View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 41

Which security control helps identify malicious activity on an endpoint?

1. EDR
2. DHCP
3. NAT
4. DNS

Correct Answer: 1

Explanation

Endpoint Detection and Response, or EDR, continuously monitors endpoint activity and can detect suspicious processes, file behavior, network connections, and other indicators of compromise. EDR solutions provide security teams with visibility into endpoint activity and often support investigation and response actions. Analysts can use endpoint telemetry to reconstruct events and identify potentially malicious behavior. EDR differs from traditional antivirus because it generally provides broader behavioral visibility, investigation capabilities, and response functions. It is especially useful when investigating compromised workstations and servers.

Question 42

Which attack exploits a vulnerability in an application by inserting malicious script into a web page?

1. SQL injection
2. Cross-site scripting
3. Password spraying
4. ARP spoofing

Correct Answer: 2

Explanation

Cross-site scripting, or XSS, occurs when malicious script is injected into content that is later executed by a victim’s browser. Depending on the vulnerability and context, attackers may attempt to steal session information, manipulate page content, or perform actions on behalf of a victim. Input validation, output encoding, content security policies, and secure development practices can help reduce XSS risk. Analysts assessing web applications should examine how user-controlled input is processed and displayed. Different XSS types include stored, reflected, and DOM-based attacks.

Question 43

What is the main purpose of security automation?

1. Increase manual workload
2. Reduce repetitive manual tasks
3. Remove all security controls
4. Disable monitoring

Correct Answer: 2

Explanation

Security automation uses technology to perform repetitive or predictable security tasks with limited manual intervention. Examples include automatically enriching alerts, isolating compromised endpoints, blocking known malicious indicators, or creating incident tickets. Automation can help analysts respond more consistently and spend more time investigating complex incidents. However, automated actions should be carefully designed and tested because incorrect rules can create operational problems or block legitimate activity. Organizations should establish appropriate conditions, approval requirements, and rollback procedures for automated security responses.

Question 44

Which protocol is commonly used to securely transfer files over an encrypted connection?

1. FTP
2. Telnet
3. SFTP
4. TFTP

Correct Answer: 3

Explanation

SFTP, or SSH File Transfer Protocol, provides file-transfer capabilities over an encrypted SSH connection. It protects data and authentication information while they are transmitted between systems. Traditional FTP does not provide encryption by default, while Telnet is an insecure remote-access protocol that transmits information without appropriate encryption. Security analysts should identify insecure protocols during assessments and recommend secure alternatives when appropriate. SFTP is commonly used for controlled file transfers where confidentiality and secure authentication are required.

Question 45

Which technique involves analyzing malware without executing it?

1. Dynamic analysis
2. Static analysis
3. Behavioral analysis
4. Live response

Correct Answer: 2

Explanation

Static malware analysis examines malicious files without executing them. Analysts may inspect file metadata, strings, headers, imported functions, embedded content, and other characteristics to identify potential behavior or indicators. This approach can provide useful information while avoiding the risks associated with running unknown malware. Dynamic analysis, by contrast, executes the malware in a controlled environment to observe its behavior. Security analysts may combine both approaches to gain a broader understanding of malware capabilities, infrastructure, persistence methods, and potential indicators of compromise.

Question 46

An organization discovers that a critical server is missing an important security patch. What should be performed first?

1. Risk assessment and prioritization
2. Delete the server
3. Disable all network security
4. Ignore the finding

Correct Answer: 1

Explanation

A critical missing patch should be evaluated through risk assessment and prioritization before remediation planning. Analysts should consider factors such as the vulnerability’s severity, exploitability, server exposure, business importance, available mitigations, and whether active exploitation is known. Critical internet-facing systems may require faster action than isolated systems with compensating controls. After prioritization, the organization can determine the appropriate remediation approach, such as applying the patch, implementing temporary controls, or scheduling maintenance. Risk-based prioritization helps security teams use limited resources effectively.

Question 47

Which attack attempts to manipulate a user’s browser by forcing an unwanted request?

1. CSRF
2. DDoS
3. Credential stuffing
4. Brute force

Correct Answer: 1

Explanation

Cross-Site Request Forgery, or CSRF, tricks an authenticated user’s browser into sending an unintended request to a web application. If the application does not properly verify that the request was intentionally initiated by the user, an attacker may cause actions to occur using the victim’s existing authenticated session. Common defenses include anti-CSRF tokens, appropriate cookie protections, origin validation, and secure application design. Analysts evaluating web applications should examine whether state-changing requests contain sufficient protections against unauthorized cross-site requests.

Question 48

Which security activity involves collecting information about a target before an attack?

1. Reconnaissance
2. Recovery
3. Remediation
4. Containment

Correct Answer: 1

Explanation

Reconnaissance is the information-gathering stage in which an attacker or security tester learns about a target environment. Information may include domains, IP addresses, technologies, employees, exposed services, applications, and other publicly or internally available details. Security teams can also perform authorized reconnaissance to understand their own attack surface. Defensive analysts should monitor for unusual scanning and enumeration activity and minimize unnecessary exposure of sensitive information. Reconnaissance does not necessarily mean a system has been compromised, but it can provide valuable context during threat investigations.

Question 49

Which data source is especially useful for identifying suspicious DNS queries?

1. DNS logs
2. Printer logs
3. Physical access logs
4. Power-monitoring logs

Correct Answer: 1

Explanation

DNS logs record domain-resolution activity and can help analysts identify suspicious domain lookups. During an investigation, analysts may look for connections to newly registered domains, known malicious domains, unusual domain patterns, excessive failed lookups, or high volumes of requests. DNS activity can provide useful evidence of malware communication, phishing infrastructure, and command-and-control behavior. However, DNS logs should be correlated with endpoint and network data because legitimate applications can also generate unusual-looking queries. Context is important when determining whether a domain request represents malicious activity.

Question 50

What does the term attack surface describe?

1. All potential points an attacker could target
2. Only physical security controls
3. A list of employee salaries
4. Backup storage capacity

Correct Answer: 1

Explanation

An attack surface represents the collection of potential entry points, vulnerabilities, exposed services, applications, devices, identities, and other assets that an attacker could potentially target. Reducing unnecessary exposure can help reduce opportunities for exploitation. Security teams can manage the attack surface by maintaining accurate asset inventories, removing unnecessary services, patching vulnerabilities, restricting access, and monitoring externally exposed resources. Attack surfaces change over time as organizations add systems, applications, cloud services, and users, so continuous discovery and assessment are important.

Question 51

Which security control can restrict access based on a user’s role?

1. RBAC
2. NAT
3. IDS
4. DNS

Correct Answer: 1

Explanation

Role-Based Access Control, or RBAC, assigns permissions according to defined organizational roles. Instead of individually assigning every permission to every user, administrators can associate permissions with roles such as analyst, manager, developer, or administrator. Users then receive access based on their assigned role. RBAC can simplify permission management and support least privilege when roles are carefully designed. Organizations should regularly review role memberships and permissions because excessive or outdated access can create security risks. RBAC is commonly used across applications, operating systems, and cloud environments.

Question 52

Which metric measures the average time required to identify a security incident?

1. MTTR
2. MTTD
3. RPO
4. RTO

Correct Answer: 2

Explanation

Mean Time to Detect, or MTTD, measures the average amount of time between the occurrence of a security event and its detection by the organization. A lower MTTD generally indicates that monitoring and detection processes are identifying incidents more quickly. Security teams can improve detection time through effective logging, SIEM correlation, endpoint monitoring, threat intelligence, and well-tuned alerts. MTTD is different from Mean Time to Respond or Mean Time to Repair, which measure later stages of incident handling. Metrics should always be interpreted within their defined measurement period.

Question 53

Which type of analysis observes malware while it is running in a controlled environment?

1. Static analysis
2. Dynamic analysis
3. Code review
4. Configuration review

Correct Answer: 2

Explanation

Dynamic malware analysis involves executing suspicious software in a controlled environment, such as a sandbox, and observing its behavior. Analysts can monitor processes, file changes, registry modifications, network connections, system calls, and other activities to understand what the malware does. This can reveal behaviors that are difficult to determine from static inspection alone. Because executing malware can be dangerous, analysis should occur in an isolated environment with appropriate safeguards. Combining dynamic findings with static analysis can provide a more complete understanding of malicious software.

Question 54

Which control can help prevent unauthorized use of removable storage devices?

1. USB device control
2. DNS filtering
3. Network routing
4. Load balancing

Correct Answer: 1

Explanation

USB device control allows organizations to manage how removable storage devices are used on endpoints. Security policies can restrict unauthorized USB devices, permit approved devices, or block certain actions such as copying sensitive information. This can reduce risks associated with malware introduced through removable media and unauthorized data transfer. Security teams should balance protection with legitimate business requirements and maintain appropriate exception processes. Device-control policies can also be combined with endpoint security and DLP capabilities for stronger protection of organizational systems and sensitive information.

Question 55

Which process validates that a vulnerability has been successfully fixed?

1. Vulnerability validation
2. Threat modeling
3. Asset discovery
4. Network segmentation

Correct Answer: 1

Explanation

Vulnerability validation confirms that a previously identified security weakness has actually been remediated. After a patch, configuration change, or other corrective action is applied, security teams can rescan or retest the affected asset to verify that the vulnerability is no longer present. Validation is important because remediation actions can fail, be applied to the wrong system, or leave related weaknesses unresolved. A vulnerability-management process should therefore include verification rather than simply marking findings as resolved based on an administrative update or patching claim.

Question 56

Which security technique separates systems into isolated network zones?

1. Network segmentation
2. Password hashing
3. File compression
4. Data classification

Correct Answer: 1

Explanation

Network segmentation divides an environment into separate network zones and controls communication between them. Segmentation can limit lateral movement by preventing unrestricted access from one part of the network to another. For example, user workstations, servers, administrative systems, and sensitive databases can be placed in different segments with specific access rules. Analysts can also monitor traffic between segments to identify suspicious activity. Segmentation is most effective when access rules are carefully designed and unnecessary communication paths are removed rather than simply creating network boundaries without meaningful restrictions.

Question 57

What is the purpose of an indicator of compromise?

1. Identify evidence associated with a possible breach
2. Increase storage capacity
3. Configure employee benefits
4. Schedule software updates

Correct Answer: 1

Explanation

An Indicator of Compromise, or IOC, is an observable piece of evidence that may indicate malicious activity or a security breach. Examples include malicious file hashes, suspicious IP addresses, domains, unusual registry entries, or known attacker artifacts. Analysts can use IOCs during threat hunting, detection, and incident response. An IOC by itself may not prove compromise because some indicators can also appear in legitimate activity. Analysts should correlate multiple indicators and contextual information to determine whether a system has actually been affected.

Question 58

Which method provides a secure way to store passwords by transforming them into fixed-length values?

1. Encryption
2. Hashing
3. Encoding
4. Compression

Correct Answer: 2

Explanation

Hashing transforms input data into a fixed-length value using a mathematical algorithm. Passwords should generally be stored using strong password-hashing mechanisms rather than reversible encryption. Secure password storage commonly uses a unique salt and a password-hashing algorithm designed to resist guessing attacks. Hashing is intended to be one-way, meaning the original password should not be directly recovered from the stored hash. Security teams should also monitor for weak algorithms, unsalted password databases, and other implementation problems that could make stolen credential databases easier to attack.

Question 59

Which activity helps identify relationships between assets, threats, and potential attack paths?

1. Threat modeling
2. Log rotation
3. Data backup
4. Patch deployment

Correct Answer: 1

Explanation

Threat modeling is a structured process used to identify potential threats, attack paths, vulnerabilities, and security requirements within a system or application. Analysts can examine how data flows through the environment, identify trust boundaries, and determine where attackers might attempt to compromise components. Threat modeling is useful during system design as well as when evaluating existing architectures. By identifying likely attack scenarios early, organizations can introduce appropriate security controls before weaknesses become operational problems. The results can also guide testing and monitoring priorities.

Question 60

Which response action removes malicious software and attacker persistence from a compromised system?

1. Identification
2. Eradication
3. Detection
4. Preparation

Correct Answer: 2

Explanation

Eradication focuses on removing the root cause and remaining traces of an attack from affected systems. Activities can include deleting malware, removing persistence mechanisms, disabling compromised accounts, addressing exploited vulnerabilities, and rebuilding systems when necessary. Eradication generally follows containment and investigation because security teams need to understand the scope and nature of the compromise before completely removing the threat. After eradication, systems should be validated and monitored during recovery to confirm that malicious activity has stopped and that the attacker no longer maintains access.