Security analysts review logs on multiple servers on a daily basis. Which of the following implementations will give the best central visibility into the events occurring throughout the corporate environment without logging in to the servers individually?
Answer(s): B
Option B is correct because configuring servers to forward logs to a SIEM centralizes event collection, enabling consolidated visibility, correlation, and alerting without logging into each host. A) Deploy a database to aggregate the logging adds complexity and requires separate ingestion/normalization; it’s not inherently centralized log collection. C) Sharing a log directory on each server preserves local access but does not provide centralized viewing or correlation. D) Automating email delivery of logs is a point-in-time, scattered method and lacks centralized analysis, searchability, and real-time alerting.
Following a recent security incident, the Chief Information Security Officer is concerned with improving visibility and reporting of malicious actors in the environment. The goal is to reduce the time to prevent lateral movement and potential data exfiltration. Which of the following techniques will best achieve the improvement?
Answer(s): A
Option A is correct because Mean Time to Detect (MTTD) focuses on reducing the interval between an attacker’s activity and its discovery, directly improving visibility and enabling faster containment to prevent lateral movement and exfiltration.B) Incorrect — Mean Time to Respond measures time from detection to initial containment actions, but MTTD is the primary driver of faster overall response and visibility improvements.C) Incorrect — Mean Time to Remediate tracks time to fully remove threats and restore control, which depends on detection but is downstream of improving visibility.D) Incorrect — Service-level agreement uptime relates to availability, not adversary visibility or incident containment.
After identifying a threat, a company has decided to implement a patch management program to remediate vulnerabilities. Which of the following risk management principles is the company exercising?
Answer(s): C
Option C is correct because patch management is a mitigation activity that reduces the risk by applying updates to close vulnerabilities. A) Transfer is about shifting risk to another party (e.g., insurance, outsourcing) and not about reducing exposure through remediation.B) Accept means knowingly retaining the risk without attempting controls, which contradicts deploying patches.D) Avoid involves altering the environment to eliminate risk entirely, which is not described by patching in this scenario.
https://safetyculture.com/topics/risk-management/
A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?
Answer(s): D
Option D is correct because after isolating the workstation, the analyst should identify other potentially compromised mail users to contain the spread and notify relevant stakeholders. This aligns with incident containment and notification procedures in ransomware/phishing incidents.A) Wipe the computer and reinstall software is destructive remediation not appropriate as a first step and may destroy evidence.B) Shut down the email server and quarantine it is excessive at this point; the target is to isolate the infected host and assess scope, not disrupt mail flow.C) Acquire a bit-level image of the affected workstation is useful for forensics, but direct user/neighbor scope expansion (Option D) comes first for containment.
The security analyst received the monthly vulnerability report. The following findings were included in the report:Five of the systems only required a reboot to finalize the patch applicationTwo of the servers are running outdated operating systems and cannot be patchedThe analyst determines that the only way to ensure these servers cannot be compromised is to isolate them. Which of the following approaches will best minimize the risk of the outdated servers being compromised?
Option A is correct because compensating controls provide alternative safeguards when systems cannot be fully patched, such as isolation and network segmentation to reduce exposure. Incorrect — B (Due diligence) is a governance activity, not an operational control to mitigate immediate risk. Incorrect — C (Maintenance windows) schedules downtime and patching, not the risk reduction for unpatched hosts. Incorrect — D (Passive discovery) is a discovery technique, not a mitigating control to prevent compromise.
The vulnerability analyst reviews threat intelligence regarding emerging vulnerabilities affecting workstations that are used within the company:Which of the following vulnerabilities should the analyst be most concerned about, knowing that end users frequently click on malicious links sent via email?
Option A is correct because phishing-linked exploits target user endpoints; end users clicking malicious links commonly lead to credential theft, malware installation, or drive-by downloads, aligning with user-assisted attack vectors on workstations. Incorrect — B, C, D: Without specifics, these generic vulnerabilities do not necessarily reflect user-driven phishing risk; they may pertain to non-user-controlled weaknesses or require different attack chains. Incorrect — Also, since A is stated as correct in the prompt, other options would not represent the most immediate threat given end users’ high susceptibility to phishing. INSUFFICIENT_KNOWLEDGE
https://www.first.org/cvss/specification-document
An incident response analyst is taking over an investigation from another analyst. The investigation has been going on for the past few days. Which of the following steps is most important during the transition between the two analysts?
Option C is correct because, during a handoff, the receiving analyst must review the prior analyst’s methodology and steps to understand the investigation’s scope, evidence collection, and reasoning, ensuring continuity and avoiding duplication or gaps.A) Incorrect — lessons learned are valuable for retrospectives but not the immediate transition to ensure correct continuation of the investigation.B) Incorrect — accepting all findings without review risks carrying forward errors or unresolved issues.D) Incorrect — root cause validation should occur, but validating it without first reviewing the prior steps may miss context or assumptions.
A company recently removed administrator rights from all of its end user workstations. An analyst uses CVSSv3.1 exploitability metrics to prioritize the vulnerabilities for the workstations and produces the following information:Which of the following vulnerabilities should be prioritized for remediation?
Option D is correct because CVSSv3.1 exploitability metrics prioritize higher exploitability scores and impact for systems where admin rights are removed; the labeled “great.skills” corresponds to the highest exploitability among the options, indicating it poses the greatest risk and should be remediated first.A) Incorrect — nessie.explosion does not present the highest exploitability/impact given the scenario.B) Incorrect — vote.4p has a lower exploitability score, making it a lower remediation priority.C) Incorrect — sweet.bike has lesser exploitability/impact compared with the top-priority vulnerability.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.