View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 141

Which security control helps detect suspicious behavior on an endpoint?

1. DHCP
2. EDR
3. NAT
4. RAID

Correct Answer: 2

Explanation

Endpoint Detection and Response (EDR) monitors endpoint activity such as processes, files, network connections, and system changes. It can detect suspicious behavior and provide analysts with detailed information for investigation. EDR platforms may also support response actions such as terminating malicious processes or isolating compromised systems. Unlike traditional antivirus solutions that may focus heavily on known signatures, EDR can provide broader behavioral visibility. Security teams should properly configure EDR policies and review alerts to identify potential attacks while minimizing unnecessary false positives.

Question 142

What is the main purpose of log normalization?

1. Convert logs into a consistent format
2. Delete old security events
3. Encrypt every network packet
4. Prevent software installation

Correct Answer: 1

Explanation

Log normalization converts information from different log sources into a consistent structure and format. Organizations collect logs from firewalls, servers, applications, endpoints, cloud services, and other systems, but each source may use different field names and formats. Normalization allows security tools to interpret and correlate these events more effectively. It improves searching, automated analysis, and detection-rule development. Without normalization, analysts may have difficulty comparing events from different systems. SIEM platforms commonly use normalization to make large amounts of security data easier to analyze.

Question 143

Which technique involves gathering information about a target before an attack?

1. Persistence
2. Reconnaissance
3. Exfiltration
4. Recovery

Correct Answer: 2

Explanation

Reconnaissance is the process of gathering information about a target before attempting an attack. Attackers may collect information about domains, IP addresses, employees, technologies, public services, and organizational infrastructure. Reconnaissance can be passive, such as researching publicly available information, or active, such as interacting directly with target systems. Security teams can reduce exposure by limiting unnecessary public information and monitoring suspicious scanning activity. Analysts may also use threat intelligence and OSINT techniques to understand what information about their own organization is publicly available.

Question 144

Which authentication attack tries many passwords against one account?

1. Password spraying
2. Credential stuffing
3. Brute force
4. Session hijacking

Correct Answer: 3

Explanation

A brute-force attack attempts many possible passwords against a single account or authentication mechanism. Attackers may use automated tools to test large numbers of password combinations until a valid credential is discovered. Account lockout policies, rate limiting, strong passwords, multifactor authentication, and monitoring can reduce this risk. Password spraying is different because it generally uses a small number of common passwords against many accounts, while credential stuffing uses previously compromised username-password combinations. Analysts should examine authentication logs for repeated failures and unusual login patterns.

Question 145

Which protocol is commonly used to synchronize system clocks across a network?

1. DNS
2. FTP
3. NTP
4. LDAP

Correct Answer: 3

Explanation

Network Time Protocol (NTP) synchronizes system clocks across networked devices. Accurate time synchronization is important for cybersecurity because analysts rely on timestamps when correlating events from multiple systems. If clocks are significantly different, it can become difficult to reconstruct an attack timeline or determine the sequence of events. Organizations should use trusted time sources and monitor systems for synchronization problems. NTP itself should also be secured appropriately because attackers may attempt to manipulate time synchronization or abuse poorly configured time services.

Question 146

What is the primary purpose of data classification?

1. Identify data according to sensitivity and handling requirements
2. Increase network throughput
3. Replace encryption
4. Detect open ports

Correct Answer: 1

Explanation

Data classification organizes information according to its sensitivity, importance, or regulatory requirements. Common classifications may include public, internal, confidential, and restricted information. Classification helps organizations determine appropriate controls for storing, transmitting, accessing, and disposing of data. For example, highly sensitive information may require stronger encryption and stricter access controls than publicly available information. Security teams should ensure classifications are clearly defined and consistently applied. Poor classification can result in sensitive information receiving insufficient protection or unnecessary security controls being applied to low-risk data.

Question 147

Which attack attempts to exploit a vulnerable web server by sending malicious database queries?

1. SQL injection
2. DNS tunneling
3. Credential stuffing
4. DDoS

Correct Answer: 1

Explanation

SQL injection occurs when attackers manipulate application input to insert malicious SQL statements into database queries. If an application does not properly validate or parameterize input, an attacker may retrieve, modify, or delete database information and, in some cases, perform other unauthorized actions. Developers can reduce this risk by using parameterized queries, prepared statements, appropriate input validation, and least-privilege database accounts. Security analysts can review web application logs, database activity, and suspicious request parameters when investigating potential SQL injection attempts.

Question 148

Which control provides an additional security layer by requiring a second authentication factor?

1. RBAC
2. MFA
3. DLP
4. FIM

Correct Answer: 2

Explanation

Multifactor authentication adds additional verification beyond a traditional password. The additional factor may be something the user possesses, such as a security key, or something inherent to the user, such as a biometric characteristic. MFA can significantly reduce the impact of stolen passwords because an attacker generally needs another authentication factor. Organizations should consider phishing-resistant authentication methods when possible. Security teams should also monitor authentication events and establish secure recovery procedures because attackers may attempt to bypass MFA through social engineering or session theft.

Question 149

Which indicator can reveal that a system is communicating with a known malicious server?

1. IOC
2. RPO
3. SLA
4. VLAN

Correct Answer: 1

Explanation

An Indicator of Compromise (IOC) is an observable artifact that may indicate malicious activity or a security breach. Examples include malicious IP addresses, domain names, file hashes, suspicious filenames, or known malware-related URLs. Analysts can search endpoint, DNS, firewall, proxy, and other logs for these indicators. IOCs are useful for identifying potentially compromised systems, although they can become outdated as attackers change infrastructure. Security teams should combine IOCs with behavioral indicators and contextual information for stronger detection and investigation.

Question 150

Which security control is specifically designed to inspect web application requests?

1. IDS
2. WAF
3. VPN
4. NAC

Correct Answer: 2

Explanation

A Web Application Firewall (WAF) inspects web application traffic and can identify or block malicious HTTP and HTTPS requests. It can help defend against attacks such as SQL injection, cross-site scripting, malicious request patterns, and certain application-layer attacks. WAF rules may use signatures, request parameters, headers, URLs, or behavioral characteristics. A WAF is not a substitute for secure application development because vulnerabilities within application logic may still exist. Analysts should review WAF alerts and tune policies to balance protection with legitimate application traffic.

Question 151

What is the purpose of a security playbook?

1. Provide predefined response procedures
2. Store encrypted passwords
3. Assign IP addresses
4. Replace vulnerability scanners

Correct Answer: 1

Explanation

A security playbook provides predefined procedures for responding to a specific type of security event or incident. It may contain investigation steps, containment actions, escalation requirements, communication procedures, evidence-collection guidance, and recovery tasks. Playbooks help security teams respond consistently and reduce decision-making delays during incidents. Examples include ransomware, phishing, compromised-account, and malware-response playbooks. Organizations should test and update playbooks regularly because systems, threats, responsibilities, and response tools can change. Well-maintained playbooks also help ensure that different analysts follow consistent processes.

Question 152

Which cloud security principle gives an identity only the permissions required to perform its task?

1. Shared responsibility
2. Least privilege
3. High availability
4. Elasticity

Correct Answer: 2

Explanation

Least privilege applies to cloud identities just as it does to traditional systems. Users, applications, services, and automated workloads should receive only the permissions necessary for their intended functions. Excessive cloud permissions can allow compromised accounts to access sensitive resources, modify configurations, or create additional identities. Security teams should regularly review role assignments, service permissions, and unused privileges. Cloud identity monitoring can also help detect unusual permission changes. Applying least privilege reduces the potential impact of compromised credentials and limits unnecessary access to critical resources.

Question 153

Which analysis method examines malware while it is running?

1. Static analysis
2. Dynamic analysis
3. Code review
4. Hash comparison

Correct Answer: 2

Explanation

Dynamic analysis examines software by executing it in a controlled environment and observing its behavior. During malware analysis, analysts may monitor processes, file modifications, registry changes, network connections, and other system activity. A sandbox is commonly used to isolate the malware from production systems. Dynamic analysis can reveal behaviors that may not be obvious from examining the file itself. However, some malware detects analysis environments and changes its behavior. Analysts therefore often combine dynamic analysis with static analysis, threat intelligence, and other investigative techniques.

Question 154

A security analyst discovers an unexpected administrator account on a server. What should be investigated first?

1. Whether the account was legitimately authorized
2. The server’s screen resolution
3. The printer configuration
4. The amount of disk space

Correct Answer: 1

Explanation

An unexpected administrator account can indicate unauthorized access, persistence, misconfiguration, or legitimate administrative activity. The analyst should first determine whether the account was properly authorized by reviewing change records, account-management logs, tickets, and responsible personnel. If the account cannot be justified, further investigation should examine its creation time, creator, privileges, authentication history, and associated activity. Analysts should avoid immediately deleting potentially important evidence without following incident-response procedures. Unauthorized privileged accounts can provide attackers with persistent and powerful access to critical systems.

Question 155

Which metric measures the average time needed to restore normal operations after an incident?

1. MTTD
2. MTTR
3. CVSS
4. RPO

Correct Answer: 2

Explanation

Mean Time to Repair or Recover (MTTR) measures the average time required to restore a system or service after an incident or failure, depending on the organization’s defined measurement. Security teams can use MTTR to evaluate response and recovery efficiency. A high MTTR may indicate delays in investigation, containment, remediation, system restoration, or coordination. Organizations should define the metric consistently so results can be compared over time. MTTR is different from MTTD, which focuses on detection, and RPO, which addresses acceptable data loss.

Question 156

Which security technology monitors network traffic and can block detected malicious activity?

1. IPS
2. DNS
3. DHCP
4. NTP

Correct Answer: 1

Explanation

An Intrusion Prevention System (IPS) monitors network traffic and can automatically block or prevent activity that matches configured attack signatures or behavioral rules. IPS solutions can help defend against network-based attacks, malicious traffic, and known exploit patterns. Analysts should tune IPS rules carefully because overly aggressive detection can block legitimate traffic and generate false positives. IPS monitoring can also provide useful information for investigations, including source and destination addresses, targeted services, and attack patterns. It should operate as part of a broader defense-in-depth strategy.

Question 157

Which activity verifies that a vulnerability has been successfully fixed?

1. Remediation validation
2. Asset discovery
3. Threat modeling
4. Data classification

Correct Answer: 1

Explanation

Remediation validation confirms that a previously identified vulnerability has actually been addressed. After a patch, configuration change, software upgrade, or other remediation action, security teams can perform another scan or manual verification to determine whether the weakness remains. Simply marking a vulnerability as fixed without validation can leave systems exposed if the remediation failed or was incomplete. Validation results should be documented so vulnerability-management records accurately reflect the current security state. This process also helps identify recurring configuration or patch-management problems.

Question 158

Which technique involves using stolen session information to impersonate a legitimate user?

1. Session hijacking
2. Port scanning
3. Data destruction
4. DNS enumeration

Correct Answer: 1

Explanation

Session hijacking occurs when an attacker obtains or takes control of a valid user session and uses it to impersonate the authenticated user. Attackers may target session cookies, tokens, or other session identifiers. Strong encryption, secure cookie settings, short session lifetimes, secure application design, and appropriate session invalidation can reduce the risk. Analysts investigating possible session hijacking should examine unusual login activity, session locations, device changes, token behavior, and application logs. Compromised sessions may allow attackers to bypass some authentication steps.

Question 159

Which security process identifies potential threats before systems are deployed?

1. Incident recovery
2. Threat modeling
3. Log retention
4. Password rotation

Correct Answer: 2

Explanation

Threat modeling identifies potential threats, attack paths, vulnerabilities, and security requirements during system or application design. Security teams can examine how data flows, which components are trusted, where sensitive information is stored, and how attackers might interact with the system. Common threat-modeling approaches help teams identify risks before deployment, when changes are generally easier and less costly to make. Threat modeling supports secure design and can guide controls such as authentication, authorization, encryption, segmentation, and input validation.

Question 160

Which email security standard allows a domain owner to specify how unauthenticated messages should be handled?

1. SPF
2. DKIM
3. DMARC
4. SMTP

Correct Answer: 3

Explanation

Domain-based Message Authentication, Reporting, and Conformance (DMARC) allows domain owners to publish policies describing how receiving mail systems should handle messages that fail relevant authentication checks. DMARC works with mechanisms such as SPF and DKIM and can provide reporting information about email authentication activity. Organizations can use DMARC policies to help reduce domain spoofing and improve visibility into unauthorized email sources. Security teams should configure authentication records carefully and monitor reports before moving to stricter enforcement policies to avoid disrupting legitimate messages.