A company is deploying new vulnerability scanning software to assess its systems. The current network is highly segmented, and the networking team wants to minimize the number of unique firewall rules. Which of the following scanning techniques would be most efficient to achieve the objective?
Answer(s): A
Option A is correct because deploying agents on all systems enables authenticated, internal scanning without requiring extensive firewall rule changes; agents can push results back centrally, reducing network traversal and rule complexity in a segmented environment. Incorrect — B: non-credentialed scans are less thorough and may miss misconfigurations, not ideal for minimizing firewall rules. Incorrect — C: cloud-based and network scans may introduce egress/GW traversal and require broader firewall access, increasing rule set. Incorrect — D: per-segment sensor deployment with credentialed scans increases complexity and rule management, defeating aim of minimizing unique firewall rules.
Which of the following attributes is part of the Diamond Model of Intrusion Analysis?
Answer(s): D
The Diamond Model of Intrusion Analysis includes four core attributes: Adversary, Infrastructure, Capability, and Victim. These attributes are used to understand and analyze cyber intrusions by examining the relationships between the attacker, their resources, the tools or capabilities they use, and the target they are attacking. Capability in this context refers to the tools, malware, exploits, or techniques that the adversary employs to achieve their objectives. The other options (Delivery, Weaponization, and Command and Control) are part of the Cyber Kill Chain model, not the Diamond Model.
A security administrator needs to import PII data records from the production environment to the test environment for testing purposes. Which of the following would best protect data confidentiality?
Option A is correct because data masking hides PII by replacing sensitive values with non-identical, obfuscated equivalents, preserving data structure for testing while protecting confidentiality. Incorrect — B (Hashing) is irreversible and unsuitable for replacing actual data in test environments where data needs to be usable; it doesn’t preserve format or support multiple records. Incorrect — C (Watermarking) embeds identifiers for ownership or provenance, not primarily for protecting confidentiality of PII. Incorrect — D (Encoding) changes representation but not securely concealment; encoded data could be decoded, failing confidentiality requirements.
The email system administrator for an organization configured DKIM signing for all email legitimately sent by the organization. Which of the following would most likely indicate an email is malicious if the company's domain name is used as both the sender and the recipient?
Option A is correct because a DMARC check failing indicates the email fails domain-based message authentication, reporting, and conformance, which helps detect spoofing even when DKIM is used; this is especially pertinent when the domain appears both as sender and recipient, suggesting tampering or misalignment with DMARC policy. Incorrect —B: The sending IP being the hosting provider does not inherently indicate malicious activity if DKIM is valid; hosting IPs can legitimately send legitimate mail. C: The signature not meeting corporate standards would fail DKIM validity or policy, but the question frames legitimate DKIM for the organization; if DKIM passes, this is not indicative of malicious mail. D: Sender and reply-to being different can be phishing-like, but by itself is not specific to DKIM/DMARC failures and does not confirm malicious activity in this DKIM-enabled scenario.
https://easydmarc.com/tools/dmarc-lookup
During an incident involving phishing, a security analyst needs to find the source of the malicious email. Which of the following techniques would provide the analyst with this information?
Option A is correct because header analysis reveals SMTP path, originating IPs, Received lines, and DKIM/SPF results, enabling source tracing of phishing emails. B) Packet capture analyzes network traffic, not email provenance unless coupled with mail gateway telemetry; not primary for source identification of the phishing email itself. C) SSL inspection decodes TLS traffic content but is not used to identify the email source, and it may violate privacy; not required for header-based origin tracing. D) Reverse engineering analyzes malware or payload internals, not the email source.
An analyst wants to ensure that users only leverage web-based software that has been pre-approved by the organization. Which of the following should be deployed?
Answer(s): B
Option B is correct because allowlisting (whitelisting) explicitly permits only pre-approved web-based software, enforcing strict application control. Incorrect — A: Blocklisting (blacklisting) only denies known bad apps, not guarantee against unapproved software. Incorrect — C: Graylisting delays or requires user action for unknown apps, not a definitive pre-approval mechanism. Incorrect — D: Webhooks are event-driven callbacks, not an access-control mechanism for application usage.
https://www.sentinelone.com/cybersecurity-101/application-whitelisting/
During a cybersecurity incident, one of the web servers at the perimeter network was affected by ransomware. Which of the following actions should be performed immediately?
Answer(s): C
Option C is correct because immediate containment of a compromised host in the perimeter network is essential to prevent lateral movement and further impact. Quarantine isolates the affected server from the network while preserving evidence for forensics and incident response.A) Shut down the server: abrupt shutdown can destroy volatile memory evidence and hinder forensic collection, and may disrupt services unnecessarily before containment is established.B) Reimage the server: not immediate containment; it requires after-action forensics to identify scope and may occur after evidence collection.D) Update the OS to latest version: unrelated to immediate containment and can risk further downtime without addressing the infection.
An organization recently changed its BC and DR plans. Which of the following would best allow for the incident response team to test the changes without any impact to the business?
Option A is correct because tabletop drills allow testing updated BC/DR plans in a risk-free, controlled environment without impacting operations, validating procedures and decision points.B is incorrect because shutting down power to the primary data center is a disruptive, high-impact action that would affect business operations, not a safe test method.C is incorrect because migrating active workloads is an actual failover exercise that can affect service availability and performance, not a low-risk validation of updated plans.D is incorrect because comparing to lessons learned is a review activity, not an active test of the updated incident response processes.
https://www.alertmedia.com/blog/tabletop-exercises/
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.