View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 21

Which security tool is primarily used to collect and correlate logs from multiple sources?

1. SIEM
2. VPN
3. Proxy
4. NAC

Correct Answer: 1

Explanation

A Security Information and Event Management system, or SIEM, collects security logs and events from multiple sources and correlates them for centralized analysis. Sources can include firewalls, servers, endpoints, authentication systems, cloud services, and applications. Correlation helps analysts identify relationships between events that may appear unrelated when viewed separately. SIEM platforms can also provide alerting, dashboards, search capabilities, and reporting. Effective implementation requires appropriate log collection and normalization so analysts can investigate suspicious activity efficiently and distinguish meaningful security events from routine system activity.

Question 22

What is the primary purpose of threat hunting?

1. Configure firewalls
2. Proactively search for threats
3. Install operating systems
4. Create user accounts

Correct Answer: 2

Explanation

Threat hunting is a proactive security activity in which analysts search through systems, networks, logs, and other data sources for signs of malicious activity that automated security controls may have missed. Instead of waiting for an alert, threat hunters develop hypotheses based on known attacker behaviors, threat intelligence, and unusual activity. They may investigate indicators such as suspicious processes, unexpected authentication, unusual network connections, or persistence mechanisms. Effective threat hunting can uncover stealthy threats and improve detection rules by identifying previously overlooked patterns.

Question 23

Which vulnerability is caused by inserting malicious commands into an application’s database query?

1. XSS
2. SQL injection
3. CSRF
4. DDoS

Correct Answer: 2

Explanation

SQL injection occurs when an application improperly handles untrusted input that becomes part of a database query. An attacker may manipulate that input to alter the intended query and potentially access, modify, or delete unauthorized information. Parameterized queries and prepared statements are among the primary defenses against SQL injection. Security analysts should also consider input validation, secure coding practices, and database account privileges. During vulnerability assessment, applications that dynamically construct SQL statements from user-controlled input should receive particular attention because improper handling can create significant security exposure.

Question 24

Which authentication method requires more than one type of verification?

1. Single sign-on
2. Multifactor authentication
3. Password hashing
4. Account federation

Correct Answer: 2

Explanation

Multifactor authentication, or MFA, requires users to provide multiple authentication factors from different categories. These categories generally include something the user knows, something the user has, and something the user is. For example, a password combined with a hardware token or authenticator application provides stronger protection than a password alone. MFA can significantly reduce the impact of stolen passwords because an attacker also needs the additional factor. Security teams should still monitor authentication activity because attackers may attempt methods such as phishing or session theft to bypass MFA.

Question 25

An analyst notices a workstation making connections to an unfamiliar external domain every five minutes. What should be investigated?

1. Possible command-and-control activity
2. Printer configuration
3. Screen resolution
4. Local disk capacity

Correct Answer: 1

Explanation

Regular connections to an unfamiliar external domain can be a potential indicator of command-and-control activity. Malware may periodically contact attacker-controlled infrastructure to receive instructions, send information, or maintain communication. Analysts should investigate the destination domain, DNS history, associated IP addresses, process responsible for the connection, timestamps, and network traffic. The behavior does not automatically prove compromise because legitimate applications can also communicate periodically with external services. Correlating endpoint telemetry, DNS records, proxy logs, and threat intelligence can help determine whether the connection is suspicious.

Question 26

Which security assessment actively attempts to exploit identified vulnerabilities?

1. Vulnerability scan
2. Penetration test
3. Log review
4. Configuration audit

Correct Answer: 2

Explanation

A penetration test actively attempts to exploit vulnerabilities in a controlled and authorized manner to determine whether weaknesses can actually be used to compromise systems or achieve specific objectives. This differs from a vulnerability scan, which primarily identifies potential weaknesses without necessarily exploiting them. Penetration testing can provide information about attack paths, security-control effectiveness, and potential business impact. Because exploitation can affect systems and data, penetration tests should have clearly defined scope, authorization, rules of engagement, and safety procedures before testing begins.

Question 27

Which attack uses previously leaked username and password combinations against multiple websites?

1. Credential stuffing
2. Brute force
3. Phishing
4. Privilege escalation

Correct Answer: 1

Explanation

Credential stuffing uses previously compromised username and password combinations to attempt access to other services. It relies on password reuse rather than guessing passwords from scratch. Attackers may automate large numbers of login attempts against online services using credentials obtained from previous breaches. Multifactor authentication, unique passwords, breached-password detection, rate limiting, and monitoring can reduce the effectiveness of credential-stuffing attacks. Analysts should investigate unusual authentication patterns, especially when the same accounts show login attempts from unfamiliar locations, devices, or addresses.

Question 28

Which control can prevent unauthorized devices from connecting to a corporate network?

1. NAC
2. SIEM
3. DLP
4. Honeypot

Correct Answer: 1

Explanation

Network Access Control, or NAC, can enforce policies that determine whether devices are allowed to connect to a network. NAC solutions may evaluate characteristics such as device identity, authentication status, security configuration, or compliance state before granting access. Organizations can use NAC to restrict unmanaged or noncompliant devices and place them into appropriate network segments. This provides an additional layer of protection against unauthorized network access. NAC is different from SIEM, which focuses on collecting and analyzing security events rather than directly controlling network admission.

Question 29

What does a CVSS score help security teams determine?

1. User password age
2. Vulnerability severity
3. Network bandwidth
4. Backup duration

Correct Answer: 2

Explanation

The Common Vulnerability Scoring System, or CVSS, provides a standardized method for expressing the severity of vulnerabilities. Its scoring framework considers characteristics related to exploitability and impact, helping organizations compare vulnerabilities and prioritize remediation. A CVSS score should not be treated as the only factor in deciding remediation priority. Organizations should also consider asset criticality, exposure, available exploits, business impact, and compensating controls. Using CVSS alongside organizational context helps security teams determine which vulnerabilities require immediate attention and which can be addressed through normal remediation cycles.

Question 30

Which log would provide information about connections allowed or blocked by a firewall?

1. Application log
2. Firewall log
3. Database log
4. Authentication log

Correct Answer: 2

Explanation

Firewall logs record network traffic that the firewall permits, blocks, or otherwise processes according to configured security rules. These logs can include source and destination addresses, ports, protocols, timestamps, and action results. Analysts can use firewall logs to investigate suspicious connections, policy violations, scanning activity, and attempted access to restricted services. When investigating an incident, firewall data can be correlated with endpoint, DNS, authentication, and application logs to build a broader timeline. Proper log retention and filtering are important for effective network-security investigations.

Question 31

Which security control is designed to prevent sensitive information from leaving an organization?

1. DLP
2. DHCP
3. NAT
4. NTP

Correct Answer: 1

Explanation

Data Loss Prevention, or DLP, is designed to identify and prevent unauthorized transmission or exposure of sensitive information. DLP controls can inspect data in locations such as endpoints, email, cloud services, and network channels. Policies may identify sensitive information using content patterns, classifications, labels, or other indicators. Depending on configuration, DLP can alert security teams, block transfers, or require additional authorization. Effective DLP requires carefully designed policies because overly broad rules can generate excessive alerts and interfere with legitimate business activities.

Question 32

What is the purpose of a honeypot?

1. Store production backups
2. Attract and monitor attackers
3. Encrypt databases
4. Manage software licenses

Correct Answer: 2

Explanation

A honeypot is a deliberately designed system or service intended to attract and observe unauthorized activity. Because legitimate users generally have no reason to interact with it, activity against a honeypot can be a useful indicator of reconnaissance, exploitation, or attempted compromise. Security teams can analyze the activity to learn about attacker techniques and improve detection capabilities. Honeypots should be carefully isolated from production systems so that an attacker cannot use them as a pathway into important resources. They are primarily detection and intelligence tools.

Question 33

Which technique involves trying common passwords against many different accounts?

1. Credential stuffing
2. Password spraying
3. SQL injection
4. Hashing

Correct Answer: 2

Explanation

Password spraying involves trying a small number of commonly used passwords against many accounts rather than attempting many passwords against a single account. Attackers use this technique to avoid triggering account lockout thresholds that might be activated by repeated failures against one user. Analysts can detect password spraying by looking for similar failed authentication attempts across multiple accounts, particularly when they originate from the same source or occur within a short timeframe. Multifactor authentication, strong password policies, monitoring, and rate limiting can help reduce this threat.

Question 34

Which activity examines systems to determine whether their configurations comply with security requirements?

1. Configuration assessment
2. Data recovery
3. Threat hunting
4. Packet capture

Correct Answer: 1

Explanation

A configuration assessment examines systems against defined security requirements, benchmarks, policies, or recommended configurations. It can identify issues such as unnecessary services, weak security settings, excessive permissions, or missing protective controls. Security teams can use configuration assessments to identify deviations from approved baselines and determine which systems require corrective action. Regular assessments are especially useful because configurations can change over time due to software updates, administrative actions, or application requirements. Findings should be documented, prioritized, remediated, and validated after changes are implemented.

Question 35

Which incident response activity focuses on determining what happened and how the attacker gained access?

1. Recovery
2. Forensic investigation
3. User provisioning
4. Patch management

Correct Answer: 2

Explanation

Forensic investigation focuses on collecting and analyzing evidence to determine what happened during a security incident. Analysts may examine endpoint artifacts, logs, network traffic, memory, files, authentication records, and other sources to reconstruct an attack timeline. The investigation can help identify the initial access method, attacker actions, affected systems, and persistence mechanisms. Evidence should be handled carefully to preserve its integrity and support accurate conclusions. Findings from forensic analysis can also help organizations improve security controls and prevent similar incidents from recurring.

Question 36

Which type of malware disguises itself as legitimate software?

1. Worm
2. Trojan
3. Ransomware
4. Rootkit

Correct Answer: 2

Explanation

A Trojan is malware that disguises itself as legitimate or useful software to persuade users or systems to execute it. Once installed, it may perform malicious activities such as stealing information, downloading additional malware, establishing persistence, or providing unauthorized access. Unlike worms, Trojans generally do not rely on self-replication as their primary propagation mechanism. Security teams can reduce Trojan infections through application controls, endpoint protection, user awareness, software verification, and monitoring for unusual processes or network connections following software installation.

Question 37

What is the primary purpose of a security baseline?

1. Define an approved configuration standard
2. Increase internet speed
3. Replace vulnerability scanning
4. Store incident reports

Correct Answer: 1

Explanation

A security baseline defines an approved configuration or minimum security standard for systems and devices. It can specify requirements for settings such as services, authentication, logging, encryption, software, and access controls. Comparing systems against a baseline helps organizations identify configuration drift and security weaknesses. Baselines should reflect organizational requirements and applicable security standards rather than being treated as permanent configurations. As technologies and threats change, security teams should review and update baselines. Automated compliance tools can help identify systems that no longer meet the required configuration.

Question 38

Which technology can block malicious network traffic based on configured security rules?

1. IDS
2. IPS
3. SIEM
4. Scanner

Correct Answer: 2

Explanation

An Intrusion Prevention System, or IPS, monitors network traffic and can automatically block or prevent activity identified as malicious according to configured detection and prevention rules. This distinguishes an IPS from a traditional IDS, which primarily detects suspicious activity and generates alerts. IPS technologies can use signatures, behavioral indicators, protocol analysis, or other detection mechanisms. Security teams must tune IPS rules carefully because overly aggressive controls can block legitimate traffic. Analysts should also investigate prevention events to determine whether they indicate an attempted attack or a false positive.

Question 39

Which practice helps determine whether a security alert is a false positive?

1. Ignoring the alert
2. Correlating additional evidence
3. Disabling all logging
4. Removing the affected user

Correct Answer: 2

Explanation

Correlating additional evidence helps analysts determine whether a security alert represents a genuine threat or a false positive. An analyst may compare the alert with endpoint activity, authentication logs, network traffic, DNS requests, user behavior, and threat intelligence. For example, an unusual login may initially appear suspicious but become explainable after confirming that the user was traveling or using an approved VPN. Analysts should avoid dismissing alerts without investigation. Proper alert validation improves detection accuracy and helps security teams focus their resources on meaningful threats.

Question 40

Which action should occur before performing an authorized penetration test?

1. Delete security logs
2. Establish rules of engagement
3. Disable all backups
4. Remove network segmentation

Correct Answer: 2

Explanation

Rules of engagement define how an authorized penetration test will be conducted. They can specify the testing scope, systems and applications included, permitted techniques, testing windows, communication procedures, emergency contacts, and actions that are prohibited. Establishing these rules helps prevent accidental disruption and ensures that testers and system owners understand their responsibilities. Formal authorization should also be obtained before testing begins. Clear rules protect both the organization and the testing team while providing boundaries for safely evaluating the effectiveness of security controls.