View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.

 

Question 161

Which security control can detect and block malicious network traffic?

1. DHCP
2. NTP
3. IDS
4. IPS

Correct Answer: 4

Explanation

An Intrusion Prevention System (IPS) monitors network traffic and can take automated action against traffic identified as malicious. Depending on its configuration, an IPS may block connections, drop packets, or otherwise prevent detected attacks. This differs from an Intrusion Detection System (IDS), which primarily detects and alerts on suspicious activity without automatically blocking it. IPS solutions can help defend against known exploits, malicious traffic patterns, and certain network attacks. Security teams should tune detection rules carefully to reduce false positives and avoid blocking legitimate business traffic.

Question 162

What is the main purpose of security log retention?

1. Preserve information for future investigation
2. Increase processor speed
3. Prevent phishing emails
4. Replace endpoint protection

Correct Answer: 1

Explanation

Security log retention ensures that important event records remain available for a defined period so analysts can investigate incidents, identify historical activity, and satisfy organizational or regulatory requirements. Retained logs can help reconstruct attack timelines and determine whether suspicious activity occurred before an incident was detected. Organizations should establish retention periods based on business needs, legal requirements, storage capacity, and security objectives. Logs should also be protected against unauthorized modification or deletion because compromised or incomplete records can significantly reduce their usefulness during investigations.

Question 163

Which type of malware encrypts files and demands payment for recovery?

1. Spyware
2. Rootkit
3. Ransomware
4. Adware

Correct Answer: 3

Explanation

Ransomware is malware that commonly encrypts files or systems and demands payment in exchange for restoring access. Modern ransomware attacks may also involve data theft and threats to publish stolen information. Security teams can reduce ransomware risk through secure backups, endpoint protection, network segmentation, least privilege, patch management, and user awareness. During an incident, analysts should isolate affected systems quickly while following evidence-preservation procedures. Organizations should maintain tested backups because relying on attackers to restore access does not provide a dependable recovery strategy.

Question 164

Which access control model assigns permissions based on a user’s job function?

1. ABAC
2. RBAC
3. DAC
4. MAC

Correct Answer: 2

Explanation

Role-Based Access Control (RBAC) assigns permissions according to predefined roles associated with job responsibilities. For example, a database administrator may receive permissions needed to manage databases, while a standard employee receives only the access required for normal work. RBAC simplifies access management by allowing administrators to manage permissions through roles rather than individually configuring every user. Organizations should regularly review role assignments because outdated roles can result in excessive privileges. RBAC also supports least privilege when roles are designed carefully and permissions are appropriately limited.

Question 165

Which security activity identifies attack paths against an application before exploitation occurs?

1. Data backup
2. Threat modeling
3. Log rotation
4. Account provisioning

Correct Answer: 2

Explanation

Threat modeling identifies potential threats, attack paths, trust boundaries, and weaknesses during the design or development of a system. Security teams can analyze how an attacker might interact with an application, access sensitive information, bypass controls, or abuse legitimate functionality. Finding these risks early allows developers to implement safeguards before deployment. Threat modeling can support decisions involving authentication, authorization, encryption, input validation, and network architecture. It should be revisited when significant application functionality, architecture, or data flows change.

Question 166

Which log would be most useful when investigating suspicious outbound web requests from an employee workstation?

1. Proxy log
2. DHCP log
3. Printer log
4. NTP log

Correct Answer: 1

Explanation

Proxy logs can provide valuable information about web requests made by systems and users. They may record destination domains, URLs, timestamps, source addresses, usernames, response codes, and transferred data volumes, depending on the organization’s configuration. Analysts can use this information to investigate connections to suspicious domains, malware command-and-control infrastructure, phishing sites, or unusual data transfers. Proxy logs become more useful when correlated with endpoint, DNS, authentication, and firewall data. Proper retention and accurate timestamps are important for reconstructing web-based activity during investigations.

Question 167

Which technique involves searching for attacker behavior that may not trigger existing alerts?

1. Threat hunting
2. Patch management
3. Data classification
4. Asset disposal

Correct Answer: 1

Explanation

Threat hunting is a proactive process in which analysts search for suspicious or malicious activity that automated security controls may not have detected. Hunters may begin with a hypothesis based on threat intelligence, known attacker techniques, unusual behaviors, or previous incidents. They can examine endpoint telemetry, authentication events, DNS activity, network traffic, and other data sources. Successful hunting can reveal hidden threats and improve detection capabilities. Findings may lead to new alerts, updated monitoring rules, additional indicators, or changes to defensive controls.

Question 168

What is the primary purpose of network traffic baselining?

1. Identify normal behavior for comparison
2. Disable unused accounts
3. Encrypt database files
4. Remove vulnerabilities automatically

Correct Answer: 1

Explanation

Network traffic baselining establishes a picture of normal network behavior so analysts can recognize significant deviations. A baseline may include typical traffic volumes, communication patterns, protocols, destinations, and usage times. Once normal behavior is understood, unusual activity such as unexpected outbound connections, large data transfers, or abnormal protocols can receive additional investigation. Baselines should account for legitimate changes such as business hours, seasonal activity, software updates, and new services. Poorly defined baselines can generate excessive alerts or fail to identify meaningful anomalies.

Question 169

Which attack technique attempts to obtain higher permissions than originally granted?

1. Persistence
2. Privilege escalation
3. Reconnaissance
4. Exfiltration

Correct Answer: 2

Explanation

Privilege escalation occurs when an attacker gains permissions beyond those originally assigned to an account or process. It can be vertical, such as a standard user obtaining administrator privileges, or involve unauthorized access to another user’s resources. Attackers may exploit software vulnerabilities, misconfigurations, weak permissions, or stolen privileged credentials. Security teams can reduce this risk through least privilege, patching, application control, strong authentication, and endpoint monitoring. Analysts should investigate unexpected privilege changes, suspicious administrative activity, and processes running with higher privileges than expected.

Question 170

Which technology can identify suspicious behavior across multiple security data sources using user activity patterns?

1. NAC
2. UEBA
3. RAID
4. FTP

Correct Answer: 2

Explanation

User and Entity Behavior Analytics (UEBA) analyzes behavior associated with users and entities such as devices, applications, or service accounts. It can identify unusual activity by comparing current behavior with established patterns or baselines. Examples include unexpected login locations, unusual data access, abnormal administrative actions, or atypical resource usage. UEBA can help detect compromised accounts and insider-related risks that may not match simple signature-based rules. Analysts should investigate anomalies with additional context because unusual behavior is not automatically evidence of malicious activity.

Question 171

Which vulnerability occurs when an application trusts user input without proper validation?

1. Input validation vulnerability
2. Hardware failure
3. Power interruption
4. Backup failure

Correct Answer: 1

Explanation

Input validation vulnerabilities occur when applications accept untrusted user input without properly checking whether it is safe and appropriate. Attackers may exploit weak validation to manipulate application behavior or inject malicious content. Depending on the application, insufficient validation can contribute to SQL injection, command injection, cross-site scripting, or other attacks. Developers should validate input according to expected data types, formats, lengths, and allowed values. Security testing can help identify weak validation before deployment, while application monitoring can help detect suspicious requests after deployment.

Question 172

Which process prioritizes vulnerabilities based on risk and business impact?

1. Vulnerability management
2. File compression
3. Network routing
4. Password synchronization

Correct Answer: 1

Explanation

Vulnerability management includes identifying, assessing, prioritizing, remediating, and validating security weaknesses. Prioritization should consider factors such as vulnerability severity, exploit availability, system exposure, asset importance, existing controls, and potential business impact. Treating every vulnerability identically can waste resources because some weaknesses present significantly greater risk than others. Security teams should establish clear remediation priorities and deadlines. After remediation, affected systems should be rescanned or otherwise validated to confirm that vulnerabilities have been addressed successfully.

Question 173

Which security mechanism verifies that a file has not changed unexpectedly?

1. Hash comparison
2. Load balancing
3. DNS forwarding
4. Network segmentation

Correct Answer: 1

Explanation

Hash comparison can help determine whether a file’s contents have changed. A cryptographic hash is calculated from the file, and the resulting value can be compared with a previously trusted hash. If the values differ, the file contents have changed. This technique is commonly used in file integrity monitoring, malware investigations, and forensic analysis. Hashes do not explain why a file changed or who changed it, so analysts need additional information such as timestamps, process activity, user accounts, and system logs to understand the event.

Question 174

Which control helps protect sensitive information from being sent through unauthorized channels?

1. DLP
2. DHCP
3. NAT
4. NTP

Correct Answer: 1

Explanation

Data Loss Prevention (DLP) controls help identify and prevent unauthorized transmission of sensitive information. DLP policies can inspect data moving through email, web applications, endpoints, cloud services, or removable media, depending on the organization’s implementation. Policies may use data classifications, keywords, patterns, labels, or other identifiers to recognize protected information. Security teams can configure actions such as blocking, alerting, encrypting, or requiring approval. DLP should be carefully tuned because overly broad policies can interrupt legitimate business activities and create excessive alerts.

Question 175

Which attack attempts to trick a victim into revealing confidential information through deception?

1. Social engineering
2. Port scanning
3. Packet fragmentation
4. Network segmentation

Correct Answer: 1

Explanation

Social engineering manipulates people into performing actions or revealing information that benefits an attacker. Common examples include phishing, pretexting, impersonation, baiting, and fraudulent support requests. Attackers often use urgency, authority, fear, or familiarity to influence victims. Security awareness training can help users recognize suspicious requests, but technical controls such as MFA, email filtering, identity verification, and least privilege are also important. Analysts investigating social-engineering incidents should examine communication records, affected accounts, authentication events, and any sensitive information that may have been disclosed.

Question 176

Which security concept assumes that no user or device should automatically be trusted?

1. Zero Trust
2. Open authentication
3. Flat networking
4. Implicit trust

Correct Answer: 1

Explanation

Zero Trust is a security approach based on continuously verifying users, devices, applications, and access requests rather than automatically trusting entities because they are inside a network. Access decisions can consider identity, device posture, location, resource sensitivity, and other contextual factors. Least privilege and segmentation are commonly used alongside Zero Trust principles. The goal is to limit unnecessary access and reduce the potential impact of compromised accounts or devices. Implementing Zero Trust generally involves multiple technologies and processes rather than a single security product.

Question 177

Which type of malware is designed to hide its presence by modifying or interacting with low-level system components?

1. Rootkit
2. Adware
3. Worm
4. Spyware

Correct Answer: 1

Explanation

A rootkit is malware designed to conceal its presence and potentially maintain privileged access to a system. Rootkits may manipulate operating-system components, processes, files, or other low-level mechanisms to evade detection. Because they can operate deeply within a system, detecting them may require specialized tools and forensic techniques. Security teams can reduce rootkit risk through secure configurations, patching, endpoint protection, integrity monitoring, and restricted administrative access. If a rootkit is strongly suspected, organizations may need to consider rebuilding affected systems from trusted sources.

Question 178

Which metric measures how quickly a security team responds after detecting an incident?

1. MTTD
2. MTTR
3. MTTA
4. RPO

Correct Answer: 3

Explanation

Mean Time to Acknowledge (MTTA) measures the average time between the generation or detection of an alert and the point when the security team acknowledges it and begins handling the event. A lower MTTA can indicate that alerts are being reviewed promptly. Organizations can improve MTTA through effective alert routing, staffing, prioritization, automation, and well-defined escalation procedures. MTTA differs from MTTD, which measures how long it takes to detect an event, and MTTR, which generally measures the time required to resolve or recover from an incident.

Question 179

Which protocol is commonly used to securely administer a remote Linux server?

1. Telnet
2. FTP
3. SSH
4. HTTP

Correct Answer: 3

Explanation

Secure Shell (SSH) provides encrypted remote administration and command-line access to systems. It protects authentication credentials and session data from being transmitted in plaintext across the network. SSH can use passwords, public-key authentication, or other authentication mechanisms depending on configuration. Security teams should restrict SSH access to authorized users, disable unnecessary authentication methods, use strong keys or credentials, and monitor login activity. Limiting exposure through firewalls or network segmentation can further reduce the attack surface of remote administration services.

Question 180

Which phase of incident response focuses on restoring systems to normal operation?

1. Recovery
2. Preparation
3. Identification
4. Containment

Correct Answer: 1

Explanation

The recovery phase focuses on restoring affected systems and services to normal operation after the threat has been contained and removed. Activities may include rebuilding systems, restoring clean backups, validating security controls, monitoring restored assets, and gradually returning services to production. Recovery should be performed carefully to ensure that attackers no longer have access and that vulnerabilities exploited during the incident have been addressed. Teams should document recovery actions and monitor systems afterward because reinfection or recurring unauthorized activity may indicate incomplete eradication.