{"id":14096,"date":"2026-09-16T12:44:09","date_gmt":"2026-09-16T12:44:09","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=14096"},"modified":"2026-09-16T12:44:09","modified_gmt":"2026-09-16T12:44:09","slug":"comptia-cysa-cs0-003-practice-test-questions-and-exam-dumps-part19-q361-380","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-cysa-cs0-003-practice-test-questions-and-exam-dumps-part19-q361-380\/","title":{"rendered":"CompTIA CYSA+ CS0-003 Practice Test Questions and Exam Dumps Part19 Q361-380"},"content":{"rendered":"

<\/h1>\n

View Full <\/b>CompTIA CS0-003 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 361<\/b><\/h3>\n

Which technology analyzes endpoint activity to detect and respond to suspicious behavior?<\/b><\/p>\n

    \n
  1. EDR<\/span><\/li>\n
  2. DHCP<\/span><\/li>\n
  3. NAT<\/span><\/li>\n
  4. FTP<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Endpoint Detection and Response (EDR) continuously monitors endpoint activity such as processes, files, network connections, and user actions. It can identify suspicious behavior, generate alerts, collect investigation data, and support response actions such as isolating an affected endpoint. EDR is useful for detecting malware, credential theft, persistence, and other endpoint-based attacks. DHCP assigns network configuration information, NAT translates addresses, and FTP provides file transfer functionality. EDR provides security-focused visibility and response capabilities directly on endpoints, making it valuable for both detection and incident investigation.<\/span><\/p>\n

    Question 362<\/b><\/h3>\n

    Which log source is most useful for investigating suspicious web requests to an application?<\/b><\/p>\n

      \n
    1. DNS logs<\/span><\/li>\n
    2. Web server logs<\/span><\/li>\n
    3. DHCP logs<\/span><\/li>\n
    4. NTP logs<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Web server logs record requests made to web applications and commonly contain information such as source IP addresses, requested URLs, HTTP methods, status codes, timestamps, and user agents. Analysts can use this information to investigate attacks such as SQL injection, directory traversal, command injection, and unusual authentication activity. DNS logs focus on domain resolution, DHCP logs record address assignments, and NTP logs relate to time synchronization. Web server logs therefore provide detailed visibility into requests reaching web applications and are an important source for application security investigations.<\/span><\/p>\n

      Question 363<\/b><\/h3>\n

      A security analyst wants to identify systems communicating with a suspicious domain. Which data should be reviewed first?<\/b><\/p>\n

        \n
      1. Password policies<\/span><\/li>\n
      2. Asset inventory<\/span><\/li>\n
      3. DNS query logs<\/span><\/li>\n
      4. File permissions<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        DNS query logs can show which systems requested resolution for a particular domain. When investigating a suspicious domain, analysts can search DNS records for the domain name and identify source devices, timestamps, query frequency, and potentially related domains. This information can help determine which endpoints may have interacted with malicious infrastructure. Password policies and file permissions provide useful security information but do not directly reveal DNS requests. Asset inventory can identify systems within the environment, but DNS logs provide the actual evidence of domain-resolution activity.<\/span><\/p>\n

        Question 364<\/b><\/h3>\n

        Which access control model uses attributes such as location, device type, and time of day?<\/b><\/p>\n

          \n
        1. RBAC<\/span><\/li>\n
        2. ABAC<\/span><\/li>\n
        3. DAC<\/span><\/li>\n
        4. MAC<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Attribute-Based Access Control (ABAC) makes authorization decisions using attributes associated with users, resources, actions, and environmental conditions. Examples include a user’s department, device security status, geographic location, or time of access. ABAC can therefore create detailed policies such as allowing access only from managed devices during approved hours. RBAC primarily uses predefined roles, DAC gives resource owners significant control over permissions, and MAC uses centrally enforced security classifications. ABAC is particularly useful when organizations need flexible access decisions based on multiple contextual conditions.<\/span><\/p>\n

          Question 365<\/b><\/h3>\n

          Which activity is an example of reconnaissance?<\/b><\/p>\n

            \n
          1. Deleting security logs<\/span><\/li>\n
          2. Enumerating publicly available information about a target<\/span><\/li>\n
          3. Encrypting stolen files<\/span><\/li>\n
          4. Installing persistence mechanisms<\/span><\/li>\n<\/ol>\n

            Correct Answer: 2<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Reconnaissance involves gathering information about a target before or during an attack. Attackers may collect publicly available information about domains, employees, technologies, IP addresses, organizational structure, and exposed services. This information can help identify potential attack paths. Deleting security logs is an anti-forensic activity, encrypting stolen files may be associated with ransomware or data theft, and installing persistence is used to maintain access. Security teams can also perform authorized reconnaissance to understand their own attack surface and identify publicly exposed information that could assist attackers.<\/span><\/p>\n

            Question 366<\/b><\/h3>\n

            Which security control can block known malicious web domains before users connect to them?<\/b><\/p>\n

              \n
            1. DNS filtering<\/span><\/li>\n
            2. File hashing<\/span><\/li>\n
            3. Memory acquisition<\/span><\/li>\n
            4. Patch management<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              DNS filtering can block or redirect requests for known malicious, phishing, or otherwise prohibited domains. When a user attempts to access a blocked domain, the DNS security service can prevent the domain from resolving to its intended destination or provide a controlled response. This can stop some malicious connections before a user reaches the website. File hashing verifies file integrity, memory acquisition collects volatile forensic evidence, and patch management addresses software vulnerabilities. DNS filtering is therefore a useful preventive control for reducing exposure to known malicious web infrastructure.<\/span><\/p>\n

              Question 367<\/b><\/h3>\n

              What does CVSS primarily provide?<\/b><\/p>\n

                \n
              1. A vulnerability severity score<\/span><\/li>\n
              2. A malware signature<\/span><\/li>\n
              3. A network encryption key<\/span><\/li>\n
              4. An incident response procedure<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                The Common Vulnerability Scoring System (CVSS) provides a standardized method for expressing the severity of vulnerabilities. It considers characteristics such as attack complexity, required privileges, user interaction, scope, and potential impact. Security teams can use CVSS scores as one factor when prioritizing vulnerabilities for remediation. A CVSS score does not itself identify malware, provide encryption keys, or define incident response procedures. Organizations should also consider business context, asset criticality, exploit availability, and exposure because technical severity alone does not determine the complete risk to an organization.<\/span><\/p>\n

                Question 368<\/b><\/h3>\n

                An analyst notices a user authenticating from two distant locations within a few minutes. What should be investigated?<\/b><\/p>\n

                  \n
                1. Data classification<\/span><\/li>\n
                2. Impossible travel<\/span><\/li>\n
                3. Patch status<\/span><\/li>\n
                4. File integrity<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Impossible travel is an authentication anomaly in which a user appears to log in from geographically distant locations within a timeframe that would make physical travel between them unrealistic. This can indicate stolen credentials, VPN use, cloud proxy services, or other unusual circumstances. Analysts should investigate the source IP addresses, authentication methods, device information, timestamps, and user activity before determining whether the event is malicious. Data classification, patch status, and file integrity address different security concerns. Impossible-travel detection is particularly useful for identifying potentially compromised accounts.<\/span><\/p>\n

                  Question 369<\/b><\/h3>\n

                  Which technique attempts to guess many passwords against one account?<\/b><\/p>\n

                    \n
                  1. Credential stuffing<\/span><\/li>\n
                  2. Password spraying<\/span><\/li>\n
                  3. Brute force<\/span><\/li>\n
                  4. Session hijacking<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 3<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    A brute-force attack attempts many password combinations against a particular account or authentication service. The attacker may systematically try different characters, words, or combinations until a valid password is discovered. Credential stuffing uses previously compromised credentials, while password spraying typically tests a small number of common passwords against many different accounts to avoid account lockouts. Session hijacking involves taking control of an authenticated session rather than guessing passwords. Account lockout policies, MFA, rate limiting, and monitoring for repeated authentication failures can help reduce brute-force attacks.<\/span><\/p>\n

                    Question 370<\/b><\/h3>\n

                    Which activity should occur before an organization deploys a major security control change?<\/b><\/p>\n

                      \n
                    1. Delete old logs<\/span><\/li>\n
                    2. Disable monitoring<\/span><\/li>\n
                    3. Assess potential impact<\/span><\/li>\n
                    4. Remove asset inventory<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 3<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Before deploying a major security control change, organizations should assess potential impact to understand how the change may affect systems, users, applications, and business operations. Testing in a controlled environment can help identify unexpected consequences before production deployment. This approach reduces the possibility that a security improvement will unintentionally cause outages or disable legitimate functionality. Deleting logs, disabling monitoring, or removing asset inventory would reduce visibility and increase operational risk. Change assessment and controlled testing are important parts of effective security and configuration management.<\/span><\/p>\n

                      Question 371<\/b><\/h3>\n

                      Which type of malware encrypts files and demands payment for their recovery?<\/b><\/p>\n

                        \n
                      1. Rootkit<\/span><\/li>\n
                      2. Spyware<\/span><\/li>\n
                      3. Ransomware<\/span><\/li>\n
                      4. Adware<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 3<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Ransomware is malware designed to deny access to systems or data, commonly by encrypting files and demanding payment from victims. Modern ransomware incidents may also involve data theft before encryption, creating additional pressure on victims. Rootkits are designed to maintain stealth or privileged access, spyware collects information, and adware primarily displays unwanted advertising. Security teams can reduce ransomware impact through endpoint protection, network segmentation, least privilege, secure backups, patching, application control, and effective incident response procedures.<\/span><\/p>\n

                        Question 372<\/b><\/h3>\n

                        Which backup characteristic is most important for recovering from ransomware?<\/b><\/p>\n

                          \n
                        1. Backups are isolated from normal user access<\/span><\/li>\n
                        2. Backups use the same administrator account<\/span><\/li>\n
                        3. Backups are stored only on the infected server<\/span><\/li>\n
                        4. Backups are never tested<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Backups should be protected from unauthorized modification or deletion so ransomware cannot easily encrypt or destroy them. Isolated, offline, immutable, or otherwise access-controlled backups can provide stronger protection against ransomware attacks. If backups are accessible using the same compromised administrative credentials, attackers may be able to destroy them as part of the attack. Storing backups only on the infected server also creates a single point of failure. Regular restoration testing is important because an untested backup may not provide reliable recovery when an actual incident occurs.<\/span><\/p>\n

                          Question 373<\/b><\/h3>\n

                          Which technology can detect suspicious wireless devices or unauthorized access points?<\/b><\/p>\n

                            \n
                          1. WIDS<\/span><\/li>\n
                          2. DLP<\/span><\/li>\n
                          3. WAF<\/span><\/li>\n
                          4. SIEM<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            A Wireless Intrusion Detection System (WIDS) monitors wireless networks for suspicious activity, unauthorized access points, rogue devices, and potentially malicious wireless behavior. It can help security teams identify devices that should not be operating within the organization’s wireless environment. DLP focuses on protecting sensitive information, WAF protects web applications, and SIEM aggregates and correlates security events from many sources. WIDS is particularly valuable in environments where unauthorized wireless infrastructure could provide attackers with an alternative path into the organization or expose users to malicious wireless activity.<\/span><\/p>\n

                            Question 374<\/b><\/h3>\n

                            What is the purpose of a security playbook?<\/b><\/p>\n

                              \n
                            1. Store employee passwords<\/span><\/li>\n
                            2. Define repeatable response actions<\/span><\/li>\n
                            3. Replace vulnerability scanners<\/span><\/li>\n
                            4. Encrypt all databases<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              A security playbook provides documented, repeatable procedures for responding to specific security events. It can define investigation steps, containment actions, communication requirements, escalation paths, evidence collection procedures, and recovery tasks. For example, an organization may maintain separate playbooks for phishing, ransomware, compromised accounts, or malware infections. Playbooks help analysts respond consistently and reduce uncertainty during stressful incidents. They do not replace vulnerability scanners or provide universal encryption. Well-maintained playbooks can also be updated after incidents and exercises to reflect lessons learned and improve response efficiency.<\/span><\/p>\n

                              Question 375<\/b><\/h3>\n

                              Which security principle requires users to receive only the permissions necessary for their duties?<\/b><\/p>\n

                                \n
                              1. Separation of duties<\/span><\/li>\n
                              2. Defense in depth<\/span><\/li>\n
                              3. Least privilege<\/span><\/li>\n
                              4. Non-repudiation<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 3<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Least privilege requires users, applications, and systems to receive only the permissions necessary to perform their authorized tasks. Limiting privileges reduces the potential damage caused by compromised accounts, malicious insiders, or software vulnerabilities. For example, a standard employee should not automatically receive administrator privileges if those permissions are unnecessary for their role. Separation of duties divides sensitive responsibilities among multiple individuals, defense in depth uses multiple layers of security controls, and non-repudiation supports accountability. Least privilege is therefore directly focused on minimizing unnecessary access rights.<\/span><\/p>\n

                                Question 376<\/b><\/h3>\n

                                A company discovers that an attacker deleted logs after compromising a server. What behavior should analysts investigate?<\/b><\/p>\n

                                  \n
                                1. Data classification<\/span><\/li>\n
                                2. Anti-forensic activity<\/span><\/li>\n
                                3. Vulnerability scanning<\/span><\/li>\n
                                4. Network segmentation<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 2<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Deleting or modifying security logs after gaining access can be considered anti-forensic behavior because it attempts to remove or obscure evidence of malicious activity. Attackers may clear event logs, modify timestamps, delete files, or otherwise manipulate evidence to make investigation more difficult. Analysts should examine remaining logs from centralized systems, SIEM platforms, network devices, and other sources to reconstruct events. Data classification organizes information, vulnerability scanning identifies weaknesses, and network segmentation separates network zones. Detecting anti-forensic activity can provide an important clue that an attacker attempted to conceal their actions.<\/span><\/p>\n

                                  Question 377<\/b><\/h3>\n

                                  Which analysis method executes suspicious malware in a controlled environment to observe its behavior?<\/b><\/p>\n

                                    \n
                                  1. Static analysis<\/span><\/li>\n
                                  2. Hash analysis<\/span><\/li>\n
                                  3. Dynamic analysis<\/span><\/li>\n
                                  4. Log normalization<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 3<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Dynamic malware analysis involves executing suspicious software in a controlled environment, such as a sandbox, and observing its behavior. Analysts can monitor processes, file changes, registry activity, network connections, system calls, and other actions to understand what the malware does. Static analysis examines malware without executing it, often by inspecting strings, metadata, code, or file structure. Hash analysis compares file fingerprints, while log normalization standardizes security events. Dynamic analysis is particularly useful when analysts need behavioral evidence about an unknown or suspicious executable.<\/span><\/p>\n

                                    Question 378<\/b><\/h3>\n

                                    Which cloud access practice best supports least privilege?<\/b><\/p>\n

                                      \n
                                    1. Granting every employee administrator access<\/span><\/li>\n
                                    2. Using role-based permissions<\/span><\/li>\n
                                    3. Sharing one administrative account<\/span><\/li>\n
                                    4. Disabling authentication logging<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Role-based permissions can support least privilege by assigning users only the access required for their responsibilities. In cloud environments, roles can be designed around specific tasks and services rather than providing broad administrative privileges. Sharing an administrative account reduces accountability and increases the potential impact of credential compromise. Granting everyone administrator access violates least privilege, while disabling authentication logging reduces visibility into account activity. Cloud IAM systems should also use MFA, periodic access reviews, and temporary elevated permissions where appropriate to further reduce unnecessary access.<\/span><\/p>\n

                                      Question 379<\/b><\/h3>\n

                                      Which indicator is most useful for identifying a specific malicious file?<\/b><\/p>\n

                                        \n
                                      1. File hash<\/span><\/li>\n
                                      2. Screen resolution<\/span><\/li>\n
                                      3. CPU model<\/span><\/li>\n
                                      4. Keyboard language<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        A file hash can serve as an indicator associated with a specific file because the hash is calculated from the file’s contents. Security teams can compare observed hashes against threat intelligence feeds, malware repositories, or internally identified malicious files. A matching hash can provide strong evidence that the same file has appeared elsewhere, although attackers can modify files to produce different hashes. Hardware characteristics such as CPU model and screen resolution do not uniquely identify malicious files. File hashes are therefore widely used as indicators of compromise during malware investigations.<\/span><\/p>\n

                                        Question 380<\/b><\/h3>\n

                                        Which step should follow successful remediation of a vulnerability?<\/b><\/p>\n

                                          \n
                                        1. Disable all security monitoring<\/span><\/li>\n
                                        2. Validate that the vulnerability is resolved<\/span><\/li>\n
                                        3. Delete the remediation records<\/span><\/li>\n
                                        4. Remove the affected asset from inventory<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 2<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          After remediation, security teams should validate that the vulnerability has actually been resolved. Validation may involve rescanning the affected system, reviewing the installed software version, checking configuration settings, or performing another approved verification method. Simply applying a patch or changing a configuration does not guarantee that the underlying issue has been corrected. Disabling monitoring or deleting records would reduce visibility and accountability, while removing an asset from inventory would create inaccurate asset information. Remediation validation provides evidence that the intended security improvement has been successfully implemented.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CompTIA CS0-003 Exam Dumps and Practice Test Dumps.   Question 361 Which technology analyzes endpoint activity to detect and respond to suspicious behavior? EDR DHCP NAT FTP Correct Answer: 1 Explanation Endpoint Detection and Response (EDR) continuously monitors endpoint activity such as processes, files, network connections, and user actions. It can identify suspicious […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14096"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=14096"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14096\/revisions"}],"predecessor-version":[{"id":14141,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/14096\/revisions\/14141"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=14096"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=14096"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=14096"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}