View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 341

Which security tool is designed to collect and correlate events from multiple sources?

1. Vulnerability scanner
2. SIEM
3. Password manager
4. Load balancer

Correct Answer: 2

Explanation

A Security Information and Event Management (SIEM) platform collects security events and logs from multiple sources and correlates them to identify suspicious activity. It can ingest data from firewalls, endpoints, authentication systems, servers, applications, and network devices. Correlation rules can connect seemingly unrelated events and generate alerts for analysts. A vulnerability scanner identifies weaknesses, a password manager stores credentials securely, and a load balancer distributes network traffic. SIEM platforms provide centralized visibility that helps security teams investigate incidents and identify patterns across different systems.

Question 342

What is the primary purpose of network segmentation?

1. Reduce lateral movement
2. Increase password length
3. Detect phishing emails
4. Calculate CVSS scores

Correct Answer: 1

Explanation

Network segmentation divides a network into separate security zones or segments and restricts communication between them. One major benefit is limiting lateral movement after an attacker compromises a system. For example, a compromised workstation may be prevented from directly communicating with sensitive database servers. Segmentation can also reduce the potential impact of security incidents and support access control requirements. Password policies, phishing detection, and CVSS scoring address different security objectives. Properly implemented segmentation creates additional security boundaries that attackers must overcome when moving through an environment.

Question 343

An analyst receives thousands of alerts generated by a single detection rule. What should be investigated first?

1. Asset inventory
2. Encryption settings
3. Alert tuning
4. Backup retention

Correct Answer: 3

Explanation

When one detection rule generates an excessive number of alerts, analysts should investigate whether the rule requires tuning. Excessive alerts may result from overly broad conditions, legitimate activity being incorrectly classified, duplicate events, or an unsuitable threshold. Alert tuning can reduce false positives and improve the signal-to-noise ratio for security analysts. Asset inventory and backup retention are important security functions but do not directly address excessive alert volume. Encryption settings also serve a different purpose. Effective tuning helps security teams focus attention on alerts that are more likely to represent genuine threats.

Question 344

Which technique involves using legitimate administrative tools to perform malicious actions?

1. Phishing
2. Living off the land
3. Credential stuffing
4. Port scanning

Correct Answer: 2

Explanation

Living off the land refers to attacker activity that abuses legitimate tools, utilities, or functionality already available on a compromised system. Examples can include PowerShell, Windows Management Instrumentation, command-line utilities, or scripting interpreters. Because these tools may normally be used by administrators, their activity can be difficult to distinguish from legitimate operations. Phishing relies on social engineering, credential stuffing uses previously stolen credentials against multiple accounts, and port scanning probes network services. Analysts should examine unusual command-line activity, parent-child processes, execution context, and user behavior when investigating potential living-off-the-land activity.

Question 345

Which document defines the permitted activities and limitations of a penetration test?

1. Security baseline
2. Incident report
3. Rules of engagement
4. Data retention policy

Correct Answer: 3

Explanation

Rules of engagement define the scope, boundaries, permissions, communication procedures, and restrictions for a penetration test. They may specify target systems, testing windows, prohibited techniques, emergency contacts, and procedures for handling unexpected findings. Establishing these rules helps ensure that authorized testing does not unintentionally disrupt production systems or exceed the approved scope. A security baseline defines expected configurations, an incident report documents an event, and a data retention policy specifies how long information should be preserved. Rules of engagement therefore provide the operational boundaries for penetration testing.

Question 346

A company wants to prevent employees from sending sensitive files through personal email. Which control is most appropriate?

1. NAC
2. IDS
3. DLP
4. NTP

Correct Answer: 3

Explanation

Data Loss Prevention (DLP) controls are designed to identify and prevent unauthorized transmission or exposure of sensitive information. A DLP solution can inspect email content and attachments for patterns associated with confidential data and block, quarantine, or alert on policy violations. NAC controls network access, IDS detects suspicious network activity, and NTP synchronizes system clocks. DLP policies can be configured around data classifications, keywords, file types, or other characteristics. This makes DLP particularly suitable for preventing employees from transmitting sensitive files through unauthorized email channels.

Question 347

Which attack attempts to manipulate a database by inserting malicious SQL statements into application input?

1. SQL injection
2. Buffer overflow
3. SSRF
4. CSRF

Correct Answer: 1

Explanation

SQL injection occurs when an attacker inserts malicious SQL statements into application input that is improperly handled by the application. If successful, the attacker may retrieve, modify, delete, or otherwise interact with database information beyond the application’s intended functionality. Proper input validation, parameterized queries, prepared statements, and secure database permissions can help reduce this risk. Buffer overflows involve memory handling, SSRF abuses server-side requests, and CSRF tricks authenticated users into performing unintended actions. SQL injection specifically targets the interaction between an application and its backend database.

Question 348

Which cloud security capability provides records of administrative actions performed within a cloud environment?

1. Vulnerability scanning
2. Cloud activity logging
3. File hashing
4. Application allowlisting

Correct Answer: 2

Explanation

Cloud activity logging records actions performed within cloud environments, such as creating resources, modifying permissions, changing security settings, or accessing services. These logs can help analysts investigate unauthorized activity and determine which account performed a particular action and when it occurred. Cloud activity logs are particularly useful for detecting suspicious administrative behavior and supporting incident investigations. Vulnerability scanning identifies weaknesses, file hashing verifies file integrity, and application allowlisting controls executable software. Properly configured cloud logging provides important visibility into account and resource activity that may otherwise be difficult to investigate.

Question 349

What is the main purpose of a vulnerability assessment?

1. Exploit every discovered weakness
2. Restore compromised systems
3. Identify and evaluate security weaknesses
4. Encrypt vulnerable applications

Correct Answer: 3

Explanation

A vulnerability assessment identifies and evaluates security weaknesses in systems, applications, networks, or devices. Scanners and other assessment techniques can identify missing patches, insecure configurations, outdated software, and known vulnerabilities. The results help organizations prioritize remediation according to factors such as severity, asset criticality, exposure, and exploitability. A vulnerability assessment does not necessarily attempt to exploit every weakness; that is more closely associated with penetration testing. Restoring systems belongs to recovery activities, while encryption is a security control rather than the primary purpose of vulnerability assessment.

Question 350

An attacker gains access to a system and creates a scheduled task that launches malware every day. What objective does this demonstrate?

1. Persistence
2. Reconnaissance
3. Exfiltration
4. Discovery

Correct Answer: 1

Explanation

Persistence refers to techniques attackers use to maintain access to a compromised system even after reboots, logouts, or other interruptions. Creating a scheduled task that automatically launches malware is a common example because the malicious program can execute repeatedly without requiring the attacker to manually reconnect. Reconnaissance involves gathering information about potential targets, while discovery focuses on learning about systems, accounts, or resources after access. Exfiltration involves stealing or transferring data outside the environment. Analysts should investigate unexpected scheduled tasks and determine their creator, commands, timing, and associated files.

Question 351

Which technology can automatically isolate an infected endpoint from the network?

1. EDR
2. DNS
3. DHCP
4. NAT

Correct Answer: 1

Explanation

Endpoint Detection and Response (EDR) platforms commonly provide endpoint isolation capabilities. When suspicious or malicious activity is detected, an analyst can use the EDR platform to isolate the affected device from most network communications while maintaining a management connection for investigation and remediation. This can help prevent malware from spreading or communicating with command-and-control infrastructure. DNS resolves domain names, DHCP assigns network configuration information, and NAT translates network addresses. EDR therefore provides a direct mechanism for responding to endpoint threats while supporting investigation and containment.

Question 352

Which factor should receive significant consideration when prioritizing vulnerabilities for remediation?

1. Screen resolution
2. Asset criticality
3. Keyboard layout
4. Operating system wallpaper

Correct Answer: 2

Explanation

Asset criticality is an important factor when prioritizing vulnerability remediation because vulnerabilities affecting essential or sensitive systems may create greater organizational risk. For example, a medium-severity vulnerability on a business-critical server could require faster attention than a higher-severity issue on an isolated test system. Other factors can include exploit availability, internet exposure, data sensitivity, and compensating controls. Screen resolution, keyboard layout, and wallpaper have no meaningful role in vulnerability risk prioritization. Combining technical severity with business context allows security teams to allocate remediation resources more effectively.

Question 353

Which protocol is commonly used to securely transfer files over an SSH connection?

1. FTP
2. Telnet
3. SFTP
4. TFTP

Correct Answer: 3

Explanation

Secure File Transfer Protocol (SFTP) provides file transfer capabilities over an SSH connection, offering encryption and authenticated communication. It is commonly used when files need to be transferred securely between systems across potentially untrusted networks. Traditional FTP does not provide encryption by default, Telnet is an insecure remote-access protocol, and TFTP is a lightweight file transfer protocol without the security features associated with SFTP. Security teams may use SFTP for transferring sensitive files, logs, configuration data, or forensic artifacts while reducing the risk of credentials and transferred information being exposed.

Question 354

A security team uses a fake server to attract attackers and observe their behavior. What is this system called?

1. Proxy
2. Honeypot
3. Firewall
4. VPN gateway

Correct Answer: 2

Explanation

A honeypot is a deliberately configured system designed to attract or detect unauthorized activity. It can imitate a legitimate server, service, or application while generating valuable security telemetry when someone interacts with it. Because legitimate users should normally have little or no reason to access the honeypot, activity against it can be highly suspicious. Analysts can use honeypot data to study attacker behavior, identify tools, collect indicators, and improve detection capabilities. Proxies forward traffic, firewalls enforce network access policies, and VPN gateways provide secure remote connectivity.

Question 355

Which evidence should be collected first when volatile memory may contain valuable forensic information?

1. RAM contents
2. Archived logs
3. Printed reports
4. Old backups

Correct Answer: 1

Explanation

RAM is volatile evidence because its contents can disappear when a system is powered off or restarted. Memory may contain active processes, network connections, encryption keys, injected code, credentials, and other information that may not be available in persistent storage. Therefore, when memory evidence is important, investigators generally prioritize capturing it before actions that could alter or destroy its contents. Archived logs and backups remain available after shutdown, while printed reports are not volatile evidence. Proper procedures should be followed during memory acquisition to preserve evidence integrity and document the collection process.

Question 356

What is the primary purpose of data classification?

1. Assign sensitivity levels to information
2. Block all network traffic
3. Detect unauthorized processes
4. Scan systems for vulnerabilities

Correct Answer: 1

Explanation

Data classification organizes information according to its sensitivity, value, regulatory requirements, or business importance. Common categories may include public, internal, confidential, and restricted information. Classification helps organizations determine appropriate security controls, access requirements, retention periods, encryption needs, and handling procedures. Blocking network traffic, detecting processes, and scanning for vulnerabilities are separate security functions. Proper classification is particularly important for protecting sensitive information because it allows organizations to apply stronger controls to data that would cause greater harm if exposed, altered, or lost.

Question 357

Which attack involves sending a small amount of malicious data to trigger memory corruption in an application?

1. DNS tunneling
2. Credential stuffing
3. Buffer overflow
4. Password spraying

Correct Answer: 3

Explanation

A buffer overflow occurs when an application writes more data into a memory buffer than the allocated space can safely hold. Excess data may overwrite adjacent memory and potentially cause crashes, unexpected behavior, or code execution under certain conditions. Attackers may exploit vulnerable applications by carefully crafting input that triggers this condition. DNS tunneling involves abusing DNS communications, credential stuffing uses previously stolen credentials, and password spraying attempts a small number of common passwords against many accounts. Secure coding practices, memory protections, input validation, and timely patching can reduce buffer overflow risks.

Question 358

Which process helps determine whether a security control is operating as intended?

1. Asset discovery
2. Control validation
3. Threat intelligence collection
4. Data destruction

Correct Answer: 2

Explanation

Control validation verifies whether a security control is functioning as intended and providing the expected protection. Testing may involve reviewing configurations, examining logs, performing controlled simulations, or conducting authorized security assessments. For example, an organization may validate whether an alerting rule actually detects the activity it was designed to identify. Asset discovery identifies systems and devices, threat intelligence provides information about threats, and data destruction removes information. Regular control validation helps identify ineffective configurations, implementation gaps, and changes that may reduce the effectiveness of existing security measures.

Question 359

Which attack technique uses previously stolen username and password combinations against many websites?

1. Password spraying
2. Brute force
3. Credential stuffing
4. Privilege escalation

Correct Answer: 3

Explanation

Credential stuffing uses previously compromised username and password combinations to attempt authentication against other services. The technique relies on password reuse, making it particularly effective when users reuse credentials across multiple websites. Password spraying instead attempts a small number of commonly used passwords against many accounts, while brute-force attacks systematically attempt many password combinations against a target account or service. Privilege escalation occurs after access has been obtained and involves gaining higher permissions. Controls such as MFA, password managers, breached-password detection, and login monitoring can reduce credential-stuffing risk.

Question 360

Which incident response activity documents what happened and identifies improvements for future incidents?

1. Containment
2. Eradication
3. Recovery
4. Lessons learned

Correct Answer: 4

Explanation

The lessons-learned activity occurs after an incident and focuses on reviewing what happened, how the organization responded, what worked, and what should be improved. Teams may examine detection performance, communication, containment actions, technical controls, documentation, and response procedures. Findings can then be used to update security controls, incident response plans, playbooks, training, and monitoring rules. Containment limits the incident, eradication removes malicious activity, and recovery restores normal operations. Lessons learned help organizations improve their future response capabilities based on evidence from the completed incident.