CS0-003 CompTIA CySA+ Exam Dumps Questions

dumps2023-07-25T11:28:11+08:00

CS0-003 exam is the new one for CompTIA CySA+ certification, and the former code CS0-002 exam in English will be retired on December 5, 2023. There are a maximum of 85 Multiple choice and performance-based questions in the real CompTIA Certification CS0-003 exam, and you have 165 minutes to answer all the questions. The required passing score for the CompTIA CS0-003 exam is 750 (on a scale of 100-900). Our new cracked CompTIA CySA+ CS0-003 exam dumps questions are the best material for you to pass the test. Free CompTIA Certification CS0-003 exam dumps are below.

Page 1 of 4

1. A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability.

Which of the following CVE metrics would be most accurate for this zero-day threat?

CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/1: K/A: L

CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

2. Which of the following tools would work best to prevent the exposure of PII outside of an organization?

PAM

IDS

PKI

DLP

3. An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:

Which of the following tuning recommendations should the security analyst share?

Set an HttpOnlvflaq to force communication by HTTPS

Block requests without an X-Frame-Options header

Configure an Access-Control-Allow-Origin header to authorized domains

Disable the cross-origin resource sharing header

4. Which of the following items should be included in a vulnerability scan report? (Choose two.)

Lessons learned

Service-level agreement

Playbook

Affected hosts

Risk score

Education plan

5. The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released.

Which of the following would best protect this organization?

A mean time to remediate of 30 days

A mean time to detect of 45 days

A mean time to respond of 15 days

Third-party application testing

6. A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious.

Given the following script:

Which of the following scripting languages was used in the script?

PowerShel

Ruby

Python

Shell script

7. A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS.

Which of the following most likely describes the observed activity?

There is an issue with the SSL certificate causinq port 443 to become unavailable for HTTPS access

An on-path attack is being performed by someone with internal access that forces users into port 80

The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80

An error was caused by BGP due to new rules applied over the company's internal routers

8. The Company shall prioritize patching of publicly available systems and services over patching of

internally available system.

According to the security policy, which of the following vulnerabilities should be the highest priority to patch?

A)

Option A

Option B

Option C

Option D

9. Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

Business continuity plan

Vulnerability management plan

Disaster recovery plan

Asset management plan

10. The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization.

Which of the following solutions will assist in reducing the risk?

Deploy a CASB and enable policy enforcement

Configure MFA with strict access

Deploy an API gateway

Enable SSO to the cloud applications

Page 2 of 4

11. An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack.

Which of the following logs should the team review first?

CDN

Vulnerability scanner

DNS

Web server

12. A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack.

Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

Weaponization

Reconnaissance

Delivery

Exploitation

13. An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets.

Which of the following steps of an attack framework is the analyst witnessing?

Exploitation

Reconnaissance

Command and control

Actions on objectives

14. An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country.

Which of the following best describes what is happening? (Choose two.)

Beaconinq

Domain Name System hijacking

Social engineering attack

On-path attack

Obfuscated links

Address Resolution Protocol poisoning

15. During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application.

Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

Conduct regular red team exercises over the application in production

Ensure that all implemented coding libraries are regularly checked

Use application security scanning as part of the pipeline for the CI/CDflow

Implement proper input validation for any data entry form

16. An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to.

Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

Proprietary systems

Legacy systems

Unsupported operating systems

Lack of maintenance windows

17. The security team reviews a web server for XSS and runs the following Nmap scan:

Which of the following most accurately describes the result of the scan?

An output of characters > and " as the parameters used m the attempt

The vulnerable parameter ID hccp://l72.31.15.2/1.php?id-2 and unfiltered characters returned

The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe

The vulnerable parameter and characters > and " with a reflected XSS attempt

18. Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

Develop a call tree to inform impacted users

Schedule a review with all teams to discuss what occurred

Create an executive summary to update company leadership

Review regulatory compliance with public relations for official notification

19. A security analyst received a malicious binary file to analyze.

Which of the following is the best technique to perform the analysis?

Code analysis

Static analysis

Reverse engineering

Fuzzing

20. An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation.

Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?

Hard disk

Primary boot partition

Malicious tiles

Routing table

Static IP address

Page 3 of 4

21. Which of the following security operations tasks are ideal for automation?

Suspicious file analysis: - Look for suspicious-looking graphics in a folder. - Create subfolders in the original folder based on category of graphics found. - Move the suspicious graphics to the appropriate subfolder

Firewall IoC block actions: Examine the firewall logs for IoCs from the most recently published zero-day exploit Take mitigating actions in the firewall to block the behavior found in the logs Follow up on any false positives that were caused by the block rules

Security application user errors: Search the error logs for signs of users having trouble with the security application Look up the user's phone number Call the user to help with any questions about using the application

Email header analysis: Check the email header for a phishing confidence metric greater than or equal to five Add the domain of sender to the block list Move the email to quarantine

22. An organization has experienced a breach of customer transactions.

Under the terms of PCI DSS, which of the following groups should the organization report the breach to?

PCI Security Standards Council

Local law enforcement

Federal law enforcement

Card issuer

23. Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

Mean time to detect

Number of exploits by tactic

Alert volume

Quantity of intrusion attempts

24. A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment.

Which of the following implications should be considered on the new hybrid environment?

The current scanners should be migrated to the cloud

Cloud-specific misconfigurations may not be detected by the current scanners

Existing vulnerability scanners cannot scan laaS systems

Vulnerability scans on cloud environments should be performed from the cloud

25. A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation.

Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

Create a timeline of events detailinq the date stamps, user account hostname and IP information associated with the activities

Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation

Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identity the case as an HR-related investigation

Notify the SOC manager for awareness after confirmation that the activity was intentional

26. Which of the following is the first step that should be performed when establishing a disaster recovery plan?

Agree on the goals and objectives of the plan

Determine the site to be used during a disaster C Demonstrate adherence to a standard disaster recovery process

Identity applications to be run during a disaster

27. A technician identifies a vulnerability on a server and applies a software patch.

Which of the following should be the next step in the remediation process?

Testing

Implementation

Validation

Rollback

28. The analyst reviews the following endpoint log entry:

Which of the following has occurred?

Registry change

Rename computer

New account introduced

Privilege escalation

29. A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools.

Which of the following best describes what the security program did?

Data enrichment

Security control plane

Threat feed combination

Single pane of glass

30. Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment.

Given the following output:

Which of the following choices should the analyst look at first?

wh4dc-748gy.lan (192.168.86.152)

lan (192.168.86.22)

imaging.lan (192.168.86.150)

xlaptop.lan (192.168.86.249)

p4wnp1_aloa.lan (192.168.86.56)

Page 4 of 4

31. When starting an investigation, which of the following must be done first?

Notify law enforcement

Secure the scene

Seize all related evidence

Interview the witnesses

32. Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

The lead should review what is documented in the incident response policy or plan

Management level members of the CSIRT should make that decision

The lead has the authority to decide who to communicate with at any t me

Subject matter experts on the team should communicate with others within the specified area of expertise

33. A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization.

Which of the following will produce the data needed for the briefing?

Firewall logs

Indicators of compromise

Risk assessment

Access control lists

34. An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country.

Which of the following describes what the analyst has noticed?

Beaconing

Cross-site scripting

Buffer overflow

PHP traversal

35. A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself.

Which of the following can the analyst perform to see the entire contents of the downloaded files?

Change the display filter to f cp. accive. pore

Change the display filter to tcg.port=20

Change the display filter to f cp-daca and follow the TCP streams

Navigate to the File menu and select FTP from the Export objects option

36. A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst.

Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?

SLA

MOU

NDA

Limitation of liability

37. Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

Command and control

Actions on objectives

Exploitation

Delivery

CS0-003 CompTIA CySA+ Exam Dumps Questions

CS0-003 CompTIA CySA+ Exam Dumps Questions

Share this post

Leave a Reply Cancel reply

Related Posts