determine potential attack paths. Security professionals may also perform authorized reconnaissance during assessments to identify exposures from an attacker’s perspective. Encrypting backups, restoring systems, and removing malware are defensive or recovery activities rather than reconnaissance. Monitoring unexpected reconnaissance can help organizations identify potential early-stage attack activity.

Question 280

Which security control provides a second layer of protection when another control fails?

1. Defense in depth
2. Data normalization
3. Log deletion
4. Credential sharing

Correct Answer: 1

Explanation

Defense in depth uses multiple complementary security controls so that the failure or bypass of one control does not automatically result in complete compromise. An organization may combine network segmentation, endpoint protection, identity controls, firewalls, monitoring, encryption, and application security measures. Each layer provides a different opportunity to prevent, detect, or limit an attack. This approach reduces dependence on a single security mechanism. Data normalization improves log consistency, while log deletion and credential sharing weaken security rather than providing additional defensive layers.