View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 301

Which security control is specifically designed to detect unauthorized wireless devices or attacks?

1. NAC
2. WAF
3. Wireless IDS
4. DLP

Correct Answer: 4

Explanation

A Wireless Intrusion Detection System, or WIDS, monitors wireless networks for suspicious activity such as rogue access points, unauthorized devices, unusual wireless traffic, and certain attack patterns. It can help security teams identify attempts to compromise wireless infrastructure or connect unauthorized devices to corporate networks. NAC focuses on controlling network access, WAF protects web applications, and DLP helps prevent unauthorized data disclosure. WIDS is particularly useful in environments where wireless connectivity is widely deployed and unauthorized access points could provide attackers with an entry point.

Question 302

What is the primary purpose of security log retention?

1. Preserve historical information for investigation and compliance
2. Prevent all malware infections
3. Encrypt endpoint storage
4. Replace vulnerability scanning

Correct Answer: 1

Explanation

Security log retention ensures that important event records remain available for a defined period so analysts can investigate incidents, identify historical patterns, support audits, and meet applicable organizational or regulatory requirements. Retained logs may include authentication events, firewall activity, endpoint telemetry, application events, and cloud activity. Retention policies should consider storage capacity, legal requirements, business needs, and the value of historical data. Log retention does not directly prevent malware or replace vulnerability scanning, but it provides important evidence when suspicious activity needs to be reconstructed.

Question 303

Which attack involves intercepting communication between two parties without their knowledge?

1. Password spraying
2. SQL injection
3. Man-in-the-middle
4. DNS tunneling

Correct Answer: 3

Explanation

A man-in-the-middle attack occurs when an attacker positions themselves between two communicating parties and intercepts or potentially alters their communication. Depending on the circumstances, the attacker may attempt to capture credentials, sensitive information, or session data. Strong encryption, certificate validation, secure protocols, and appropriate network protections can reduce the risk. Password spraying targets authentication systems, SQL injection targets database queries, and DNS tunneling abuses DNS traffic for communication or data transfer. Analysts investigating suspected interception should examine network paths, certificates, and unusual connection behavior.

Question 304

Which security practice helps ensure systems are configured according to approved organizational requirements?

1. Data exfiltration
2. Configuration management
3. Password spraying
4. Packet fragmentation

Correct Answer: 2

Explanation

Configuration management helps organizations maintain systems according to approved security and operational requirements. It involves establishing desired configurations, tracking changes, identifying configuration drift, and ensuring that unauthorized modifications are addressed. Security baselines are often used as reference points during configuration assessments. Configuration management can cover operating systems, network devices, applications, cloud resources, and security controls. Data exfiltration is an attacker activity, password spraying targets authentication, and packet fragmentation concerns network transmission. Effective configuration management reduces weaknesses caused by inconsistent or unauthorized system settings.

Question 305

An analyst discovers an unusual executable that has no known hash reputation. What should be done next?

1. Immediately assume it is harmless
2. Delete all endpoint evidence
3. Disable every security control
4. Perform additional malware analysis

Correct Answer: 4

Explanation

An unknown file hash does not prove that a file is malicious or legitimate. The analyst should perform additional analysis using available evidence such as file metadata, strings, static analysis, sandbox execution, behavioral observations, network connections, and endpoint telemetry. Hash reputation is useful when a sample is already known, but newly created or modified malware may have no reputation data. Analysts should preserve the original evidence and follow organizational procedures before executing suspicious files. Controlled analysis can provide additional information needed to determine the file’s nature and risk.

Question 306

Which security concept involves identifying possible threats against an application before development is completed?

1. Log retention
2. Threat modeling
3. Network monitoring
4. Data recovery

Correct Answer: 3

Explanation

Threat modeling identifies potential threats, attack paths, trust boundaries, assets, and security requirements during application design and development. Performing threat modeling early allows developers and security teams to address weaknesses before the application reaches production. Common activities include identifying valuable assets, considering potential attackers, mapping data flows, and determining appropriate mitigations. Log retention focuses on preserving event records, network monitoring observes activity, and data recovery restores information after loss. Threat modeling supports secure design by considering security risks before vulnerabilities become embedded in deployed applications.

Question 307

Which email security mechanism allows a domain owner to specify how receiving servers should handle messages that fail authentication checks?

1. DMARC
2. SSH
3. SPF
4. SFTP

Correct Answer: 1

Explanation

Domain-based Message Authentication, Reporting, and Conformance, or DMARC, allows a domain owner to publish a policy describing how receiving mail systems should handle messages that fail relevant authentication checks. DMARC can use SPF and DKIM authentication results and supports reporting that helps domain owners understand email authentication activity. Policies can instruct receiving systems to monitor, quarantine, or reject certain messages depending on configuration. SSH and SFTP provide secure remote access and file transfer, while SPF identifies authorized sending servers. DMARC is an important control against domain spoofing and phishing.

Question 308

What is the main purpose of a network traffic capture during an investigation?

1. Change firewall configurations
2. Examine communications for suspicious activity
3. Restore deleted files
4. Create user accounts

Correct Answer: 2

Explanation

Network traffic captures provide detailed information about communications occurring between systems. Analysts can examine source and destination addresses, ports, protocols, packet contents when available, timing, and communication patterns. This information can help identify suspicious connections, malware communication, data transfers, reconnaissance, or protocol misuse. Packet captures are especially useful when other logs do not provide sufficient detail. Capturing traffic does not itself change firewall configurations or restore files. Analysts should ensure that traffic collection is authorized and that captured information is protected because it may contain sensitive data.

Question 309

Which technique attempts to exploit a vulnerability by sending more data than a program can properly handle in a memory buffer?

1. SQL injection
2. CSRF
3. Buffer overflow
4. DNS tunneling

Correct Answer: 3

Explanation

A buffer overflow occurs when a program receives more data than the allocated memory buffer can safely handle. Depending on the vulnerability and system protections, an attacker may cause crashes, corrupt memory, or potentially execute malicious code. Secure programming practices, memory protections, input validation, and timely patching can reduce the risk. SQL injection targets database queries, CSRF abuses authenticated user actions, and DNS tunneling uses DNS communications for covert data transfer or command-and-control. Vulnerability assessments and secure code review can help identify buffer overflow risks.

Question 310

Which factor is most important when determining whether a vulnerability should receive immediate attention?

1. The color of the vulnerability report
2. The number of pages in the report
3. The analyst’s preferred tool
4. Exploitability and asset criticality

Correct Answer: 4

Explanation

Vulnerability prioritization should consider both the characteristics of the vulnerability and the importance of the affected asset. Exploitability, known exploitation activity, exposure, severity, asset criticality, business impact, and available compensating controls can influence remediation urgency. A severe vulnerability on a highly exposed critical system may require faster action than the same vulnerability on an isolated, low-value asset. The visual format of a report or an analyst’s preferred tool does not determine risk. Effective prioritization focuses resources on weaknesses that present meaningful organizational exposure.

Question 311

Which activity is an example of security automation?

1. Automatically disabling an account after confirmed malicious activity
2. Manually reviewing every event
3. Printing every firewall log
4. Rewriting every security policy

Correct Answer: 1

Explanation

Security automation uses technology to perform predefined security actions with limited manual intervention. For example, a SOAR platform may automatically disable a compromised account after a high-confidence detection, block a malicious IP address, create an incident ticket, or collect additional evidence. Automation is most effective when the trigger and response are well understood and appropriate safeguards are in place. Manual review remains important for ambiguous or high-impact decisions. Automation can reduce repetitive work, improve response speed, and help security teams apply consistent procedures.

Question 312

Which control helps prevent unauthorized devices from connecting to a corporate network?

1. File hashing
2. Network Access Control
3. Data classification
4. Log compression

Correct Answer: 2

Explanation

Network Access Control, or NAC, can enforce policies that determine whether devices are permitted to connect to organizational networks. NAC may evaluate device identity, authentication status, security configuration, operating system information, or compliance with organizational requirements. Noncompliant devices can be denied access, placed into a restricted network, or redirected for remediation. File hashing verifies data integrity, data classification categorizes information, and log compression reduces storage requirements. NAC can therefore provide an important layer of protection against unmanaged or unauthorized devices.

Question 313

What does a false positive indicate in a security detection system?

1. A malicious event was completely missed
2. A vulnerability was successfully patched
3. A legitimate event was incorrectly identified as malicious
4. An incident was fully contained

Correct Answer: 4

Explanation

A false positive occurs when a security detection incorrectly identifies legitimate activity as malicious or suspicious. High false-positive rates can create alert fatigue, consume analyst resources, and make important alerts harder to recognize. Security teams can reduce false positives by tuning detection rules, adjusting thresholds, adding contextual information, and creating appropriate exclusions for known legitimate behavior. A false negative is different because it occurs when malicious activity is missed. Detection tuning should aim to maintain useful coverage while reducing unnecessary alerts and preserving analyst attention for meaningful events.

Question 314

Which type of vulnerability results from insufficient validation of user-provided input before it is processed by an application?

1. Input validation vulnerability
2. Storage failure
3. Time synchronization error
4. Backup failure

Correct Answer: 3

Explanation

An input validation vulnerability occurs when an application accepts user-controlled data without adequately verifying that the input meets expected requirements. Attackers may exploit weak validation to inject malicious content, manipulate application behavior, or trigger vulnerabilities such as SQL injection, command injection, or cross-site scripting. Applications should validate input according to expected type, length, format, range, and context, while also applying appropriate output encoding and secure processing techniques. Storage failures, time synchronization errors, and backup failures are separate operational or infrastructure issues.

Question 315

Which security activity uses public sources to gather information about a potential threat or target?

1. Memory forensics
2. OSINT
3. Disk imaging
4. Packet reconstruction

Correct Answer: 2

Explanation

Open-Source Intelligence, or OSINT, involves collecting and analyzing information from publicly available sources. Security teams may use OSINT to research domains, organizations, exposed services, threat actors, vulnerabilities, leaked information, or publicly reported incidents. Sources can include websites, public databases, technical documentation, social media, and other openly accessible resources. OSINT can support reconnaissance analysis and threat intelligence activities, but information should be validated because public sources can contain inaccurate or outdated material. Memory forensics and disk imaging involve analyzing system evidence rather than public information.

Question 316

Which practice helps protect backups from ransomware that attempts to encrypt connected storage?

1. Keeping immutable or offline backups
2. Sharing backup administrator passwords
3. Removing backup verification
4. Connecting all backups permanently

Correct Answer: 1

Explanation

Immutable or offline backups can help protect recovery data from ransomware because attackers may be unable to modify or encrypt properly isolated backup copies. Organizations should maintain multiple backup copies, test restoration procedures, restrict administrative access, and monitor backup infrastructure for suspicious activity. Keeping every backup permanently connected and writable can allow ransomware to reach those copies after compromising an administrator or backup system. Backup protection should therefore include access controls, segmentation, immutability where appropriate, monitoring, and regular recovery testing.

Question 317

Which protocol is commonly used to synchronize clocks across networked systems?

1. FTP
2. SMTP
3. NTP
4. LDAP

Correct Answer: 4

Explanation

Network Time Protocol, or NTP, synchronizes clocks across networked systems. Accurate and consistent time is important for security monitoring because analysts rely on timestamps to correlate events from different devices and reconstruct incident timelines. Significant clock differences can make investigations more difficult and may cause events to appear out of sequence. FTP is used for file transfers, SMTP is used for email transmission, and LDAP commonly supports directory services. Organizations should monitor time synchronization and protect trusted time sources because accurate timestamps support effective logging and forensic analysis.

Question 318

What is the primary purpose of data classification?

1. Determine how information should be handled based on sensitivity
2. Identify open network ports
3. Detect malware execution
4. Synchronize system clocks

Correct Answer: 2

Explanation

Data classification categorizes information according to characteristics such as sensitivity, confidentiality, business value, or regulatory requirements. Common classifications may include public, internal, confidential, and restricted information. Classification helps organizations determine appropriate security controls for storing, transmitting, accessing, and disposing of information. For example, highly sensitive information may require stronger encryption, stricter access controls, and additional monitoring. Data classification does not identify open ports, detect malware execution, or synchronize system clocks. It provides a foundation for applying security protections according to the value and sensitivity of information.

Question 319

Which technique involves using legitimate operating system tools to perform malicious actions without introducing obvious third-party malware?

1. Credential stuffing
2. Phishing
3. Living off the land
4. Port scanning

Correct Answer: 3

Explanation

Living off the land involves abusing legitimate tools and capabilities already present on a system to perform malicious activities. Attackers may use utilities such as PowerShell, Windows Management Instrumentation, command shells, scripting engines, or other administrative tools. This approach can make detection more difficult because the tools themselves are legitimate and may be used regularly by administrators. Analysts should therefore examine context, command-line arguments, parent-child process relationships, user privileges, and unusual execution patterns rather than automatically treating every use of a legitimate administrative tool as malicious.

Question 320

Which document formally defines the permitted scope and limitations of a penetration test?

1. Security baseline
2. Rules of engagement
3. Asset inventory
4. Data classification policy

Correct Answer: 1

Explanation

Rules of engagement define the authorized scope, methods, targets, timing, communication procedures, and limitations for a penetration test or other security assessment. They help ensure that testing is performed safely and within approved boundaries. The document may specify systems that can be tested, prohibited activities, emergency contacts, and procedures for handling discovered sensitive information. A security baseline defines expected configurations, an asset inventory identifies organizational assets, and a data classification policy defines information-handling requirements. Clear rules of engagement reduce operational and legal risks during authorized testing.