View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 121

Which process identifies all devices connected to an organization’s network?

1. Asset discovery
2. Data classification
3. Log retention
4. File hashing

Correct Answer: 4

Explanation

Asset discovery identifies devices, systems, applications, and other resources operating within an organization’s environment. Maintaining an accurate asset inventory is important because security teams cannot effectively protect systems they do not know about. Discovery tools may identify servers, workstations, cloud resources, network devices, and other connected assets. Analysts can compare discovered assets against approved inventories to identify unauthorized or unknown systems. Regular discovery is especially useful because networks change frequently as devices are added, removed, replaced, or reconfigured.

Question 122

Which attack attempts to use stolen username and password combinations against many accounts?

1. Credential stuffing
2. Buffer overflow
3. DNS tunneling
4. Session hijacking

Correct Answer: 1

Explanation

Credential stuffing uses previously stolen username and password combinations to attempt access to other accounts. Attackers rely on password reuse because users frequently reuse credentials across multiple services. Security teams can reduce this risk through multifactor authentication, breached-password detection, strong authentication policies, and monitoring for unusual login activity. Credential stuffing differs from password spraying, where attackers typically try a small number of commonly used passwords against many accounts. Analysts should investigate unusual authentication patterns, repeated failures, and successful logins from unexpected locations or devices.

Question 123

What is the primary purpose of a security baseline?

1. Increase system storage
2. Define an approved secure configuration
3. Replace vulnerability scanning
4. Disable system logging

Correct Answer: 2

Explanation

A security baseline defines the approved configuration and security settings that systems are expected to maintain. Baselines may specify password policies, enabled services, firewall settings, logging requirements, software versions, and other controls. Analysts can compare current configurations against the baseline to identify configuration drift or unauthorized changes. Establishing consistent baselines helps reduce unnecessary attack surfaces and improves security management across large environments. Baselines should be reviewed periodically because business requirements, technologies, threats, and organizational security standards can change over time.

Question 124

Which tool is commonly used to capture and analyze network packets?

1. Wireshark
2. Word processor
3. Password manager
4. Backup utility

Correct Answer: 1

Explanation

Wireshark is a packet-analysis tool that allows analysts to capture and inspect network traffic. It can display protocol information, source and destination addresses, ports, packet contents, and communication sequences. Security professionals may use packet captures to investigate suspicious connections, malware communication, protocol problems, or potential data exfiltration. Packet analysis requires understanding normal network behavior so unusual traffic can be identified accurately. Analysts should also consider encryption because encrypted traffic may limit visibility into the contents even though metadata such as addresses and ports remains observable.

Question 125

Which attack involves secretly intercepting communication between two parties?

1. DDoS
2. Password spraying
3. Man-in-the-middle
4. SQL injection

Correct Answer: 3

Explanation

A man-in-the-middle attack occurs when an attacker positions themselves between communicating parties and intercepts or potentially modifies their traffic. Depending on the situation, the attacker may attempt to steal credentials, session information, or other sensitive data. Strong encryption, certificate validation, secure network configurations, and properly secured wireless connections can reduce this risk. Analysts investigating suspected interception should examine network paths, certificate warnings, unusual gateway behavior, wireless configurations, and unexpected traffic patterns. Secure protocols help prevent attackers from reading or modifying protected communications.

Question 126

What does CVSS primarily provide?

1. A vulnerability severity score
2. A malware signature
3. A network topology
4. A user authentication method

Correct Answer: 1

Explanation

The Common Vulnerability Scoring System (CVSS) provides a standardized method for representing the severity of vulnerabilities. Scores are calculated using characteristics related to exploitability and impact, helping organizations compare vulnerabilities consistently. CVSS can support prioritization, but a score should not be the only factor considered when deciding remediation order. Asset importance, exposure, exploit availability, compensating controls, and business impact can also influence risk. Security teams commonly combine CVSS information with vulnerability-management data to determine which weaknesses require more immediate attention.

Question 127

Which incident response phase focuses on removing malware and attacker access from affected systems?

1. Identification
2. Preparation
3. Eradication
4. Recovery

Correct Answer: 3

Explanation

Eradication focuses on removing the root cause and remaining traces of an incident from affected systems. Activities may include deleting malicious files, removing persistence mechanisms, disabling compromised accounts, eliminating unauthorized access, and addressing exploited vulnerabilities. Analysts should confirm that the threat has been removed before systems are returned to normal operation. Eradication differs from containment, which focuses on limiting the incident’s spread, and recovery, which focuses on restoring systems and services. Proper documentation of eradication activities also supports later review and lessons learned.

Question 128

Which security control can restrict devices from connecting to a corporate network based on policy?

1. NAC
2. DNS
3. NTP
4. SMTP

Correct Answer: 1

Explanation

Network Access Control (NAC) can enforce policies that determine whether devices are permitted to connect to a network. NAC solutions may evaluate device identity, security posture, authentication status, operating system information, or compliance with organizational requirements. Noncompliant devices can be denied access or placed into a restricted network segment for remediation. NAC helps organizations prevent unmanaged or insecure endpoints from obtaining normal network access. Its effectiveness depends on accurate policies, reliable device identification, and appropriate integration with authentication and network infrastructure.

Question 129

Which attack technique attempts to execute unauthorized commands through application input?

1. Credential stuffing
2. Command injection
3. DDoS
4. Shoulder surfing

Correct Answer: 2

Explanation

Command injection occurs when an application improperly handles user-supplied input and allows an attacker to execute unintended operating-system commands. This vulnerability can result from unsafe input handling, insecure command construction, or inadequate validation. Successful exploitation may allow attackers to access files, execute programs, change configurations, or compromise the underlying system. Developers can reduce the risk through secure coding practices, strict input validation, safe APIs, least privilege, and avoiding unnecessary shell execution. Security analysts should investigate suspicious command execution and application requests for possible exploitation attempts.

Question 130

What is the primary purpose of threat hunting?

1. Proactively search for malicious activity
2. Replace incident documentation
3. Install operating systems
4. Increase database storage

Correct Answer: 1

Explanation

Threat hunting is a proactive security activity in which analysts search environments for signs of malicious or suspicious behavior that automated controls may have missed. Hunters may develop hypotheses based on threat intelligence, attacker techniques, unusual behavior, or known indicators. They can investigate endpoint activity, authentication events, network traffic, and other telemetry. Threat hunting can uncover previously undetected activity and improve defensive capabilities. Findings may lead to new detection rules, improved monitoring, updated indicators, or changes to security controls.

Question 131

Which technology can automatically respond to security alerts using predefined workflows?

1. SOAR
2. FTP
3. DHCP
4. RAID

Correct Answer: 1

Explanation

Security Orchestration, Automation, and Response (SOAR) platforms can automate repetitive security tasks and coordinate actions across multiple security tools. A SOAR workflow may receive an alert, enrich it with threat intelligence, identify affected systems, create a ticket, and initiate predefined containment actions. Automation can reduce response time and repetitive manual work. However, workflows should be carefully tested because incorrect automation can disrupt legitimate systems or users. Security teams should establish appropriate approval requirements for high-impact actions before allowing them to execute automatically.

Question 132

Which email authentication mechanism helps receiving servers verify the authorized sending infrastructure?

1. SPF
2. FTP
3. SNMP
4. SSH

Correct Answer: 1

Explanation

Sender Policy Framework (SPF) allows a domain owner to specify which mail servers are authorized to send email on behalf of that domain. Receiving mail systems can check the sender’s infrastructure against the published SPF policy. SPF can help reduce certain forms of domain spoofing, although it does not independently provide complete protection against phishing. Organizations often use SPF alongside DKIM and DMARC for stronger email authentication. Analysts investigating suspicious messages can examine authentication results and email headers for additional evidence of spoofing or impersonation.

Question 133

Which security practice reduces the risk of attackers exploiting outdated software?

1. Patch management
2. Port mirroring
3. Data compression
4. Load balancing

Correct Answer: 1

Explanation

Patch management involves identifying, testing, deploying, and verifying software updates that address security vulnerabilities and other issues. Keeping operating systems and applications current reduces exposure to known vulnerabilities that attackers may exploit. Organizations should prioritize patches based on factors such as vulnerability severity, exploit availability, asset exposure, and business importance. Testing is also important because poorly managed updates can cause compatibility or operational problems. After deployment, security teams should verify that patches were successfully installed and that vulnerable versions are no longer present.

Question 134

Which attack technique involves moving from one compromised system to another?

1. Persistence
2. Lateral movement
3. Reconnaissance
4. Exfiltration

Correct Answer: 2

Explanation

Lateral movement occurs when an attacker moves from an initially compromised system to additional systems within an environment. Attackers may use stolen credentials, remote services, administrative tools, or vulnerabilities to access other resources. This behavior can allow attackers to reach more valuable systems and sensitive data. Security teams can reduce lateral movement through network segmentation, least privilege, strong authentication, endpoint monitoring, and restricted administrative access. Analysts should investigate unusual remote logins, administrative activity, credential use, and unexpected connections between internal systems.

Question 135

Which control helps identify unauthorized modifications to important files?

1. File integrity monitoring
2. Network address translation
3. Load balancing
4. Spam filtering

Correct Answer: 1

Explanation

File Integrity Monitoring (FIM) detects changes to monitored files and directories by comparing current states against known trusted states. It can alert security teams when important system files, configuration files, or application components are modified unexpectedly. Unauthorized changes may indicate malware activity, privilege abuse, configuration errors, or legitimate administrative work. Analysts should investigate the user, process, timestamp, and reason associated with a detected change. FIM is particularly useful on critical servers where unauthorized modifications could affect security, availability, or application behavior.

Question 136

What is the purpose of a honeypot?

1. Attract and monitor suspicious activity
2. Encrypt all network traffic
3. Replace endpoint protection
4. Store production backups

Correct Answer: 1

Explanation

A honeypot is a system or service designed to attract and observe unauthorized or suspicious activity. Because legitimate users generally should not interact with it, activity involving a honeypot can provide useful indicators for security monitoring and threat analysis. Honeypots can help analysts study attacker techniques and identify scanning, exploitation, or unauthorized access attempts. They must be carefully isolated from production systems so attackers cannot use them as a pathway into the real environment. Security teams should document and monitor honeypot activity consistently.

Question 137

Which concept describes reducing the number of exposed services and entry points on a system?

1. Attack surface reduction
2. Data aggregation
3. Log normalization
4. Traffic shaping

Correct Answer: 1

Explanation

Attack surface reduction involves minimizing the number of exposed systems, services, applications, ports, accounts, and other potential entry points available to attackers. Organizations can reduce attack surfaces by disabling unnecessary services, removing unused applications, restricting network access, closing unused ports, and applying least privilege. Reducing unnecessary exposure can make exploitation more difficult and simplify monitoring. Analysts should regularly review systems because new applications, cloud resources, and configuration changes can introduce additional exposure. Asset discovery and vulnerability management support ongoing attack surface reduction.

Question 138

Which security measure helps prevent unauthorized users from reading sensitive stored data?

1. Hashing
2. Encryption
3. Logging
4. Tokenization

Correct Answer: 2

Explanation

Encryption transforms readable data into ciphertext that requires an appropriate key to decrypt. It helps protect sensitive information when stored on devices, servers, databases, or other storage systems. Encryption is different from hashing, which is generally designed as a one-way transformation and is commonly used for integrity verification or password storage. Organizations should manage encryption keys securely because loss or compromise of keys can affect data availability or confidentiality. Analysts should verify that sensitive data is encrypted according to organizational security requirements and applicable policies.

Question 139

Which attack uses a malicious script executed in a victim’s web browser?

1. SQL injection
2. Command injection
3. Cross-site scripting
4. Buffer overflow

Correct Answer: 3

Explanation

Cross-site scripting (XSS) occurs when an attacker causes malicious script content to execute in a victim’s browser through a vulnerable web application. Depending on the type of XSS and application behavior, attackers may attempt to steal session information, manipulate page content, or perform actions within the victim’s browser context. Developers can reduce XSS risks through proper input handling, output encoding, content security policies, and secure application design. Analysts investigating XSS should review application requests, parameters, logs, affected pages, and suspicious script payloads.

Question 140

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

1. MTTR
2. RTO
3. RPO
4. MTTD

Correct Answer: 3

Explanation

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. For example, an organization with an RPO of one hour should have recovery mechanisms capable of limiting potential data loss to approximately that period under the defined recovery scenario. RPO is different from Recovery Time Objective (RTO), which defines how quickly a service or system should be restored. Security and continuity teams use these objectives to design backup schedules, replication strategies, and recovery procedures appropriate to business requirements.