If you are looking for free CS0-003 dumps than here we have some sample question answers available. You can prepare from our CompTIA CS0-003 exam questions notes and prepare exam with this practice test. Check below our updated CS0-003 exam dumps.
DumpsGroup are top class study material providers and our inclusive range of CS0-003 Real exam questions would be your key to success in CompTIA CompTIA CySA+ Certification Exam in just first attempt. We have an excellent material covering almost all the topics of CompTIA CS0-003 exam. You can get this material in CompTIA CS0-003 PDF and CS0-003 practice test engine formats designed similar to the Real Exam Questions. Free CS0-003 questions answers and free CompTIA CS0-003 study material is available here to get an idea about the quality and accuracy of our study material.
Sample Question 4
An employee accessed a website that caused a device to become infected with invasivemalware. The incident response analyst has:• created the initial evidence log.• disabled the wireless adapter on the device.• interviewed the employee, who was unable to identify the website that was accessed• reviewed the web proxy traffic logs.Which of the following should the analyst do to remediate the infected device?
A. Update the system firmware and reimage the hardware. B. Install an additional malware scanner that will send email alerts to the analyst. C. Configure the system to use a proxy server for Internet access. D. Delete the user profile and restore data from backup.
Answer: A
Explanation: Updating the system firmware and reimaging the hardware is the best action
to perform to remediate the infected device, as it helps to ensure that the device is restored
to a clean and secure state and that any traces of malware are removed. Firmware is a
type of software that controls the low-level functions of a hardware device, such as a
motherboard, hard drive, or network card. Firmware can be updated or flashed to fix bugs,
improve performance, or enhance security. Reimaging is a process of erasing and
restoring the data on a storage device, such as a hard drive or a solid state drive, using an
image file that contains a copy of the operating system, applications, settings, and files.
Reimaging can help to recover from system failures, data corruption, or malware infections.
Updating the system firmware and reimaging the hardware can help to remediate the
infected device by removing any malicious code or configuration changes that may have
been made by the malware, as well as restoring any missing or damaged files or settings
that may have been affected by the malware. This can help to prevent further damage,
data loss, or compromise of the device or the network. The other actions are not as
effective or appropriate as updating the system firmware and reimaging the hardware, as
they do not address the root cause of the infection or ensure that the device is fully cleaned
and secured. Installing an additional malware scanner that will send email alerts to the
analyst may help to detect and remove some types of malware, but it may not be able to
catch all malware variants or remove them completely. It may also create conflicts or
performance issues with other security tools or systems on the device. Configuring the
system to use a proxy server for Internet access may help to filter or monitor some types of
malicious traffic or requests, but it may not prevent or remove malware that has already
infected the device or that uses other methods of communication or propagation. Deleting
the user profile and restoring data from backup may help to recover some data or settings
that may have been affected by the malware, but it may not remove malware that has
infected other parts of the system or that has persisted on the device.
Sample Question 5
A SOC analyst identifies the following content while examining the output of a debuggercommand over a client-server application:getconnection (database01, "alpha " , "AXTV. 127GdCx94GTd") ;Which of the following is the most likely vulnerability in this system?
A. Lack of input validation B. SQL injection C. Hard-coded credential D. Buffer overflow attacks
Answer: C
Explanation:
The most likely vulnerability in this system is hard-coded credential. Hard-coded credential
is a practice of embedding or storing a username, password, or other sensitive information
in the source code or configuration file of a system or application. Hard-coded credential
can pose a serious security risk, as it can expose the system or application to unauthorized
access, data theft, or compromise if the credential is discovered or leaked by an attacker.
Hard-coded credential can also make it difficult to change or update the credential if
needed, as it may require modifying the code or file and redeploying the system or
application.
Sample Question 6
A security analyst must preserve a system hard drive that was involved in a litigationrequest Which of the following is the best method to ensure the data on the device is notmodified?
A. Generate a hash value and make a backup image. B. Encrypt the device to ensure confidentiality of the data. C. Protect the device with a complex password. D. Perform a memory scan dump to collect residual data.
Answer: A
Explanation: Generating a hash value and making a backup image is the best method to
ensure the data on the device is not modified, as it creates a verifiable copy of the original
data that can be used for forensic analysis. Encrypting the device, protecting it with a
password, or performing a memory scan dump do not prevent the data from being altered
or deleted. Verified References: CompTIA CySA+ CS0-002 Certification Study Guide, page
3291
Sample Question 7
During an incident, some loCs of possible ransomware contamination were found in agroup of servers in a segment of the network. Which of the following steps should be takennext?
A. Isolation B. Remediation C. Reimaging D. Preservation
Answer: A
Explanation: Isolation is the first step to take after detecting some indicators of
compromise (IoCs) of possible ransomware contamination. Isolation prevents the
ransomware from spreading to other servers or segments of the network, and allows the
security team to investigate and contain the incident. Isolation can be done by
disconnecting the infected servers from the network, blocking the malicious traffic, or
applying firewall rules12. References: 10 Things You Should Do After a Ransomware Attack, How to Recover from a
Ransomware Attack: A Step-by-Step Guide
Sample Question 8
Which of the following would eliminate the need for different passwords for a variety orinternal application?
A. CASB B. SSO C. PAM D. MFA
Answer: B
Explanation: Single Sign-On (SSO) allows users to log in with a single ID and password to
access multiple applications. It eliminates the need for different passwords for various
internal applications, streamlining the authentication process.
Sample Question 9
An analyst wants to ensure that users only leverage web-based software that has beenpre-approved by the organization. Which of the following should be deployed?
A. Blocklisting B. Allowlisting C. Graylisting D. Webhooks
Answer: B
Explanation:
The correct answer is B. Allowlisting. Allowlisting is a technique that allows only pre-approved web-based software to run on a
system or network, while blocking all other software. Allowlisting can help prevent
unauthorized or malicious software from compromising the security of an organization.
Allowlisting can be implemented using various methods, such as application control,
browser extensions, firewall rules, or proxy servers12.
The other options are not the best techniques to ensure that users only leverage webbased
software that has been pre-approved by the organization. Blocklisting (A) is a
technique that blocks specific web-based software from running on a system or network,
while allowing all other software. Blocklisting can be ineffective or inefficient, as it requires
that temporarily rejects or delays incoming messages from unknown or suspicious sources,
until they are verified as legitimate. Graylisting is mainly used for email filtering, not for
web-based software control. Webhooks (D) are a technique that allows web-based
software to send or receive data from other web-based software in real time, based on
certain events or triggers. Webhooks are not related to web-based software control, but
rather to web-based software integration.
Sample Question 10
An email hosting provider added a new data center with new public IP addresses. Which ofthe following most likely needs to be updated to ensure emails from the new data center donot get blocked by spam filters?
A. DKIM B. SPF C. SMTP D. DMARC
Answer: B
Explanation: SPF (Sender Policy Framework) is a DNS TXT record that lists authorized
sending IP addresses for a given domain. If an email hosting provider added a new data
center with new public IP addresses, the SPF record needs to be updated to include those
new IP addresses, otherwise the emails from the new data center may fail SPF checks and get blocked by spam filters123 References: 1: Use DMARC to validate email, setup steps
2: How to set up SPF, DKIM and DMARC: other mail & hosting providers providers 3: Set
up SPF, DKIM, or DMARC records for my hosting email
Sample Question 11
A SOC analyst is analyzing traffic on a network and notices an unauthorized scan. Whichof the following types of activities is being observed?
A. Potential precursor to an attack B. Unauthorized peer-to-peer communication C. Rogue device on the network D. System updates
Answer: A
Sample Question 12
An organization has activated the CSIRT. A security analyst believes a single virtual serverwas compromised and immediately isolated from the network. Which of the followingshould the CSIRT conduct next?
A. Take a snapshot of the compromised server and verify its integrity B. Restore the affected server to remove any malware C. Contact the appropriate government agency to investigate D. Research the malware strain to perform attribution
Answer: A
Explanation: The next action that the CSIRT should conduct after isolating the
compromised server from the network is to take a snapshot of the compromised server and
verify its integrity. Taking a snapshot of the compromised server involves creating an exact
copy or image of the server’s data and state at a specific point in time. Verifying its integrity involves ensuring that the snapshot has not been altered, corrupted, or tampered with
during or after its creation. Taking a snapshot and verifying its integrity can help preserve
and protect any evidence or information related to the incident, as well as prevent any
tampering, contamination, or destruction of evidence.
Sample Question 13
A security analyst has prepared a vulnerability scan that contains all of the company'sfunctional subnets. During the initial scan, users reported that network printers began toprint pages that contained unreadable text and icons.Which of the following should the analyst do to ensure this behavior does not oocur duringsubsequent vulnerability scans?
A. Perform non-credentialed scans. B. Ignore embedded web server ports. C. Create a tailored scan for the printer subnet. D. Increase the threshold length of the scan timeout.
Answer: C
Explanation: The best way to prevent network printers from printing pages during a
vulnerability scan is to create a tailored scan for the printer subnet that excludes the ports
and services that trigger the printing behavior. The other options are not effective for this
purpose: performing non-credentialed scans may not reduce the impact on the printers;
ignoring embedded web server ports may not cover all the possible ports that cause
printing; increasing the threshold length of the scan timeout may not prevent the printing
from occurring.
References: According to the CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition1,
one of the objectives for the exam is to “use appropriate tools and methods to manage,
prioritize and respond to attacks and vulnerabilities”. The book also covers the usage and
syntax of vulnerability scanning tools, such as Nessus, Nmap, and Qualys, in chapter 4.
Specifically, it explains the meaning and function of each component in vulnerability
scanning, such as credentialed vs. non-credentialed scans, port scanning, and scan
scheduling1, pages 149-160. It also discusses the common issues and challenges of
vulnerability scanning, such as network disruptions, false positives, and scan scope1,
pages 161-162. Therefore, this is a reliable source to verify the answer to the question.
Sample Question 14
Which of the following makes STIX and OpenloC information readable by both humans andmachines?
A. XML B. URL C. OVAL D. TAXII
Answer: A
Explanation:
The correct answer is A. XML.
STIX and OpenloC are two standards for representing and exchanging cyber threat
intelligence (CTI) information. STIX stands for Structured Threat Information Expression
and OpenloC stands for Open Location and Identity Coordinates. Both standards use XML
as the underlying data format to encode the information in a structured and machinereadable
way. XML stands for Extensible Markup Language and it is a widely used
standard for defining and exchanging data on the web. XML uses tags, attributes, and
elements to describe the structure and meaning of the data. XML is also human-readable,
as it uses plain text and follows a hierarchical and nested structure.
XML is not the only format that can be used to make STIX and OpenloC information
readable by both humans and machines, but it is the most common and widely supported
one. Other formats that can be used include JSON, CSV, or PDF, depending on the use
case and the preferences of the information producers and consumers. However, XML has
some advantages over other formats, such as:
XML is more expressive and flexible than JSON or CSV, as it can define complex
data types, schemas, namespaces, and validation rules.
XML is more standardized and interoperable than PDF, as it can be easily parsed,
transformed, validated, and queried by various tools and languages.
XML is more compatible with existing CTI standards and tools than other formats,
as it is the basis for STIX 1.x, TAXII 1.x, MAEC, CybOX, OVAL, and others.
References:
1 Introduction to STIX - GitHub Pages
2 5 Best Threat Intelligence Feeds in 2023 (Free & Paid Tools) - Comparitech
3 What Are STIX/TAXII Standards? - Anomali Resources
4 What is STIX/TAXII? | Cloudflare
5 Sample Use | TAXII Project Documentation - GitHub Pages
6 Trying to retrieve xml data with taxii - Stack Overflow
7 CISA AIS TAXII Server Connection Guide
8 CISA AIS TAXII Server Connection Guide v2.0 | CISA
Sample Question 15
A security analyst found the following vulnerability on the company’s website:<INPUT TYPE=“IMAGE” SRC=“javascript:alert(‘test’);”>Which of the following should be implemented to prevent this type of attack in the future?
A. Input sanitization B. Output encoding C. Code obfuscation D. Prepared statements
Answer: A
Explanation:
This is a type of web application vulnerability called cross-site scripting (XSS), which allows an attacker to inject malicious code into a web page that is viewed by other users. XSS can
be used to steal cookies, session tokens, credentials, or other sensitive information, or to
perform actions on behalf of the victim.
Input sanitization is a technique that prevents XSS attacks by checking and filtering the
user input before processing it. Input sanitization can remove or encode any characters or
strings that may be interpreted as code by the browser, such as <, >, ", ', or javascript:.
Input sanitization can also validate the input against a predefined format or range of values,
and reject any input that does not match.
Output encoding is a technique that prevents XSS attacks by encoding the output before
sending it to the browser. Output encoding can convert any characters or strings that may
be interpreted as code by the browser into harmless entities, such as <, >, ", ', or
javascript:. Output encoding can also escape any special characters that may have a
different meaning in different contexts, such as , /, or ;.
Code obfuscation is a technique that makes the source code of a web application more
difficult to read and understand by humans. Code obfuscation can use techniques such as
renaming variables and functions, removing comments and whitespace, replacing literals
with expressions, or adding dummy code. Code obfuscation can help protect the
intellectual property and trade secrets of a web application, but it does not prevent XSS
attacks.
Sample Question 16
A systems administrator receives reports of an internet-accessible Linux server that isrunning very sluggishly. The administrator examines the server, sees a high amount ofmemory utilization, and suspects a DoS attack related to half-open TCP sessionsconsuming memory. Which of the following tools would best help to prove whether thisserver was experiencing this behavior?
A. Nmap B. TCPDump C. SIEM D. EDR
Answer: B
Explanation:
TCPDump is the best tool to prove whether the server was experiencing a DoS attack
related to half-open TCP sessions consuming memory. TCPDump is a command-line tool
that can capture and analyze network traffic, such as TCP, UDP, and ICMP packets.
TCPDump can help the administrator to identify the source and destination of the traffic,
the TCP flags and sequence numbers, the packet size and frequency, and other
information that can indicate a DoS attack. A DoS attack related to half-open TCP sessions
is also known as a SYN flood attack, which is a type of volumetric attack that aims to
exhaust the network bandwidth or resources of the target server by sending a large amount
of TCP SYN requests and ignoring the TCP SYN-ACK responses. This creates a backlog
of half-open connections on the server, which consume memory and CPU resources, and
prevent legitimate connections from being established12. TCPDump can help the
administrator to detect a SYN flood attack by looking for a high number of TCP SYN
packets with different source IP addresses, a low number of TCP SYN-ACK packets, and a
very low number of TCP ACK packets34. References: SYN flood DDoS attack | Cloudflare,
What is a SYN flood attack and how to prevent it? | NETSCOUT, TCPDump - A Powerful
Tool for Network Analysis and Security, How to Detect a SYN Flood Attack with TCPDump
Sample Question 17
Which of the following is the best action to take after the conclusion of a security incident toimprove incident response in the future?
A. Develop a call tree to inform impacted users B. Schedule a review with all teams to discuss what occurred C. Create an executive summary to update company leadership D. Review regulatory compliance with public relations for official notification
Answer: B
Explanation: One of the best actions to take after the conclusion of a security incident to
improve incident response in the future is to schedule a review with all teams to discuss
what occurred, what went well, what went wrong, and what can be improved. This review is
also known as a lessons learned session or an after-action report. The purpose of this
review is to identify the root causes of the incident, evaluate the effectiveness of the
incident response process, document any gaps or weaknesses in the security controls, and
recommend corrective actions or preventive measures for future incidents. Official
Which of the following should be updated after a lessons-learned review?
A. Disaster recovery plan B. Business continuity plan C. Tabletop exercise D. Incident response plan
Answer: D
Explanation: A lessons-learned review is a process of evaluating the effectiveness and
efficiency of the incident response plan after an incident or an exercise. The purpose of the
review is to identify the strengths and weaknesses of the incident response plan, and to
update it accordingly to improve the future performance and resilience of the organization.
Therefore, the incident response plan should be updated after a lessons-learned review.
References: The answer was based on the NCSC CAF guidance from the National Cyber
Security Centre, which states: “You should use post-incident and post-exercise reviews to
actively reduce the risks associated with the same, or similar, incidents happening in future.
Lessons learned can inform any aspect of your cyber security, including: System
configuration Security monitoring and reporting Investigation procedures
Containment/recovery strategies”
Sample Question 19
A malicious actor has gained access to an internal network by means of social engineering.The actor does not want to lose access in order to continue the attack. Which of thefollowing best describes the current stage of the Cyber Kill Chain that the threat actor iscurrently operating in?
A. Weaponization B. Reconnaissance C. Delivery D. Exploitation
Answer: D
Explanation: The Cyber Kill Chain is a framework that describes the stages of a
cyberattack from reconnaissance to actions on objectives. The exploitation stage is where attackers take advantage of the vulnerabilities they have discovered in previous stages to
further infiltrate a target’s network and achieve their objectives. In this case, the malicious
actor has gained access to an internal network by means of social engineering and does
not want to lose access in order to continue the attack. This indicates that the actor is in the
exploitation stage of the Cyber Kill Chain. Official References:
Which of the following best describes the process of requiring remediation of a knownthreat within a given time frame?
A. SLA B. MOU C. Best-effort patching D. Organizational governance
Answer: A
Explanation: An SLA (Service Level Agreement) is a contract or agreement between a
service provider and a customer that defines the expected level of service, performance,
quality, and availability of the service. An SLA also specifies the responsibilities,
obligations, and penalties for both parties in case of non-compliance or breach of the
agreement. An SLA can help organizations to ensure that their security services are
delivered in a timely and effective manner, and that any security incidents or vulnerabilities
are addressed and resolved within a specified time frame. An SLA can also help to
establish clear communication, expectations, and accountability between the service
provider and the customer12
An MOU (Memorandum of Understanding) is a document that expresses a mutual
agreement or understanding between two or more parties on a common goal or objective.
An MOU is not legally binding, but it can serve as a basis for future cooperation or collaboration. An MOU may not be suitable for requiring remediation of a known threat
within a given time frame, as it does not have the same level of enforceability, specificity, or
measurability as an SLA.
Best-effort patching is an informal and ad hoc approach to applying security patches or
updates to systems or software. Best-effort patching does not follow any defined process,
policy, or schedule, and relies on the availability and discretion of the system administrators
or users. Best-effort patching may not be effective or efficient for requiring remediation of a
known threat within a given time frame, as it does not guarantee that the patches are
applied correctly, consistently, or promptly. Best-effort patching may also introduce new
risks or vulnerabilities due to human error, compatibility issues, or lack of testing.
Organizational governance is the framework of rules, policies, procedures, and processes
that guide and direct the activities and decisions of an organization. Organizational
governance can help to establish the roles, responsibilities, and accountabilities of different
stakeholders within the organization, as well as the goals, values, and principles that shape
the organizational culture and behavior. Organizational governance can also help to ensure
compliance with internal and external standards, regulations, and laws. Organizational
governance may not be sufficient for requiring remediation of a known threat within a given
time frame, as it does not specify the details or metrics of the service delivery or
performance. Organizational governance may also vary depending on the size, structure,
and nature of the organization.
Sample Question 21
Which of the following can be used to learn more about TTPs used by cybercriminals?
A. ZenMAP B. MITRE ATT&CK C. National Institute of Standards and Technology D. theHarvester
Answer: B
Explanation: MITRE ATT&CK is a globally accessible knowledge base of adversary
tactics and techniques based on real-world observations. It is used as a foundation for the
development of specific threat models and methodologies in the private sector, in
government, and in the cybersecurity product and service community. It can help security
professionals understand, detect, and mitigate cyber threats by providing a comprehensive
framework of TTPs.
References: MITRE ATT&CK, Getting Started with ATT&CK, MITRE ATT&CK | MITRE
Sample Question 22
An analyst is evaluating a vulnerability management dashboard. The analyst sees that apreviously remediated vulnerability has reappeared on a database server. Which of thefollowing is the most likely cause?
A. The finding is a false positive and should be ignored. B. A rollback had been executed on the instance. C. The vulnerability scanner was configured without credentials. D. The vulnerability management software needs to be updated.
Answer: B
Explanation:
A rollback had been executed on the instance. If a database server is restored to a
previous state, it may reintroduce a vulnerability that was previously fixed. This can happen
due to backup and recovery operations, configuration changes, or software updates. A
rollback can undo the patching or mitigation actions that were applied to remediate the
vulnerability. References: Vulnerability Remediation: It’s Not Just Patching, Section: The
Remediation Process; Vulnerability assessment for SQL Server, Section: Remediation
Sample Question 23
A security program was able to achieve a 30% improvement in MTTR by integratingsecurity controls into a SIEM. The analyst no longer had to jump between tools. Which ofthe following best describes what the security program did?
A. Data enrichment B. Security control plane C. Threat feed combination D. Single pane of glass
Answer: D
Explanation: A single pane of glass is a term that describes a unified view or interface that
integrates multiple tools or data sources into one dashboard or console. A single pane of
glass can help improve security operations by providing visibility, correlation, analysis, and
alerting capabilities across various security controls and systems. A single pane of glass
can also help reduce complexity, improve efficiency, and enhance decision making for
security analysts. In this case, a security program was able to achieve a 30% improvement
in MTTR by integrating security controls into a SIEM, which provides a single pane of glass
An incident response team found IoCs in a critical server. The team needs to isolate andcollect technical evidence for further investigation. Which of the following pieces of datashould be collected first in order to preserve sensitive information before isolating theserver?
A. Hard disk B. Primary boot partition C. Malicious tiles D. Routing table E. Static IP address
Answer: A
Explanation: The hard disk is the piece of data that should be collected first in order to
preserve sensitive information before isolating the server. The hard disk contains all the
files and data stored on the server, which may include evidence of malicious activity, such
as malware installation, data exfiltration, or configuration changes. The hard disk should be
collected using proper forensic techniques, such as creating an image or a copy of the disk
and maintaining its integrity using hashing algorithms.
Sample Question 25
A company has a primary control in place to restrict access to a sensitive database.However, the company discovered an authentication vulnerability that could bypass thiscontrol. Which of the following is the best compensating control?
A. Running regular penetration tests to identify and address new vulnerabilities B. Conducting regular security awareness training of employees to prevent socialengineering attacks C. Deploying an additional layer of access controls to verify authorized individuals D. Implementing intrusion detection software to alert security teams of unauthorized accessattempts
Answer: C
Explanation:
Deploying an additional layer of access controls to verify authorized individuals is the best
compensating control for the authentication vulnerability that could bypass the primary
control. A compensating control is a security measure that is implemented to mitigate the
risk of a vulnerability or a threat when the primary control is not sufficient or feasible. A
compensating control should provide a similar or greater level of protection as the primary
control, and should be closely related to the vulnerability or the threat it is addressing1. In
this case, the primary control is to restrict access to a sensitive database, and the
vulnerability is an authentication bypass. Therefore, the best compensating control is to
deploy an additional layer of access controls, such as multifactor authentication, role-based
access control, or encryption, to verify the identity and the authorization of the individuals
who are accessing the database. This way, the compensating control can prevent
unauthorized access to the database, even if the primary control is bypassed23. Running
regular penetration tests, conducting regular security awareness training, and implementing intrusion detection software are all good security practices, but they are not compensating
controls for the authentication vulnerability, as they do not provide a similar or greater level
of protection as the primary control, and they are not closely related to the vulnerability or
the threat they are addressing. References: Compensating Controls: An Impermanent
Solution to an IT … - Tripwire, What is Multifactor Authentication (MFA)? | Duo Security,
Role-Based Access Control (RBAC) and Role-Based Security, [What is a Penetration Test
and How Does It Work?]
Sample Question 26
A Chief Information Security Officer has outlined several requirements for a newvulnerability scanning project:. Must use minimal network bandwidth. Must use minimal host resources. Must provide accurate, near real-time updates. Must not have any stored credentials in configuration on the scannerWhich of the following vulnerability scanning methods should be used to best meet theserequirements?
A. Internal B. Agent C. Active D. Uncredentialed
Answer: B
Explanation: Agent-based vulnerability scanning is a method that uses software agents
installed on the target systems to scan for vulnerabilities. This method meets the
requirements of the project because it uses minimal network bandwidth and host
resources, provides accurate and near real-time updates, and does not require any stored
credentials on the scanner. References: What Is Vulnerability Scanning? Types, Tools and
Best Practices, Section: Types of vulnerability scanning; CompTIA CySA+ Study Guide:
A security alert was triggered when an end user tried to access a website that is notallowed per organizational policy. Since the action is considered a terminable offense, theSOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation. Which ofthe following is the best way to ensure that the investigation complies with HR or privacypolicies?
A. Create a timeline of events detailinq the date stamps, user account hostname and IPinformation associated with the activities B. Ensure that the case details do not reflect any user-identifiable information Passwordprotect the evidence and restrict access to personnel related to the investigation C. Create a code name for the investigation in the ticketing system so that all personnelwith access will not be able to easily identity the case as an HR-related investigation D. Notify the SOC manager for awareness after confirmation that the activity wasintentional
Answer: B
Explanation: The best way to ensure that the investigation complies with HR or privacy
policies is to ensure that the case details do not reflect any user-identifiable information,
such as name, email address, phone number, or employee ID. This can help protect the
privacy and confidentiality of the user and prevent any potential discrimination or retaliation.
Additionally, password protecting the evidence and restricting access to personnel related
to the investigation can help preserve the integrity and security of the evidence and prevent
any unauthorized or accidental disclosure or modification.
Sample Question 28
A cybersecurity analyst is recording the following details* ID* Name* Description* Classification of information* Responsible partyIn which of the following documents is the analyst recording this information?
A. Risk register B. Change control documentation C. Incident response playbook D. Incident response plan
Answer: A
Explanation: A risk register typically contains details like ID, name, description,
classification of information, and responsible party. It’s used for tracking identified risks and
managing them.Recording details like ID, Name, Description, Classification of information,
and Responsible party is typically done in a Risk Register. This document is used to
identify, assess, manage, and monitor risks within an organization. It's not directly related
to incident response or change control documentation.
Sample Question 29
The Chief Information Security Officer is directing a new program to reduce attack surfacerisks and threats as part of a zero trust approach. The IT security team is required to comeup with priorities for the program. Which of the following is the best priority based oncommon attack frameworks?
A. Reduce the administrator and privileged access accounts B. Employ a network-based IDS C. Conduct thorough incident response D. Enable SSO to enterprise applications
Answer: A
Explanation: The best priority based on common attack frameworks for a new program to
reduce attack surface risks and threats as part of a zero trust approach is to reduce the
administrator and privileged access accounts. Administrator and privileged access
accounts are accounts that have elevated permissions or capabilities to perform sensitive or critical tasks on systems or networks, such as installing software, changing
configurations, accessing data, or granting access. Reducing the administrator and
privileged access accounts can help minimize the attack surface, as it can limit the number
of potential targets or entry points for attackers, as well as reduce the impact or damage of
an attack if an account is compromised.
Sample Question 30
Which of the following threat-modeling procedures is in the OWASP Web Security TestingGuide?
A. Review Of security requirements B. Compliance checks C. Decomposing the application D. Security by design
Answer: C
Explanation:
The OWASP Web Security Testing Guide (WSTG) includes a section on threat modeling,
which is a structured approach to identify, quantify, and address the security risks
associated with an application. The first step in the threat modeling process is
decomposing the application, which involves creating use cases, identifying entry points,
assets, trust levels, and data flow diagrams for the application. This helps to understand
the application and how it interacts with external entities, as well as to identify potential
threats and vulnerabilities1. The other options are not part of the OWASP WSTG threat
modeling process.
Sample Question 31
During an incident, a security analyst discovers a large amount of Pll has been emailedexternally from an employee to a public email address. The analyst finds that the externalemail is the employee'spersonal email. Which of the following should the analyst recommend be done first?
A. Place a legal hold on the employee's mailbox. B. Enable filtering on the web proxy. C. Disable the public email access with CASB. D. Configure a deny rule on the firewall.
Answer: A
Explanation: Placing a legal hold on the employee’s mailbox is the best action to perform
first, as it preserves all mailbox content, including deleted items and original versions of
modified items, for potential legal or forensic purposes. A legal hold is a feature that allows
an administrator to retain mailbox data for a user indefinitely or for a specified period,
regardless of the user’s actions or retention policies. A legal hold can be applied to a
mailbox using Litigation Hold or In-Place Hold in Exchange Server or Exchange Online. A
legal hold can help to ensure that evidence of data exfiltration or other malicious activities
is not lost or tampered with, and that the organization can comply with any legal or
regulatory obligations. The other actions are not as urgent or effective as placing a legal
hold on the employee’s mailbox, as they do not address the immediate threat of data loss
or compromise. Enabling filtering on the web proxy may help to prevent some types of data
exfiltration or malicious traffic, but it does not help to recover or preserve the data that has
already been emailed externally. Disabling the public email access with CASB (Cloud
Access Security Broker) may help to block or monitor the use of public email services by
employees, but it does not help to recover or preserve the data that has already been
emailed externally. Configuring a deny rule on the firewall may help to block or monitor the
network traffic from the employee’s laptop, but it does not help to recover or preserve the
data that has already been emailed externally.
Sample Question 32
A systems administrator notices unfamiliar directory names on a production server. Theadministrator reviews the directory listings and files, and then concludes the server hasbeencompromised. Which of the following steps should the administrator take next?
A. Inform the internal incident response team. B. Follow the company's incident response plan. C. Review the lessons learned for the best approach. D. Determine when the access started.
Answer: B
Explanation: An incident response plan is a set of predefined procedures and guidelines
that an organization follows when faced with a security breach or attack. An incident
response plan helps to ensure that the organization can quickly and effectively contain,
analyze, eradicate, and recover from the incident, as well as prevent or minimize the
damage and impact to the business operations, reputation, and customers. An incident
response plan also defines the roles and responsibilities of the incident response team, the
communication channels and protocols, the escalation and reporting procedures, and the
tools and resources available for the incident response.
By following the company’s incident response plan, the administrator can ensure that they
are following the best practices and standards for handling a security incident, and that
they are coordinating and collaborating with the relevant stakeholders and authorities.
Following the company’s incident response plan can also help to avoid or reduce any legal,
regulatory, or contractual liabilities or penalties that may arise from the incident.
The other options are not as effective or appropriate as following the company’s incident
response plan. Informing the internal incident response team (A) is a good step, but it
should be done according to the company’s incident response plan, which may specify
who, when, how, and what to report. Reviewing the lessons learned for the best approach
during the active response phase. Determining when the access started (D) is a good step,
but it should be done as part of the analysis phase of the incident response plan, not before
following the plan.
Sample Question 33
After a security assessment was done by a third-party consulting firm, the cybersecurityprogram recommended integrating DLP and CASB to reduce analyst alert fatigue. Which ofthe following is the best possible outcome that this effort hopes to achieve?
A. SIEM ingestion logs are reduced by 20%. B. Phishing alerts drop by 20%. C. False positive rates drop to 20%. D. The MTTR decreases by 20%.
Answer: D
Explanation:
The MTTR (Mean Time to Resolution) decreases by 20% is the best possible outcome that
this effort hopes to achieve, as it reflects the improvement in the efficiency and
effectiveness of the incident response process by reducing analyst alert fatigue. Analyst
alert fatigue is a term that refers to the phenomenon of security analysts becoming
overwhelmed, desensitized, or exhausted by the large number of alerts they receive from
various security tools or systems, such as DLP (Data Loss Prevention) or CASB (Cloud
Access Security Broker). DLP is a security solution that helps to prevent unauthorized access, use, or transfer of sensitive data, such as personal information, intellectual
property, or financial records. CASB is a security solution that helps to monitor and control
the use of cloud-based applications and services, such as SaaS (Software as a Service),
PaaS (Platform as a Service), or IaaS (Infrastructure as a Service). Both DLP and CASB
can generate alerts when they detect potential data breaches, policy violations, or
malicious activities, but they can also produce false positives, irrelevant information, or
duplicate notifications that can overwhelm or distract the security analysts. Analyst alert
fatigue can have negative consequences for the security posture and performance of an
organization, such as missing or ignoring critical alerts, delaying or skipping investigations
or remediations, making errors or mistakes, or losing motivation or morale. Therefore, it is
important to reduce analyst alert fatigue and optimize the alert management process by
using various strategies, such as tuning the alert thresholds and rules, prioritizing and
triaging the alerts based on severity and context, enriching and correlating the alerts with
additional data sources, automating or orchestrating repetitive or low-level tasks or actions,
or integrating and consolidating different security tools or systems into a unified platform.
By reducing analyst alert fatigue and optimizing the alert management process, the effort
hopes to achieve a decrease in the MTTR, which is a metric that measures the average
time it takes to resolve an incident from the moment it is reported to the moment it is
closed. A lower MTTR indicates a faster and more effective incident response process,
which can help to minimize the impact and damage of security incidents, improve customer
satisfaction and trust, and enhance security operations and outcomes. The other options
are not as relevant or realistic as the MTTR decreases by 20%, as they do not reflect the
best possible outcome that this effort hopes to achieve. SIEM ingestion logs are reduced
by 20% is not a relevant outcome, as it does not indicate any improvement in the incident
response process or any reduction in analyst alert fatigue. SIEM (Security Information and
Event Management) is a security solution that collects and analyzes data from various
sources, such as logs, events, or alerts, and provides security monitoring, threat detection,
and incident response capabilities. SIEM ingestion logs are records of the data that is
ingested by the SIEM system from different sources. Reducing SIEM ingestion logs may
imply less data volume or less data sources for the SIEM system, which may not
necessarily improve its performance or accuracy. Phishing alerts drop by 20% is not a
realistic outcome, as it does not depend on the integration of DLP and CASB or any
reduction in analyst alert fatigue. Phishing alerts are notifications that indicate potential
phishing attempts or attacks, such as fraudulent emails, websites, or messages that try to
trick users into revealing sensitive information or installing malware. Phishing alerts can be
generated by various security tools or systems, such as email security solutions, web
security solutions, endpoint security solutions, or user awareness training programs.
Reducing phishing alerts may imply less phishing attempts or attacks on the organization,
which may not necessarily be influenced by the integration of DLP and CASB or any
reduction in analyst alert fatigue. False positive rates drop to 20% is not a realistic outcome
Sample Question 34
A security analyst needs to secure digital evidence related to an incident. The securityanalyst must ensure that the accuracy of the data cannot be repudiated. Which of thefollowing should be implemented?
A. Offline storage B. Evidence collection C. Integrity validation D. Legal hold
Answer: C
Explanation:
Integrity validation is the process of ensuring that the digital evidence has not been altered
or tampered with during collection, acquisition, preservation, or analysis. It usually involves
generating and verifying cryptographic hashes of the evidence, such as MD5 or SHA-1.
Integrity validation is essential for maintaining the accuracy and admissibility of the digital
evidence in court.
Sample Question 35
During a security test, a security analyst found a critical application with a buffer overflowvulnerability. Which of the following would be best to mitigate the vulnerability at theapplication level?
A. Perform OS hardening. B. Implement input validation. C. Update third-party dependencies. D. Configure address space layout randomization.
Answer: B
Explanation:
Implementing input validation is the best way to mitigate the buffer overflow vulnerability at
the application level. Input validation is a technique that checks the data entered by users
or attackers against a set of rules or constraints, such as data type, length, format, or
range. Input validation can prevent common web application attacks such as SQL injection,
cross-site scripting (XSS), or command injection, which exploit the lack of input validation
to execute malicious code or commands on the server or the client side. By validating the
input before allowing submission, the web application can reject or sanitize any malicious
or unexpected input, and protect the application from being compromised12. References:
How to detect, prevent, and mitigate buffer overflow attacks - Synopsys, How to mitigate
buffer overflow vulnerabilities | Infosec
Sample Question 36
Which of the following would an organization use to develop a business continuity plan?
A. A diagram of all systems and interdependent applications B. A repository for all the software used by the organization C. A prioritized list of critical systems defined by executive leadership D. A configuration management database in print at an off-site location
Answer: C
Explanation:
A prioritized list of critical systems defined by executive leadership is the best option to use
to develop a business continuity plan. A business continuity plan (BCP) is a system of
prevention and recovery from potential threats to a company. The plan ensures that
personnel and assets are protected and are able to function quickly in the event of a
disaster1. A BCP should include a business impact analysis, which identifies the critical
systems and processes that are essential for the continuity of the business operations, and
the potential impacts of their disruption2. The executive leadership should be involved in
defining the critical systems and their priorities, as they have the strategic vision and
authority to make decisions that affect the whole organization3. A diagram of all systems
and interdependent applications, a repository for all the software used by the organization,
and a configuration management database in print at an off-site location are all useful tools for documenting and managing the IT infrastructure, but they are not sufficient to develop a
comprehensive BCP that covers all aspects of the business continuity4. References: What
Is a Business Continuity Plan (BCP), and How Does It Work?, Business continuity plan
(BCP) in 8 steps, with templates, Business continuity planning | Business Queensland,
Understanding the Essentials of a Business Continuity Plan
Sample Question 37
A security analyst is reviewing a packet capture in Wireshark that contains an FTP sessionfrom a potentially compromised machine. The analyst sets the following display filter: ftp.The analyst can see there are several RETR requests with 226 Transfer completeresponses, but the packet list pane is not showing the packets containing the file transferitself. Which of the following can the analyst perform to see the entire contents of thedownloaded files?
A. Change the display filter to f cp. accive. pore B. Change the display filter to tcg.port=20 C. Change the display filter to f cp-daca and follow the TCP streams D. Navigate to the File menu and select FTP from the Export objects option
Answer: C
Explanation: The best way to see the entire contents of the downloaded files in Wireshark
is to change the display filter to ftp-data and follow the TCP streams. FTP-data is a protocol
that is used to transfer files between an FTP client and server using TCP port 20. By
filtering for ftp-data packets and following the TCP streams, the analyst can see the actual
file data that was transferred during the FTP session
Sample Question 38
A SOC analyst recommends adding a layer of defense for all endpoints that will betterprotect against external threats regardless of the device's operating system. Which of thefollowing best meets thisrequirement?
A. SIEM B. CASB C. SOAR D. EDR
Answer: D
Explanation: EDR stands for Endpoint Detection and Response, which is a layer of
defense that monitors endpoints for malicious activity and provides automated or manual
response capabilities. EDR can protect against external threats regardless of the device’s
operating system, as it can detect and respond to attacks based on behavioral analysis and
threat intelligence. EDR is also one of the tools that CompTIA CySA+ covers in its exam
A security analyst is performing vulnerability scans on the network. The analyst installs ascanner appliance, configures the subnets to scan, and begins the scan of the network.Which of the followingwould be missing from a scan performed with this configuration?
A. Operating system version B. Registry key values C. Open ports D. IP address
Answer: B
Explanation:
Registry key values would be missing from a scan performed with this configuration, as the
scanner appliance would not have access to the Windows Registry of the scanned
systems. The Windows Registry is a database that stores configuration settings and
options for the operating system and installed applications. To scan the Registry, the
scanner would need to have credentials to log in to the systems and run a local agent or
script. The other items would not be missing from the scan, as they can be detected by the
scanner appliance without credentials. Operating system version can be identified by analyzing service banners or fingerprinting techniques. Open ports can be discovered by
performing a port scan or sending probes to common ports. IP address can be obtained by
resolving the hostname or using network discovery tools.
The Chief Information Security Officer (CISO) of a large management firm has selected acybersecurity framework that will help the organization demonstrate its investment in toolsand systems to protect its data. Which of the following did the CISO most likely select?
A. PCI DSS B. COBIT C. ISO 27001 D. ITIL
Answer: C
Explanation: ISO 27001 is an international standard that establishes a framework for implementing, maintaining, and improving an information security management system
(ISMS). It helps organizations demonstrate their commitment to protecting their data and
complying with various regulations and best practices. The other options are not relevant
for this purpose: PCI DSS is a standard that focuses on protecting payment card data;
COBIT is a framework that provides guidance on governance and management of
enterprise IT; ITIL is a framework that provides guidance on service management and
delivery.
References: According to the CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition1,
one of the objectives for the exam is to “use appropriate tools and methods to manage,
prioritize and respond to attacks and vulnerabilities”. The book also covers the usage and
syntax of various cybersecurity frameworks and standards, such as ISO 27001, PCI DSS,
COBIT, and ITIL, in chapter 1. Specifically, it explains the meaning and function of each
framework and standard, such as ISO 27001, which provides a comprehensive approach
to information security management1, page 29. Therefore, this is a reliable source to verify
the answer to the question.
Sample Question 41
A technician identifies a vulnerability on a server and applies a software patch. Which ofthe following should be the next step in the remediation process?
A. Testing B. Implementation C. Validation D. Rollback
Answer: C
Explanation: The next step in the remediation process after applying a software patch is
validation. Validation is a process that involves verifying that the patch has been
successfully applied, that it has fixed the vulnerability, and that it has not caused any
adverse effects on the system or application functionality or performance. Validation can be
done using various methods, such as scanning, testing, monitoring, or auditing.
Sample Question 42
A security analyst is trying to identify anomalies on the network routing. Which of thefollowing functions can the analyst use on a shell script to achieve the objective mostaccurately?
A. function x() { info=$(geoiplookup $1) && echo "$1 | $info" } B. function x() { info=$(ping -c 1 $1 | awk -F "/" ’END{print $5}’) && echo "$1 | $info" } C. function x() { info=$(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ".in-addr" ’{print $1}').origin.asn.cymru.com TXT +short) && echo "$1 | $info" } D. function x() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo "$1 | $info" }
Answer: C
Explanation: The function that can be used on a shell script to identify anomalies on the
This function takes an IP address as an argument and performs two DNS lookups using the dig command. The first lookup uses the -x option to perform a reverse DNS lookup and
get the hostname associated with the IP address. The second lookup uses the
origin.asn.cymru.com domain to get the autonomous system number (ASN) and other
information related to the IP address. The function then prints the IP address and the ASN
information, which can help identify any routing anomalies or inconsistencies
Sample Question 43
While reviewing web server logs, an analyst notices several entries with the same timestamps, but all contain odd characters in the request line. Which of the following stepsshould be taken next?
A. Shut the network down immediately and call the next person in the chain of command. B. Determine what attack the odd characters are indicative of C. Utilize the correct attack framework and determine what the incident response willconsist of. D. Notify the local law enforcement for incident response
Answer: B
Explanation:
Determining what attack the odd characters are indicative of is the next step that should be
taken after reviewing web server logs and noticing several entries with the same time
stamps, but all contain odd characters in the request line. This step can help the analyst
identify the type and severity of the attack, as well as the possible source and motive of the
attacker. The odd characters in the request line may indicate that the attacker is trying to
exploit a vulnerability or inject malicious code into the web server or application, such as
SQL injection, cross-site scripting, buffer overflow, or command injection. The analyst can
use tools and techniques such as log analysis, pattern matching, signature detection, or
threat intelligence to determine what attack the odd characters are indicative of, and then
proceed to the next steps of incident response, such as containment, eradication, recovery,
An employee is no longer able to log in to an account after updating a browser. Theemployee usually has several tabs open in the browser. Which ofthe following attacks was most likely performed?
A. RFI B. LFI C. CSRF D. XSS
Answer: C
Explanation: The most likely attack that was performed is CSRF (Cross-Site Request Forgery). This is an attack that forces a user to execute unwanted actions on a web
application in which they are currently authenticated1. If the user has several tabs open in
the browser, one of them might contain a malicious link or form that sends a request to the
web application to change the user’s password, email address, or other account settings.
The web application will not be able to distinguish between the legitimate requests made by
the user and the forged requests made by the attacker. As a result, the user will lose
access to their account.
To prevent CSRF attacks, web applications should implement some form of anti-CSRF
tokens or other mechanisms that validate the origin and integrity of the requests2. These
tokens are unique and unpredictable values that are generated by the server and
embedded in the forms or URLs that perform state-changing actions. The server will then
verify that the token received from the client matches the token stored on the server before
processing the request. This way, an attacker cannot forge a valid request without knowing
the token value.
Some other possible attacks that are not relevant to this scenario are:
RFI (Remote File Inclusion) is an attack that allows an attacker to execute
malicious code on a web server by including a remote file in a script. This attack
does not affect the user’s browser or account settings.
LFI (Local File Inclusion) is an attack that allows an attacker to read or execute
local files on a web server by manipulating the input parameters of a script. This
attack does not affect the user’s browser or account settings.
XSS (Cross-Site Scripting) is an attack that injects malicious code into a web page
that is then executed by the user’s browser. This attack can affect the user’s
browser or account settings, but it requires the user to visit a compromised web
page or click on a malicious link. It does not depend on having several tabs open
in the browser.
Sample Question 45
Which of the following is a reason why proper handling and reporting of existing evidenceare important for the investigation and reporting phases of an incident response?
A. TO ensure the report is legally acceptable in case it needs to be presented in court B. To present a lessons-learned analysis for the incident response team C. To ensure the evidence can be used in a postmortem analysis D. To prevent the possible loss of a data source for further root cause analysis
Answer: A
Explanation:
Sample Question 46
An analyst has received an IPS event notification from the SIEM stating an IP address,which is known to be malicious, has attempted to exploit a zero-day vulnerability on severalweb servers. The exploit contained the following snippet:/wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administratorWhich of the following controls would work best to mitigate the attack represented by thissnippet?
A. Limit user creation to administrators only. B. Limit layout creation to administrators only. C. Set the directory trx_addons to read only for all users. D. Set the directory v2 to read only for all users.
Answer: A
Explanation: Limiting user creation to administrators only would work best to mitigate the
attack represented by this snippet. The snippet shows an attempt to exploit a zero-day
vulnerability in the ThemeREX Addons WordPress plugin, which allows remote code
execution by invoking arbitrary PHP functions via the REST-API endpoint /wpjson/
trx_addons/V2/get/sc_layout. In this case, the attacker tries to use the wp_insert_user
function to create a new administrator account on the WordPress site12. Limiting user
creation to administrators only would prevent the attacker from succeeding, as they would
need to provide valid administrator credentials to create a new user. This can be done by
using a plugin or a code snippet that restricts user registration to administrators34. Limiting
layout creation to administrators only, setting the directory trx_addons to read only for all
users, and setting the directory v2 to read only for all users are not effective controls to
mitigate the attack, as they do not address the core of the vulnerability, which is the lack of
input validation and sanitization on the REST-API endpoint. Moreover, setting directories to
read only may affect the functionality of the plugin or the WordPress site56. References:
Zero-Day Vulnerability in ThemeREX Addons Now Patched - Wordfence, Mitigating Zero
Day Attacks With a Detection, Prevention … - Spiceworks, How to Restrict WordPress
User Registration to Specific Email …, How to Limit WordPress User Registration to
Specific Domains, WordPress File Permissions: A Guide to Securing Your Website,
WordPress File Permissions: What is the Ideal Setting?
Sample Question 47
Which of the following stakeholders are most likely to receive a vulnerability scan report?(Select two).
A. Executive management B. Law enforcement C. Marketing D. Legal E. Product owner F. Systems admininstration
Answer: A,F
Explanation: Executive management and systems administration are the most likely
stakeholders to receive a vulnerability scan report because they are responsible for
overseeing the security posture and remediation efforts of the organization. Law
enforcement, marketing, legal, and product owner are less likely to be involved in the
vulnerability management process or need access to the scan results. References:
Cybersecurity Analyst+ - CompTIA, How To Write a Vulnerability Assessment Report | ECCouncil,
Driving Stakeholder Alignment in Vulnerability Management - LogicGate
Sample Question 48
A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become?
A. Hacklivist B. Advanced persistent threat C. Insider threat D. Script kiddie
Answer: C
Explanation: The user has become an insider threat by downloading software that
contains malware onto a computer that eventually infects numerous other systems. An
insider threat is a person or entity that has legitimate access to an organization’s systems,
networks, or resources and uses that access to cause harm or damage to the organization.
An insider threat can be intentional or unintentional, malicious or negligent, and can result
from various actions or behaviors, such as downloading unauthorized software, violating
security policies, stealing data, sabotaging systems, or collaborating with external
