CS0-003 Actual Questions Answers PDF 100% Cover Real Exam Questions [Q78-Q98]

NEW QUESTION 78
An analyst is remediating items associated with a recent incident. The analyst has isolated the vulnerability and is actively removing it from the system. Which of the following steps of the process does this describe?

Eradication

Recovery

Containment

Preparation

NEW QUESTION 79
Which of the following describes a contract that is used to define the various levels of maintenance to be provided by an external business vendor in a secure environment?

MOU

NDA

BIA

SLA

NEW QUESTION 80
A security audit for unsecured network services was conducted, and the following output was generated:

Which of the following services should the security team investigate further? (Select two).

21

22

23

636

1723

3389

The output shows the results of a port scan, which is a technique used to identify open ports and services running on a network host. Port scanning can be used by attackers to discover potential vulnerabilities and exploit them, or by defenders to assess the security posture and configuration of their network devices1 The output lists six ports that are open on the target host, along with the service name and version associated with each port. The service name indicates the type of application or protocol that is using the port, while the version indicates the specific release or update of the service. The service name and version can provide useful information for both attackers and defenders, as they can reveal the capabilities, features, and weaknesses of the service.
Among the six ports listed, two are particularly risky and should be investigated further by the security team: port 23 and port 636.
Port 23 is used by Telnet, which is an old and insecure protocol for remote login and command execution. Telnet does not encrypt any data transmitted over the network, including usernames and passwords, which makes it vulnerable to eavesdropping, interception, and modification by attackers. Telnet also has many known vulnerabilities that can allow attackers to gain unauthorized access, execute arbitrary commands, or cause denial-of-service attacks on the target host23 Port 636 is used by LDAP over SSL/TLS (LDAPS), which is a protocol for accessing and modifying directory services over a secure connection. LDAPS encrypts the data exchanged between the client and the server using SSL/TLS certificates, which provide authentication, confidentiality, and integrity. However, LDAPS can also be vulnerable to attacks if the certificates are not properly configured, verified, or updated. For example, attackers can use self-signed or expired certificates to perform man-in-the-middle attacks, spoofing attacks, or certificate revocation attacks on LDAPS connections.
Therefore, the security team should investigate further why port 23 and port 636 are open on the target host, and what services are running on them. The security team should also consider disabling or replacing these services with more secure alternatives, such as SSH for port 23 and StartTLS for port 6362

NEW QUESTION 81
A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user’s workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

Create a timeline of events detailinq the date stamps, user account hostname and IP information associated with the activities

Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation

Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identity the case as an HR-related investigation

Notify the SOC manager for awareness after confirmation that the activity was intentional

NEW QUESTION 82
A security analyst performs various types of vulnerability scans. Review the vulnerability scan results to determine the type of scan that was executed and if a false positive occurred for each device.
Instructions:
Select the Results Generated drop-down option to determine if the results were generated from a credentialed scan, non-credentialed scan, or a compliance scan.
For ONLY the credentialed and non-credentialed scans, evaluate the results for false positives and check the findings that display false positives. NOTE: If you would like to uncheck an option that is currently selected, click on the option a second time.
Lastly, based on the vulnerability scan results, identify the type of Server by dragging the Server to the results.
The Linux Web Server, File-Print Server and Directory Server are draggable.
If at any time you would like to bring back the initial state of the simulation, please select the Reset All button.
When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

NEW QUESTION 83
An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?

To satisfy regulatory requirements for incident reporting

To hold other departments accountable

To identify areas of improvement in the incident response process

To highlight the notable practices of the organization’s incident response team

NEW QUESTION 84
A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below:

Which of the following vulnerability types is the security analyst validating?

Directory traversal

XSS

XXE

SSRF

NEW QUESTION 85
You are a cybersecurity analyst tasked with interpreting scan data from Company As servers You must verify the requirements are being met for all of the servers and recommend changes if you find they are not The company’s hardening guidelines indicate the following
* TLS 1 2 is the only version of TLS
running.
* Apache 2.4.18 or greater should be used.
* Only default ports should be used.
INSTRUCTIONS
using the supplied dat
a. record the status of compliance With the company’s guidelines for each server.
The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for Issues based ONLY on the hardening guidelines provided.
Part 1:

AppServ2:

AppServ3:

AppServ4:

Part 2:

check the explanation part below for the solution

NEW QUESTION 86
Which of the following items should be included in a vulnerability scan report? (Choose two.)

Lessons learned

Service-level agreement

Playbook

Affected hosts

Risk score

Education plan

NEW QUESTION 87
A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?

CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/1: K/A: L

CVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

CVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H

CVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H

NEW QUESTION 88
A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?

Wipe the computer and reinstall software

Shut down the email server and quarantine it from the network.

Acquire a bit-level image of the affected workstation.

Search for other mail users who have received the same file.

NEW QUESTION 89
A security analyst is reviewing the following log entries to identify anomalous activity:

Which of the following attack types is occurring?

Directory traversal

SQL injection

Buffer overflow

Cross-site scripting

NEW QUESTION 90
Which of the following is the first step that should be performed when establishing a disaster recovery plan?

Agree on the goals and objectives of the plan

Determine the site to be used during a disaster
C Demonstrate adherence to a standard disaster recovery process

Identity applications to be run during a disaster

NEW QUESTION 91
A digital forensics investigator works from duplicate images to preserve the integrity of the original evidence. Which of the following types of media are most volatile and should be preserved? (Select two).

Memory cache

Registry file

SSD storage

Temporary filesystems

Packet decoding

Swap volume

NEW QUESTION 92
During an incident, a security analyst discovers a large amount of Pll has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee’s personal email. Which of the following should the analyst recommend be done first?

Place a legal hold on the employee’s mailbox.

Enable filtering on the web proxy.

Disable the public email access with CASB.

Configure a deny rule on the firewall.

NEW QUESTION 93
Which of the following best describes the reporting metric that should be utilized when measuring the degree to which a system, application, or user base is affected by an uptime availability outage?

Timeline

Evidence

Impact

Scope

NEW QUESTION 94
You are a penetration tester who is reviewing the system hardening guidelines for a company. Hardening guidelines indicate the following.
There must be one primary server or service per device.
Only default port should be used
Non- secure protocols should be disabled.
The corporate internet presence should be placed in a protected subnet
Instructions :
Using the available tools, discover devices on the corporate network and the services running on these devices.
You must determine
ip address of each device
The primary server or service each device
The protocols that should be disabled based on the hardening guidelines

NEW QUESTION 95
Legacy medical equipment, which contains sensitive data, cannot be patched. Which of the following is the best solution to improve the equipment’s security posture?

Move the legacy systems behind a WAR

Implement an air gap for the legacy systems.

Place the legacy systems in the perimeter network.

Implement a VPN between the legacy systems and the local network.

NEW QUESTION 96
A development team recently released a new version of a public-facing website for testing prior to production. The development team is soliciting the help of various teams to validate the functionality of the website due to its high visibility. Which of the following activities best describes the process the development team is initiating?

Static analysis

Stress testing

Code review

User acceptance testing

NEW QUESTION 97
During a recent site survey. an analyst discovered a rogue wireless access point on the network. Which of the following actions should be taken first to protect the network while preserving evidence?

Run a packet sniffer to monitor traffic to and from the access point.

Connect to the access point and examine its log files.

Identify who is connected to the access point and attempt to find the attacker.

Disconnect the access point from the network

The correct answer is D. Disconnect the access point from the network.
A rogue access point is a wireless access point that has been installed on a network without the authorization or knowledge of the network administrator. A rogue access point can pose a serious security risk, as it can allow unauthorized users to access the network, intercept network traffic, or launch attacks against the network or its devices1234.
The first action that should be taken to protect the network while preserving evidence is to disconnect the rogue access point from the network. This will prevent any further damage or compromise of the network by blocking the access point from communicating with other devices or users. Disconnecting the rogue access point will also preserve its state and configuration, which can be useful for forensic analysis and investigation. Disconnecting the rogue access point can be done physically by unplugging it from the network port or wirelessly by disabling its radio frequency5.
The other options are not the best actions to take first, as they may not protect the network or preserve evidence effectively.
Option A is not the best action to take first, as running a packet sniffer to monitor traffic to and from the access point may not stop the rogue access point from causing harm to the network. A packet sniffer is a tool that captures and analyzes network packets, which are units of data that travel across a network. A packet sniffer can be useful for identifying and troubleshooting network problems, but it may not be able to prevent or block malicious traffic from a rogue access point. Moreover, running a packet sniffer may require additional time and resources, which could delay the response and mitigation of the incident5.
Option B is not the best action to take first, as connecting to the access point and examining its log files may not protect the network or preserve evidence. Connecting to the access point may expose the analyst’s device or credentials to potential attacks or compromise by the rogue access point. Examining its log files may provide some information about the origin and activity of the rogue access point, but it may also alter or delete some evidence that could be useful for forensic analysis and investigation. Furthermore, connecting to the access point and examining its log files may not prevent or stop the rogue access point from continuing to harm the network5.
Option C is not the best action to take first, as identifying who is connected to the access point and attempting to find the attacker may not protect the network or preserve evidence. Identifying who is connected to the access point may require additional tools or techniques, such as scanning for wireless devices or analyzing network traffic, which could take time and resources away from responding and mitigating the incident. Attempting to find the attacker may also be difficult or impossible, as the attacker may use various methods to hide their identity or location, such as encryption, spoofing, or proxy servers. Moreover, identifying who is connected to the access point and attempting to find the attacker may not prevent or stop the rogue access point from causing further damage or compromise to the network5.
Reference:
1 CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives
2 Cybersecurity Analyst+ – CompTIA
3 CompTIA CySA+ CS0-002 Certification Study Guide
4 CertMaster Learn for CySA+ Training – CompTIA
5 How to Protect Against Rogue Access Points on Wi-Fi – Byos
6 Wireless Access Point Protection: 5 Steps to Find Rogue Wi-Fi Networks …
7 Rogue Access Point – Techopedia
8 Rogue access point – Wikipedia
9 What is a Rogue Access Point (Rogue AP)? – Contextual Security

NEW QUESTION 98
Which of the following would help an analyst to quickly find out whether the IP address in a SIEM alert is a known-malicious IP address?

Join an information sharing and analysis center specific to the company’s industry.

Upload threat intelligence to the IPS in STIX/TAXII format.

Add data enrichment for IPS in the ingestion pipleline.

Review threat feeds after viewing the SIEM alert.

CS0-003 Actual Questions Answers PDF 100% Cover Real Exam Questions [Q78-Q98]

[Sep 08, 2025] Free CompTIA Network+ N10-009 Exam Question [Q187-Q203]

Latest DA0-001 Pass Guaranteed Exam Dumps with Accurate & Updated Questions [Q86-Q106]

Jun-2024 CompTIA CAS-004 Actual Questions and Braindumps [Q30-Q44]

Leave a Reply Cancel reply

Related Posts

Leave a Reply Cancel reply